joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fd050
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, ecx
test edx, edx
je 0x7fd077
mov ebx, edx
mov ecx, dword [ebx]
mov edx, edi
call fcn.00777e20
test eax, eax
je 0x7fd23d
mov ebx, dword [ebx + 0x24]
test ebx, ebx
jne 0x7fd05f
mov edx, fcn.0077c9f0
xor eax, eax
movzx ebx, byte [0xbb0eb7]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.0077c9f0
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x7fd22c
mov al, byte [0xbb0eb7]
mov ebx, edx
xor ecx, ecx
mov ah, 1
xor ebx, fcn.0077c9f0
sete cl
mov ebx, ecx
not ebx
lea ecx, [ecx + ebx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb0eb7], ah
jne 0x7fd0af
mov ecx, fcn.0077c9f0
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, fcn.0077c9f0
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7fd134
mov edx, ecx
xor eax, eax
movzx ebx, byte [0xbb0eb7]
xor edx, fcn.0077c9f0
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x7fd109
jmp 0x7fd22c
xor eax, eax
xor ecx, fcn.0077c9f0
movzx edx, byte [0xbb0eb7]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7fd201
mov ecx, fcn.0077c9f0
xor eax, eax
and ecx, 1
inc ecx
xor ecx, fcn.0077c9f0
sete al
mov ecx, eax
not ecx
and ecx, 0x40b
lea ecx, [eax + ecx*2 - 0x2712465c]
mov eax, dword [0xbb0ea0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb0ea0], eax
not eax
imul edx, eax
mov eax, dword [0xbb0ea4]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb0ea4], eax
or ebx, edx
not eax
mov edx, dword [0xbb0ea8]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb0ea8], edx
or ebx, eax
not edx
mov eax, dword [0xbb0eac]
imul edx, ebx
lea ebx, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb0eac], eax
or ebx, edx
not eax
mov dl, 1
imul eax, ebx
shl dl, cl
xor dword [0xbb0eb0], eax
or byte [0xbb0eb7], dl
mov eax, fcn.0077c9f0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0077c9f0
sete cl
mov eax, ecx
not eax
lea ecx, [ecx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb0eb7], al
push edi
push 0xbb0ea0
push esi
call fcn.00782570
add esp, 0xc
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
ret
Function at 0x800e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [edx + 0x10]
xor ebx, ebx
test eax, eax
je 0x80100f
test byte [edx + 0x28], 2
mov ebp, edx
je 0x80100f
mov edi, dword [ebp + 0x40]
mov esi, dword [eax + 8]
mov dword [esp], ecx
test esi, esi
je 0x800e61
mov ecx, dword [esi]
mov edx, edi
call fcn.00777e20
test eax, eax
je 0x80100c
mov esi, dword [esi + 0x14]
jmp 0x800e47
mov eax, fcn.007ba0b0
mov edx, 3
movzx ecx, byte [0xbb1247]
sub edx, eax
mov eax, edx
xor eax, fcn.007ba0b0
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x800fec
mov al, byte [0xbb1247]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007ba0b0
sete cl
not cl
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb1247], ah
jne 0x800e93
mov edx, fcn.007ba0b0
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.007ba0b0
sete dl
not dl
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x800f02
mov eax, ecx
movzx edx, byte [0xbb1247]
xor eax, fcn.007ba0b0
sete al
not al
and al, 7
movzx eax, al
bt edx, eax
jae 0x800ee0
jmp 0x800fec
xor ecx, fcn.007ba0b0
movzx ecx, byte [0xbb1247]
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x800fc5
mov eax, fcn.007ba0b0
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb1230]
xor edx, fcn.007ba0b0
sete cl
xor ecx, 0x9b007c5f
add ecx, 0x500
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb1230], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb1234]
lea esi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb1234], eax
or esi, edx
not eax
mov edx, dword [0xbb1238]
imul eax, esi
lea esi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb1238], edx
or esi, eax
not edx
mov eax, dword [0xbb123c]
imul edx, esi
lea esi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb123c], eax
or esi, edx
not eax
mov dl, 1
imul eax, esi
shl dl, cl
xor dword [0xbb1240], eax
or byte [0xbb1247], dl
mov eax, fcn.007ba0b0
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.007ba0b0
sete cl
not cl
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb1247], al
push 0
push edi
push 0xbb1230
mov esi, dword [esp + 0xc]
push esi
call fcn.00782570
add esp, 0x10
mov byte [esi + 0x11], 1
mov ebx, 1
jmp 0x80100f
mov dword [ebp + 0x44], esi
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x801fc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, fcn.008219a0
mov esi, ecx
xor eax, eax
not edx
and edx, 1
mov ecx, edx
add ecx, fcn.008219a0
movzx ecx, byte [0xbb1183]
setne al
bt ecx, eax
jb 0x8020c5
mov al, byte [0xbb1183]
mov ecx, edx
mov ah, 1
add ecx, fcn.008219a0
setne cl
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb1183], ah
jne 0x801fef
mov ecx, fcn.008219a0
movzx eax, al
not ecx
and ecx, 1
mov edx, ecx
add edx, fcn.008219a0
setne dl
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x80204b
mov edx, ecx
xor eax, eax
add edx, fcn.008219a0
movzx edx, byte [0xbb1183]
setne al
bt edx, eax
jae 0x802030
jmp 0x8020c5
xor eax, eax
add ecx, fcn.008219a0
movzx ecx, byte [0xbb1183]
setne al
bt ecx, eax
jb 0x8020a6
mov eax, fcn.008219a0
xor ecx, ecx
mov dl, 1
not eax
and eax, 1
add eax, fcn.008219a0
mov eax, dword [0xbb1178]
sete cl
xor ecx, 0x2156b6b1
add ecx, 0x288
xor eax, ecx
mov dword [0xbb1178], eax
not eax
imul eax, ecx
and cl, 7
shl dl, cl
xor dword [0xbb117c], eax
or byte [0xbb1183], dl
mov eax, fcn.008219a0
not eax
and eax, 1
add eax, fcn.008219a0
mov al, 0xfe
setne cl
xor cl, 7
rol al, cl
and byte [0xbb1183], al
mov ecx, esi
mov edx, 0xbb1178
call fcn.00777e20
test eax, eax
jne 0x8020dc
mov eax, 0x10000000
pop esi
ret
mov edx, fcn.00794990
movzx ecx, byte [0xbb118f]
and edx, 1
inc edx
mov eax, edx
xor eax, fcn.00794990
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x802200
mov al, byte [0xbb118f]
mov ecx, edx
mov ah, 1
xor ecx, fcn.00794990
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb118f], ah
jne 0x80210b
mov ecx, fcn.00794990
movzx eax, al
and ecx, 1
inc ecx
mov edx, ecx
xor edx, fcn.00794990
sete dl
not dl
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x802177
mov eax, ecx
movzx edx, byte [0xbb118f]
xor eax, fcn.00794990
sete al
not al
and al, 3
movzx eax, al
bt edx, eax
jae 0x802155
jmp 0x802200
xor ecx, fcn.00794990
movzx ecx, byte [0xbb118f]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x8021dd
mov eax, fcn.00794990
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00794990
mov eax, dword [0xbb1184]
sete cl
xor ecx, 0x8fed9b53
add ecx, 0x818
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb1184], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
xor dword [0xbb1188], edx
mov dl, 1
shl dl, cl
or byte [0xbb118f], dl
mov eax, fcn.00794990
and eax, 1
inc eax
xor eax, fcn.00794990
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb118f], al
mov ecx, esi
mov edx, 0xbb1184
call fcn.00777e20
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
shl eax, 0x1d
pop esi
ret
Function at 0x802d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, fcn.00777b20
mov ebx, 3
mov esi, ecx
movzx ecx, byte [0xbb135f]
mov ebp, dword [esp + 0x18]
sub ebx, eax
mov eax, ebx
xor eax, fcn.00777b20
sete al
xor al, 5
add al, 4
and al, 7
movzx eax, al
bt ecx, eax
jb 0x802e87
mov al, byte [0xbb135f]
mov ecx, ebx
mov ah, 1
xor ecx, fcn.00777b20
sete cl
xor cl, 5
add cl, 4
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb135f], ah
jne 0x802d5f
mov edi, fcn.00777b20
mov ecx, 3
sub ecx, edi
mov edi, ecx
xor edi, fcn.00777b20
sete ah
xor ah, 5
add ah, 4
and ah, 7
xor ah, 7
movzx edi, ah
movzx eax, al
bt eax, edi
jae 0x802dd8
mov eax, ecx
movzx edi, byte [0xbb135f]
xor eax, fcn.00777b20
sete al
xor al, 5
add al, 4
and al, 7
movzx eax, al
bt edi, eax
jae 0x802db4
jmp 0x802e87
xor ebx, ebx
xor ecx, fcn.00777b20
movzx ecx, byte [0xbb135f]
sete bl
xor ebx, 0x40418d9d
add ebx, 0x404
mov eax, ebx
and al, 7
movzx eax, al
bt ecx, eax
jb 0x802e5c
mov edi, 0xbb1320
xor eax, eax
mov dword [esp], esi
mov ebp, dword [edi]
mov ecx, eax
mov esi, ebx
inc eax
shl esi, cl
xor cl, 0x1f
xor ebp, ebx
shr ebx, cl
mov dword [edi], ebp
or ebx, esi
not ebp
add edi, 4
imul ebx, ebp
cmp eax, 0xf
jne 0x802e0c
mov eax, fcn.00777b20
mov ecx, 3
mov ebp, dword [esp + 0x18]
sub ecx, eax
mov al, 1
xor ecx, fcn.00777b20
sete cl
xor cl, 5
add cl, 4
and cl, 7
shl al, cl
or byte [0xbb135f], al
mov esi, dword [esp]
mov eax, fcn.00777b20
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.00777b20
sete cl
xor cl, 5
add cl, 4
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb135f], al
push dword [esp + 0x1c]
push edx
push ebp
push 0xbb1320
push esi
call fcn.00782570
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x803c20
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
movzx eax, word [edx + 0x10]
mov esi, ecx
mov ecx, eax
or ecx, 1
test al, 0x60
mov word [edx + 0x10], cx
je 0x803ebe
mov edx, fcn.00795680
movzx ecx, byte [0xbb171b]
not edx
and edx, 1
mov eax, edx
add eax, fcn.00795680
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x803eb0
mov al, byte [0xbb171b]
mov ecx, edx
mov ah, 1
add ecx, fcn.00795680
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb171b], ah
jne 0x803c69
mov ecx, fcn.00795680
movzx eax, al
not ecx
and ecx, 1
mov edx, ecx
add edx, fcn.00795680
sete dl
not dl
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x803cd6
mov eax, ecx
movzx edx, byte [0xbb171b]
add eax, fcn.00795680
sete al
not al
and al, 3
movzx eax, al
bt edx, eax
jae 0x803cb4
jmp 0x803eb0
add ecx, fcn.00795680
movzx ecx, byte [0xbb171b]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x803e8c
mov eax, fcn.00795680
xor ecx, ecx
not eax
and eax, 1
add eax, fcn.00795680
mov eax, dword [0xbb16e0]
sete cl
xor ecx, 0x2bd26d1b
add ecx, 0x580
xor eax, ecx
mov dword [0xbb16e0], eax
not eax
mov edx, dword [0xbb16e4]
imul eax, ecx
and cl, 7
lea edi, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbb16e4], edx
or edi, eax
not edx
mov eax, dword [0xbb16e8]
imul edx, edi
lea edi, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbb16e8], eax
or edi, edx
not eax
mov edx, dword [0xbb16ec]
imul eax, edi
lea edi, [eax*8]
xor edx, eax
shr eax, 0x1c
mov dword [0xbb16ec], edx
or edi, eax
not edx
mov eax, dword [0xbb16f0]
imul edx, edi
mov edi, edx
shl edi, 4
xor eax, edx
shr edx, 0x1b
mov dword [0xbb16f0], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb16f4]
mov edi, eax
shl edi, 5
xor edx, eax
shr eax, 0x1a
mov dword [0xbb16f4], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbb16f8]
mov edi, edx
shl edi, 6
xor eax, edx
shr edx, 0x19
mov dword [0xbb16f8], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb16fc]
mov edi, eax
shl edi, 7
xor edx, eax
shr eax, 0x18
mov dword [0xbb16fc], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbb1700]
mov edi, edx
shl edi, 8
xor eax, edx
shr edx, 0x17
mov dword [0xbb1700], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb1704]
mov edi, eax
shl edi, 9
xor edx, eax
shr eax, 0x16
mov dword [0xbb1704], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbb1708]
mov edi, edx
shl edi, 0xa
xor eax, edx
shr edx, 0x15
mov dword [0xbb1708], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb170c]
mov edi, eax
shl edi, 0xb
xor edx, eax
shr eax, 0x14
mov dword [0xbb170c], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbb1710]
mov edi, edx
shl edi, 0xc
xor eax, edx
shr edx, 0x13
mov dword [0xbb1710], eax
or edx, edi
not eax
imul eax, edx
mov dl, 1
xor dword [0xbb1714], eax
shl dl, cl
or byte [0xbb171b], dl
mov eax, fcn.00795680
not eax
and eax, 1
add eax, fcn.00795680
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb171b], al
push 0xbb16e0
push esi
call fcn.00782570
add esp, 8
pop esi
pop edi
ret
Function at 0x809ac0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0xbcbae0]
xor eax, esp
mov dword [esp + 0x10], eax
mov ebp, dword [edx + 0x3c]
test ebp, ebp
je 0x809bed
mov eax, dword [edx + 8]
mov edi, edx
test eax, eax
jne 0x809bed
mov ebx, dword [ecx + 0x2c]
mov esi, ecx
inc ebx
mov dword [ecx + 0x2c], ebx
mov dword [edi + 8], ebx
call fcn.007ebd10
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xc]
mov dword [esp], eax
call fcn.00802ca0
test eax, eax
mov dword [esp + 8], ebp
je 0x809b62
mov ebp, dword [esp + 0xc]
mov ecx, dword [esp]
mov edx, 0x45
push ebx
push ebp
call fcn.007c57e0
add esp, 8
test ebp, ebp
jne 0x809b3a
mov ecx, dword [esp]
mov edx, dword [esp + 0x28]
call fcn.007ebf10
jmp 0x809b97
js 0x809b97
movzx eax, word [edi + 2]
mov edx, ebp
mov ecx, ebp
sar edx, 0x1f
mov word [esp + 4], ax
call fcn.007b2640
cmp word [esp + 4], ax
jle 0x809b97
mov word [edi + 2], ax
or byte [edi + 5], 0x40
jmp 0x809b97
mov edx, dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.007ebed0
add esp, 4
mov ebp, dword [esp]
mov edx, 0xf
mov ecx, ebp
push ebx
call fcn.007edd80
add esp, 4
mov ecx, ebp
mov edx, 0x14
push dword [esp + 0x28]
push ebx
call fcn.007c57e0
add esp, 8
mov eax, dword [esp + 8]
cmp dword [eax + 0x10], 0
je 0x809bed
mov ebp, dword [esi + 0x2c]
mov dword [esp + 4], ebx
mov ecx, esi
lea ebx, [ebp + 1]
mov dword [esi + 0x2c], ebx
mov dword [edi + 0xc], ebx
inc dword [esi + 0x2c]
mov edx, dword [eax + 0x10]
push ebx
call fcn.007ebed0
add esp, 4
mov esi, dword [esp]
mov edx, 0xf
mov ecx, esi
push ebx
call fcn.007edd80
add esp, 4
add ebp, 2
mov ecx, esi
mov edx, 0x98
push ebx
push ebp
push dword [esp + 0xc]
call fcn.007c5800
add esp, 0xc
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00980459
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x80cfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, fcn.00804e60
mov esi, ecx
movzx ecx, byte [0xbb28bb]
imul edi, edi
and edi, 3
cmp edi, 1
seta al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x80d163
mov al, byte [0xbb28bb]
cmp edi, 1
mov ah, 1
seta cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb28bb], ah
jne 0x80d011
mov ecx, fcn.00804e60
movzx edi, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta ah
or ah, 4
xor ah, 7
movzx eax, ah
bt edi, eax
jae 0x80d06b
cmp ecx, 1
movzx edi, byte [0xbb28bb]
seta al
or al, 4
movzx eax, al
bt edi, eax
jae 0x80d04f
jmp 0x80d163
cmp ecx, 1
movzx edi, byte [0xbb28bb]
seta al
or al, 4
movzx eax, al
bt edi, eax
jb 0x80d142
mov eax, fcn.00804e60
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
mov eax, dword [0xbb28a0]
seta cl
or ecx, 0xe7fdb3a8
add ecx, 0x80c
mov ebx, ecx
xor eax, ecx
shr ebx, 0x1f
mov dword [0xbb28a0], eax
not eax
or ebx, ecx
and cl, 7
imul ebx, eax
mov eax, dword [0xbb28a4]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbb28a4], eax
or ebp, ebx
not eax
mov edi, dword [0xbb28a8]
imul eax, ebp
lea ebx, [eax*4]
xor edi, eax
shr eax, 0x1d
mov dword [0xbb28a8], edi
or ebx, eax
not edi
mov eax, dword [0xbb28ac]
imul edi, ebx
lea ebx, [edi*8]
xor eax, edi
shr edi, 0x1c
mov dword [0xbb28ac], eax
or ebx, edi
not eax
mov edi, dword [0xbb28b0]
imul eax, ebx
mov ebx, eax
shl ebx, 4
xor edi, eax
shr eax, 0x1b
mov dword [0xbb28b0], edi
or eax, ebx
not edi
imul edi, eax
mov ah, 1
xor dword [0xbb28b4], edi
shl ah, cl
or byte [0xbb28bb], ah
mov eax, fcn.00804e60
imul eax, eax
and eax, 3
cmp eax, 1
mov al, 0xfe
seta cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb28bb], al
push edx
push 0xbb28a0
push 0
push esi
call fcn.007f2440
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x811b20
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0xbcbae0]
mov ebx, ecx
mov esi, 1
xor eax, ebp
mov dword [esp + 0x90], eax
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x54], edx
movzx ecx, byte [ecx + 0x2c]
cmp ecx, 2
setne al
lea eax, [eax + eax*4 + 5]
cmovae esi, eax
mov eax, dword [ebx]
test dx, dx
mov dword [esp + 0x38], esi
mov dword [esp + 0x50], eax
mov eax, dword [eax]
mov dword [esp + 0x44], eax
je 0x811b85
mov eax, dword [ebx + 8]
test eax, eax
je 0x811b85
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
lea eax, [ecx*4 + 0x20]
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x1c]
lea edi, [ecx + ecx]
mov ecx, dword [esp + 0x44]
imul eax, edi
lea edx, [eax + esi*2]
mov eax, edx
sar eax, 0x1f
push eax
call fcn.0078dcd0
add esp, 4
test eax, eax
je 0x812483
mov ecx, eax
lea eax, [esi + esi]
mov esi, dword [esp + 0x38]
mov edx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x2c], ecx
shl esi, 5
add edx, esi
mov dword [ecx + esi + 0x1c], 0
mov dword [ecx + esi + 0x18], 0
mov dword [ecx + esi + 0x14], 0
mov dword [ecx + esi + 0x10], 0
mov dword [ecx + esi + 0xc], 0
mov dword [ecx + esi + 8], 0
mov dword [ecx + esi + 4], 0
mov dword [ecx + esi], 0
mov dword [esp + 0x10], edx
lea eax, [edx + esi]
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x18], eax
add ecx, 0x20
dec edi
lea eax, [eax + edx*4]
jg 0x811c1d
cmp dword [esp + 0x1c], 0
jne 0x811c3a
mov dword [esp + 0x48], 0
jmp 0x811c4d
push dword [esp + 4]
push 0
mov dword [esp + 0x50], eax
push eax
call fcn.00980a60
add esp, 0xc
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x2c]
mov ecx, 0x30
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x84]
cmp eax, 0x30
cmovb ecx, eax
mov word [edi + esi + 0x10], cx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x811c86
xor eax, eax
cmp dl, 1
sbb al, al
not al
or al, cl
mov byte [edi + esi + 0x16], al
test dl, dl
je 0x8122b5
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
invalid
invalid
Function at 0x81a650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, ecx
mov ecx, dword [ecx]
mov esi, dword [esp + 0x18]
call fcn.007c5030
mov ebx, dword [eax + 8]
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0xc]
add esp, 8
mov esi, eax
test eax, eax
je 0x81a8d2
cmp esi, 0x13
je 0x81a8d2
cmp esi, 7
jne 0x81a693
mov ecx, dword [edi]
call fcn.0077e7a0
jmp 0x81a8d2
mov eax, dword [ebx + 8]
test eax, eax
jne 0x81a7ac
mov edx, fcn.007f4780
mov ebp, fcn.007f4780
movzx ecx, byte [0xbb2487]
or edx, 2
xor ebp, 2
mov eax, edx
add eax, ebp
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x81a79a
mov al, byte [0xbb2487]
mov ecx, edx
mov ah, 1
add ecx, ebp
sete cl
or cl, 6
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2487], ah
jne 0x81a6cf
mov ecx, fcn.007f4780
mov edx, fcn.007f4780
or ecx, 2
xor edx, 2
mov ebp, ecx
add ebp, edx
sete ah
or ah, 6
xor ah, 7
movzx ebp, ah
movzx eax, al
bt eax, ebp
jae 0x81a72e
mov eax, ecx
movzx ebp, byte [0xbb2487]
add eax, edx
sete al
or al, 6
movzx eax, al
bt ebp, eax
jae 0x81a714
jmp 0x81a79a
add ecx, edx
movzx ecx, byte [0xbb2487]
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x81a775
mov eax, fcn.007f4780
mov edx, fcn.007f4780
xor ecx, ecx
xor edx, 2
or eax, 2
add eax, edx
mov dl, 1
sete cl
mov eax, ecx
or cl, 6
shl dl, cl
or eax, 0x14e0d13e
xor dword [0xbb2480], eax
or byte [0xbb2487], dl
mov eax, fcn.007f4780
mov ecx, fcn.007f4780
xor ecx, 2
or eax, 2
add eax, ecx
mov al, 0xfe
sete cl
or cl, 6
xor cl, 7
rol al, cl
and byte [0xbb2487], al
mov ecx, esi
call fcn.0077e340
push eax
push 0xbb2480
jmp 0x81a8c9
mov ebp, fcn.007a06d0
mov dword [esp], eax
xor eax, eax
imul ebp, ebp
movzx edx, byte [0xbb248f]
and ebp, 3
cmp ebp, 1
seta al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x81a8c1
mov al, byte [0xbb248f]
xor edx, edx
cmp ebp, 1
seta dl
mov ecx, edx
xor ecx, 5
lea ecx, [ecx + edx*2]
mov dl, 1
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbb248f], dl
jne 0x81a7df
mov ecx, fcn.007a06d0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
mov ebp, edx
xor edx, 5
lea edx, [edx + ebp*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81a849
xor eax, eax
cmp ecx, 1
movzx ebp, byte [0xbb248f]
seta al
mov edx, eax
xor edx, 5
lea eax, [edx + eax*2]
bt ebp, eax
jae 0x81a82b
jmp 0x81a8c1
xor eax, eax
cmp ecx, 1
movzx edx, byte [0xbb248f]
seta al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x81a899
mov eax, fcn.007a06d0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 0x7ee54ef5
lea ecx, [eax + ecx*2 + 0x200]
mov al, 1
xor dword [0xbb2488], ecx
and cl, 7
shl al, cl
or byte [0xbb248f], al
mov eax, fcn.007a06d0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 5
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb248f], al
push dword [esp]
push 0xbb2488
push edi
call fcn.00782570
add esp, 0xc
push dword [ebx + 8]
call fcn.00775660
add esp, 4
mov dword [ebx + 8], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x81df70
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [esp + 8], edx
mov edx, dword [edx + 0x48]
mov esi, ecx
mov edi, dword [esp + 0x3c]
mov ebp, dword [esi + 8]
mov eax, dword [esi + 0x2c]
movzx ecx, word [edx + 0x18]
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], ebp
movzx ebp, word [edx + 0x2a]
mov edx, dword [edx + 0x20]
lea ebx, [eax + 1]
add edi, ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esi]
add eax, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x2c], eax
call fcn.008054f0
mov ecx, dword [esi]
mov edx, eax
mov dword [esp + 0x14], esi
call fcn.0077edc0
test ebp, ebp
mov dword [esp], eax
je 0x81e050
mov eax, dword [esp + 8]
mov dword [esp + 4], ebx
xor ebx, ebx
cmp dword [esp + 0x38], 0
mov esi, dword [esp + 0xc]
mov edi, dword [eax + 8]
sete bl
mov ecx, esi
lea edx, [ebx*4 + 0x21]
push edi
call fcn.007edd80
add esp, 4
mov ecx, esi
mov edx, 0xb
call fcn.007ebd30
lea edx, [ebx + ebx*2 + 0x16]
mov ebx, dword [esp + 4]
mov dword [esp + 0x18], eax
mov ecx, esi
push ebp
push ebx
push 0
push edi
call fcn.007826e0
add esp, 0x10
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov dword [ecx + 0x14], eax
mov ecx, esi
call fcn.007ebd40
xor esi, esi
mov ecx, dword [esp + 0xc]
lea eax, [esi + ebx]
mov edx, 0x59
push eax
push esi
push edi
call fcn.007c5800
add esp, 0xc
inc esi
cmp esi, ebp
jne 0x81e034
cmp bp, word [esp + 0x10]
jae 0x81e158
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ebx
lea ebx, [ebx + ebp]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + ebp*4]
mov edx, edi
push ebx
push dword [esp + 0x3c]
push ebp
push dword [esp + 0x14]
call fcn.0081da90
add esp, 0x10
cmp eax, ebx
je 0x81e0b5
cmp dword [esp + 0x1c], 1
mov esi, eax
jne 0x81e0a2
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
call fcn.007f0bc0
mov ebx, esi
jmp 0x81e0b9
mov ecx, dword [esp + 0xc]
mov edx, 0x4e
push ebx
push esi
call fcn.007c57e0
add esp, 8
mov ebx, dword [esp + 4]
movzx eax, word [edi + 0xc]
test al, 1
je 0x81e0db
cmp dword [esp], 0
je 0x81e14d
mov eax, dword [edi]
mov ecx, 0x800
mov eax, dword [eax + 4]
and eax, ecx
jne 0x81e146
jmp 0x81e14d
test eax, 0x100
jne 0x81e14d
mov eax, dword [edi]
test byte [edi + 0xb], 8
mov esi, dword [eax + 0x10]
jne 0x81e114
mov ecx, esi
call fcn.007f2f20
test eax, eax
je 0x81e114
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
lea eax, [ebx + ebp]
mov edx, 0x32
push dword [edi + 0xc]
push eax
call fcn.007c57e0
add esp, 8
cmp dword [esp], 0
je 0x81e14d
mov edi, dword [esp]
mov ecx, esi
movsx edx, byte [edi + ebp]
call fcn.007f17e0
cmp al, 0x41
je 0x81e132
movzx eax, byte [edi + ebp]
jmp 0x81e138
mov al, 0x41
mov byte [edi + ebp], 0x41
movsx edx, al
mov ecx, esi
call fcn.0081e760
test eax, eax
je 0x81e14d
mov eax, dword [esp]
mov byte [eax + ebp], 0x41
inc ebp
cmp ebp, dword [esp + 0x10]
jne 0x81e05b
mov eax, dword [esp]
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret