joyce8/EMBER2024-capa huggingface dataset:
Function at 0x794350
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
jmp 0x794360
push ebp
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x79453c
mov ebx, edx
mov esi, ecx
call fcn.00795930
test eax, eax
jne 0x79438f
mov ecx, 0x4ce
call fcn.00780040
mov edi, 0x15
jmp 0x79453c
push dword [esi + 0xc]
call fcn.007801d0
add esp, 4
test byte [esi + 0x58], 8
je 0x7943b4
push 0
push esi
push dword [esi + 0xd0]
push 8
call dword [esi + 0xcc]
add esp, 0x10
mov ecx, esi
call fcn.00846820
mov ecx, esi
call fcn.007af200
test ebx, ebx
jne 0x79452e
mov ecx, esi
call fcn.008468a0
test eax, eax
je 0x79452e
mov edx, 0x79c560
movzx ecx, byte [0xbbdaab]
imul edx, edx
and edx, 3
cmp edx, 2
sete al
xor al, 5
add al, 0x24
and al, 7
movzx eax, al
bt ecx, eax
jb 0x79450c
mov al, byte [0xbbdaab]
cmp edx, 2
mov ah, 1
sete cl
xor cl, 5
add cl, 0x24
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbdaab], ah
jne 0x794408
mov ecx, 0x79c560
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
xor dl, 5
add dl, 0x24
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x794472
cmp ecx, 2
movzx edx, byte [0xbbdaab]
sete al
xor al, 5
add al, 0x24
and al, 7
movzx eax, al
bt edx, eax
jae 0x794452
jmp 0x79450c
xor edx, edx
cmp ecx, 2
movzx ecx, byte [0xbbdaab]
sete dl
xor edx, 0xb32043ed
add edx, 0x1024
mov eax, edx
and al, 7
movzx eax, al
bt ecx, eax
jb 0x7944e5
mov edi, 0xbbda60
xor eax, eax
mov ebx, dword [edi]
mov ecx, eax
mov ebp, edx
inc eax
shl ebp, cl
xor cl, 0x1f
xor ebx, edx
shr edx, cl
mov dword [edi], ebx
or edx, ebp
not ebx
add edi, 4
imul edx, ebx
cmp eax, 0x12
jne 0x7944a0
mov eax, 0x79c560
imul eax, eax
and eax, 3
cmp eax, 2
mov al, 1
sete cl
xor cl, 5
add cl, 0x24
and cl, 7
shl al, cl
or byte [0xbbdaab], al
mov eax, 0x79c560
imul eax, eax
and eax, 3
cmp eax, 2
mov al, 0xfe
sete cl
xor cl, 5
add cl, 0x24
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbbdaab], al
push 0xbbda60
push 5
push esi
call fcn.00787000
add esp, 0xc
push dword [esi + 0xc]
call fcn.007801e0
add esp, 4
mov edi, 5
jmp 0x79453c
mov ecx, esi
mov dword [esi + 0x60], 0x64cffc7f
call fcn.007888a0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x795930
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx + 0x60]
mov eax, 1
cmp ecx, 0xa029a697
je 0x795aa7
cmp ecx, 0xf03b7906
je 0x795aa7
cmp ecx, 0x4b771290
je 0x795aa7
push esi
mov edx, fcn.007c8020
movzx ecx, byte [0xbbdf43]
and edx, 1
inc edx
mov eax, edx
xor eax, fcn.007c8020
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x795a9a
mov al, byte [0xbbdf43]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007c8020
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbdf43], ah
jne 0x79598c
mov ecx, fcn.007c8020
movzx eax, al
and ecx, 1
inc ecx
mov edx, ecx
xor edx, fcn.007c8020
sete dl
not dl
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7959f8
mov eax, ecx
movzx edx, byte [0xbbdf43]
xor eax, fcn.007c8020
sete al
not al
and al, 3
movzx eax, al
bt edx, eax
jae 0x7959d6
jmp 0x795a9a
xor ecx, fcn.007c8020
movzx ecx, byte [0xbbdf43]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x795a77
mov eax, fcn.007c8020
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007c8020
mov eax, dword [0xbbdf34]
sete cl
xor ecx, 0x9124670b
add ecx, 0x11e0
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbbdf34], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbbdf38]
lea esi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbbdf38], eax
or esi, edx
not eax
mov dl, 1
imul eax, esi
shl dl, cl
xor dword [0xbbdf3c], eax
or byte [0xbbdf43], dl
mov eax, fcn.007c8020
and eax, 1
inc eax
xor eax, fcn.007c8020
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbbdf43], al
mov ecx, 0xbbdf34
call fcn.007d3420
xor eax, eax
pop esi
ret
Function at 0x798c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0xbd33e0]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x18]
xor eax, esp
mov dword [esp + 0x1c], eax
call fcn.00798c20
xor esi, esi
test edi, edi
js 0x798d83
cmp dword [esp + 0x18], edi
jle 0x798d83
mov eax, fcn.007985d0
not eax
and eax, 1
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edi, dword [esi*4 + 0xb530f0]
mov ebp, dword [esi*4 + 0xb53110]
mov dword [esp + 0x14], esi
add ecx, fcn.007985d0
sete al
mov ecx, eax
not ecx
and ecx, 0x809
lea edx, [eax + ecx*2 + 0x666c63f6]
mov eax, 1
xor edx, dword [esi*4 + str.p_aYW]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x798d6a
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x798cef
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x798d11
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x798d06
jmp 0x798d6a
mov dword [esp + 8], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x798d60
lea ecx, [ebp - 4]
shr ecx, 2
je 0x798d58
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x798d2e
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x14]
inc esi
cmp esi, 5
jne 0x798c81
mov eax, dword [esp + 0x34]
mov esi, dword [eax*4 + 0xb50d60]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7997c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, fcn.007a72b0
mov esi, fcn.007a72b0
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 4], ecx
xor esi, 2
or eax, 2
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
xor eax, eax
mov esi, dword [edx*4 + 0xb559d0]
mov ebp, dword [edx*4 + 0xb55b10]
mov dword [esp + 0x1c], edx
add ecx, dword [esp + 0x10]
sete al
mov ecx, eax
xor ecx, 0xd75a0b71
lea ebx, [ecx + eax*2 + 0x900]
mov eax, 1
xor ebx, dword [edx*4 + 0xb53150]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [esi + ebp - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x7998d0
mov dword [esp + 8], eax
mov al, byte [esi + ebp - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x799853
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x799875
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x79986a
jmp 0x7998d0
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x7998ca
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7998c2
xor eax, eax
mov edi, esi
mov dword [esp + 0x18], ecx
mov ecx, edi
mov dword [esp + 0x20], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x20]
add edi, 4
cmp eax, ecx
jne 0x79988e
mov eax, dword [esp + 8]
or byte [esi + ebp - 1], al
not dl
and byte [esi + ebp - 1], dl
mov edx, dword [esp + 0x1c]
inc edx
cmp edx, 0x50
jne 0x7997e9
xor ebx, ebx
cmp dword [esp + 0xc], 0
sete bl
push 0
push 0
push 0xffffffffffffffff
push dword [esp + 0x10]
push 0
push ebx
call dword [0xbb36d8]
mov ebp, eax
add ebp, eax
je 0x799935
shl eax, 2
xor edx, edx
xor esi, esi
mov ecx, eax
call fcn.007870a0
test eax, eax
je 0x799937
mov edi, eax
push ebp
push eax
push 0xffffffffffffffff
push dword [esp + 0x10]
push 0
push ebx
call dword [0xbb36d8]
test eax, eax
mov esi, edi
jne 0x799937
push edi
call fcn.00780f60
add esp, 4
xor esi, esi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x799950
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.0080c680
mov dword [esp + 4], ecx
xor ecx, ecx
mov dword [esp + 0xc], edx
and eax, 1
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ebp, dword [ecx*4 + 0xb559d0]
mov esi, dword [ecx*4 + 0xb55b10]
mov dword [esp + 0x18], ecx
xor eax, fcn.0080c680
mov eax, 1
sete bl
xor ebx, 0xf3e369fd
add ebx, 4
xor ebx, dword [ecx*4 + 0xb53290]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x799a50
mov dword [esp + 8], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x7999d3
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x7999f5
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x7999ea
jmp 0x799a50
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x799a4a
lea ecx, [esi - 4]
shr ecx, 2
je 0x799a42
xor eax, eax
mov edi, ebp
mov dword [esp + 0x14], ecx
mov ecx, edi
mov dword [esp + 0x1c], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x1c]
add edi, 4
cmp eax, ecx
jne 0x799a0e
mov eax, dword [esp + 8]
or byte [ebp + esi - 1], al
not dl
and byte [ebp + esi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x79996e
xor ebx, ebx
cmp dword [esp + 0xc], 0
sete bl
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esp + 0x18]
push 0
push ebx
call dword [0xbb3750]
xor edi, edi
test eax, eax
je 0x799abf
mov edx, eax
mov ecx, eax
mov ebp, eax
sar edx, 0x1f
call fcn.007870a0
test eax, eax
je 0x799abf
mov esi, eax
push 0
push 0
push ebp
push eax
push 0xffffffffffffffff
push dword [esp + 0x18]
push 0
push ebx
call dword [0xbb3750]
test eax, eax
je 0x799ab6
mov edi, esi
jmp 0x799abf
push esi
call fcn.00780f60
add esp, 4
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x79cac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1fc
mov eax, dword [0xbd33e0]
mov ebx, dword [esp + 0x214]
mov esi, ecx
mov edi, edx
mov ecx, edx
mov edx, 0x1f4
xor eax, esp
mov dword [esp + 0x1f8], eax
lea eax, [esp + 4]
mov byte [esp + 4], 0
push eax
call fcn.0079cd40
add esp, 4
test ebx, ebx
mov edx, 0xc26b11
mov eax, 0x2401
cmovne edx, ebx
xor ebp, ebp
movzx ecx, byte [esp + ebp + 4]
cmp ecx, 0xd
ja 0x79cb1c
bt eax, ecx
jb 0x79cb1f
inc ebp
jmp 0x79cb0d
mov ebx, 0x78b490
movzx ecx, byte [0xbb47a3]
and ebx, 1
inc ebx
mov eax, ebx
xor eax, 0x78b490
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x79ccf3
mov al, byte [0xbb47a3]
mov ecx, ebx
mov ah, 1
xor ecx, 0x78b490
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb47a3], ah
jne 0x79cb4e
mov ecx, 0x78b490
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, 0x78b490
movzx ebx, al
sete ah
not ah
and ah, 3
xor ah, 7
movzx eax, ah
bt ebx, eax
jae 0x79cbba
mov eax, ecx
movzx ebx, byte [0xbb47a3]
xor eax, 0x78b490
sete al
not al
and al, 3
movzx eax, al
bt ebx, eax
jae 0x79cb98
jmp 0x79ccf3
xor ecx, 0x78b490
movzx ecx, byte [0xbb47a3]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x79ccd0
mov eax, 0x78b490
xor ecx, ecx
and eax, 1
inc eax
xor eax, 0x78b490
mov eax, dword [0xbb4780]
sete cl
xor ecx, 0x8fe4e00b
or ecx, 0xce0
xor eax, ecx
mov dword [esp], ecx
mov dword [0xbb4780], eax
not eax
mov ebx, dword [0xbb4784]
imul ecx, eax, 0x8fe4eceb
lea eax, [ecx + ecx]
xor ebx, ecx
shr ecx, 0x1e
mov dword [0xbb4784], ebx
or eax, ecx
not ebx
imul ebx, eax
mov eax, dword [0xbb4788]
lea ecx, [ebx*4]
xor eax, ebx
shr ebx, 0x1d
mov dword [0xbb4788], eax
or ecx, ebx
not eax
imul eax, ecx
mov ecx, dword [0xbb478c]
lea ebx, [eax*8]
xor ecx, eax
shr eax, 0x1c
mov dword [0xbb478c], ecx
or ebx, eax
not ecx
mov eax, dword [0xbb4790]
imul ecx, ebx
mov ebx, ecx
shl ebx, 4
xor eax, ecx
shr ecx, 0x1b
mov dword [0xbb4790], eax
or ecx, ebx
not eax
imul eax, ecx
mov ecx, dword [0xbb4794]
mov ebx, eax
shl ebx, 5
xor ecx, eax
shr eax, 0x1a
mov dword [0xbb4794], ecx
or eax, ebx
not ecx
imul ecx, eax
mov eax, dword [0xbb4798]
mov ebx, ecx
shl ebx, 6
xor eax, ecx
shr ecx, 0x19
mov dword [0xbb4798], eax
or ecx, ebx
not eax
imul eax, ecx
mov ecx, dword [esp]
xor dword [0xbb479c], eax
mov al, 1
and cl, 3
shl al, cl
or byte [0xbb47a3], al
mov eax, 0x78b490
and eax, 1
inc eax
xor eax, 0x78b490
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb47a3], al
lea eax, [esp + 4]
mov byte [esp + ebp + 4], 0
push eax
push edx
push dword [esp + 0x218]
push edi
push dword [esp + 0x228]
push 0xbb4780
push esi
call fcn.00783470
add esp, 0x1c
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x1fc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x79d260
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.007882e0
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 4], edx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp dword [esp + 0x10], 1
mov ebp, dword [ecx*4 + 0xb559d0]
mov esi, dword [ecx*4 + 0xb55b10]
mov dword [esp + 0x18], ecx
mov eax, 1
seta bl
or ebx, 0x65437e96
add ebx, 0x280
xor ebx, dword [ecx*4 + 0xb542f0]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x79d361
mov dword [esp + 8], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x79d2e4
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x79d306
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x79d2fb
jmp 0x79d361
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x79d35b
lea ecx, [esi - 4]
shr ecx, 2
je 0x79d353
xor eax, eax
mov edi, ebp
mov dword [esp + 0x14], ecx
mov ecx, edi
mov dword [esp + 0x1c], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x1c]
add edi, 4
cmp eax, ecx
jne 0x79d31f
mov eax, dword [esp + 8]
or byte [ebp + esi - 1], al
not dl
and byte [ebp + esi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x79d280
call dword [0xbb35b8]
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
cmp ecx, dword [0xbb47e4]
jge 0x79d39c
cmp eax, 0x36
jg 0x79d3aa
mov edx, eax
add edx, 0xfffffffb
cmp edx, 0x1c
ja 0x79d39c
mov esi, 0x18000001
bt esi, edx
jb 0x79d3c7
mov edx, dword [esp + 4]
xor ecx, ecx
test edx, edx
je 0x79d3df
mov dword [edx], eax
jmp 0x79d3df
cmp eax, 0x78
jg 0x79d3bb
cmp eax, 0x37
je 0x79d3c7
cmp eax, 0x40
jne 0x79d39c
jmp 0x79d3c7
cmp eax, 0x4cf
je 0x79d3c7
cmp eax, 0x79
jne 0x79d39c
inc ecx
imul ecx, dword [0xbb47e8]
push ecx
call fcn.00783970
add esp, 4
inc dword [edi]
mov ecx, 1
mov eax, ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x79ded0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov edx, fcn.007a6360
xor ecx, ecx
mov eax, dword [0xbd33e0]
imul edx, edx
and edx, 3
xor eax, esp
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], edx
xor ebx, ebx
cmp dword [esp + 0x10], 3
mov ebp, dword [ecx*4 + 0xb559d0]
mov edi, dword [ecx*4 + 0xb55b10]
mov dword [esp + 0x18], ecx
mov eax, 1
sete bl
xor ebx, 0x24619b83
or ebx, 0x60
xor ebx, dword [ecx*4 + 0xb546b0]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x79dfd9
mov dword [esp + 8], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x79df5c
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x79df7e
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x79df73
jmp 0x79dfd9
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x79dfd3
lea ecx, [edi - 4]
shr ecx, 2
je 0x79dfcb
xor eax, eax
mov esi, ebp
mov dword [esp + 0x14], ecx
mov ecx, esi
mov dword [esp + 0x1c], esi
mov esi, dword [esi]
mov dword [esp], ebx
xor esi, ebx
mov dword [ecx], esi
mov ecx, eax
not esi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, esi
mov esi, dword [esp + 0x1c]
add esi, 4
cmp eax, ecx
jne 0x79df97
mov eax, dword [esp + 8]
or byte [ebp + edi - 1], al
not dl
and byte [ebp + edi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x79defb
mov eax, dword [0xc26a74]
cmp eax, 2
je 0x79dffa
call fcn.00783aa0
test eax, eax
je 0x79e041
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x58]
push 0
push dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [0xbb36c0]
jmp 0x79e059
push 0
push dword [esp + 0x54]
push 0
push dword [esp + 0x58]
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [0xbb36b4]
mov ecx, dword [esp + 0x34]
mov esi, eax
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x79e540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov ecx, fcn.007c3d70
mov edx, fcn.007c3d70
xor edi, edi
mov eax, dword [0xbd33e0]
and ecx, 1
xor ecx, edx
xor eax, esp
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], ecx
xor eax, eax
cmp dword [esp + 0x14], 0xffffffff
mov ebp, dword [edi*4 + 0xb559d0]
mov esi, dword [edi*4 + 0xb55b10]
mov dword [esp + 0x1c], edi
sete al
mov ecx, eax
not ecx
and ecx, 0x861
lea edx, [eax + ecx*2 - 0x75ed48f2]
mov eax, 1
xor edx, dword [edi*4 + 0xb54a70]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x79e653
mov dword [esp + 0xc], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x79e5d8
mov ecx, dword [esp + 0xc]
movzx eax, al
test ebx, eax
je 0x79e5fa
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x79e5ef
jmp 0x79e653
mov dword [esp + 0x10], ebx
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x79e649
lea ecx, [esi - 4]
shr ecx, 2
je 0x79e641
xor eax, eax
mov ebx, ebp
mov dword [esp + 0x18], ecx
mov edi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor edi, edx
shr edx, cl
mov ecx, dword [esp + 0x18]
or edx, dword [esp]
mov dword [ebx], edi
not edi
add ebx, 4
imul edx, edi
cmp eax, ecx
jne 0x79e617
mov eax, dword [esp + 0xc]
or byte [ebp + esi - 1], al
mov eax, dword [esp + 0x10]
not al
and byte [ebp + esi - 1], al
mov edi, dword [esp + 0x1c]
inc edi
cmp edi, 0x50
jne 0x79e56f
mov eax, dword [0xc26a74]
cmp eax, 2
je 0x79e674
call fcn.00783aa0
test eax, eax
je 0x79e6b7
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x54]
push 0
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [0xbb3738]
jmp 0x79e6cf
push 0
push dword [esp + 0x50]
push 0
push dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [0xbb372c]
mov ecx, dword [esp + 0x34]
mov esi, eax
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a00c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov edx, 3
push 1
push pe_nt_image_headers32
call fcn.007a02b0
add esp, 8
test eax, eax
jne 0x7a0277
cmp byte [esi + 0x50], 0
je 0x7a010f
mov byte [esi + 0x51], 1
mov ecx, esi
mov edx, 1
push 1
push pe_nt_image_headers32
call fcn.007a02b0
add esp, 8
mov esi, 0x508
jmp 0x7a026d
lea eax, [esi + 8]
push 0
push 0
push eax
call fcn.0079a710
add esp, 0xc
mov edi, eax
mov ecx, esi
mov edx, 1
push 1
push pe_nt_image_headers32
call fcn.007a02b0
add esp, 8
test edi, edi
je 0x7a0277
mov eax, fcn.0083b650
xor ecx, ecx
mov dword [esp + 8], esi
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor edx, edx
cmp dword [esp + 0x10], 1
mov edi, dword [ecx*4 + 0xb550e0]
mov ebp, dword [ecx*4 + 0xb55230]
mov dword [esp + 0x18], ecx
mov eax, 1
seta dl
xor edx, 0xcdf7b2e3
add edx, 0xa28
xor edx, dword [ecx*4 + str.__8]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7a0233
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7a01b8
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x7a01da
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7a01cf
jmp 0x7a0233
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7a0229
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7a0221
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7a01f7
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x51
jne 0x7a0154
mov eax, dword [esp + 8]
mov edi, dword [eax + 4]
call dword [0xbb35b8]
mov esi, 0x120a
mov ecx, 0x120a
mov edx, eax
push 0x317a
push edi
push 0xbb4ae0
call fcn.0079cac0
add esp, 0xc
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, 2
push 1
push pe_nt_image_headers32
call fcn.007a02b0
add esp, 0x24
jmp 0x7a0272
Function at 0x7a02b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ebx, ecx
cmp edx, 3
je 0x7a02e2
mov edi, edx
mov edx, 1
cmp edi, 1
jne 0x7a02e7
lea ecx, [ebx + 0x10]
mov edx, eax
push esi
call fcn.0079e540
add esp, 4
jmp 0x7a02f4
mov edx, 3
lea ecx, [ebx + 0x10]
push esi
push eax
call fcn.0079ded0
add esp, 8
xor ecx, ecx
test eax, eax
jne 0x7a0410
mov eax, fcn.00826850
mov dword [esp + 8], ebx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor edx, edx
cmp dword [esp + 0x10], 2
mov edi, dword [ecx*4 + 0xb559d0]
mov ebp, dword [ecx*4 + 0xb55b10]
mov dword [esp + 0x18], ecx
mov eax, 1
sete dl
xor edx, 0xe5735e97
add edx, 0x210
xor edx, dword [ecx*4 + 0xb554d0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7a03f0
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7a0375
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x7a0397
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7a038c
jmp 0x7a03f0
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7a03e6
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7a03de
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7a03b4
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x7a0311
call dword [0xbb35b8]
mov ecx, dword [esp + 8]
mov dword [ecx + 0x58], eax
mov ecx, 5
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret