joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6881d0
Capabilities:
Allocate or change rwx memory
Decrypt data using tea
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [esi - 4]
mov dword [ebp - 0x10], edi
mov eax, edi
call fcn.006880b0
cmp eax, dword [edi + esi - 4]
jne 0x6882b5
mov ebx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x28], eax
add edi, 0x10
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x34]
lea ecx, [esi - 0x14]
push eax
push 0x40
push ecx
push edi
call sub.KERNEL32.DLL_VirtualProtect
add esi, 0xffffffec
je 0x6882b5
mov eax, esi
shr eax, 3
mov dword [ebp - 0x18], eax
je 0x6882b5
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], esi
xor eax, eax
nop
mov dword [ebp - 0x1c], eax
mov ebx, dword [edi]
mov dword [ebp - 0x20], edi
mov edx, dword [edi + 4]
mov ecx, 0xc6ef3720
mov edi, 0x20
nop word cs:[eax + eax]
lea esi, [ebx + ecx]
mov eax, ebx
shr eax, 5
add eax, dword [ebp - 0x28]
xor eax, esi
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x2c]
xor eax, esi
sub edx, eax
lea eax, [ecx + edx]
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x30]
xor esi, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x24]
xor esi, eax
sub ebx, esi
add ecx, 0x61c88647
dec edi
jne 0x688260
mov edi, dword [ebp - 0x20]
mov dword [edi], ebx
mov dword [edi + 4], edx
add edi, 8
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, dword [ebp - 0x18]
jne 0x688240
cmp dword [ebp - 0x14], 8
jae 0x6882bf
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x10]
call eax
mov al, 1
jmp 0x6882b7

Function at 0x688310
Capabilities:
Create thread

Disassembly:
cmp dword [0x87896c], 0
je 0x68831a
ret
push ebp
mov ebp, esp
push 0x878970
push 0
push 0
push 0x6882d0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x87896c], eax
pop ebp
ret
Function at 0x69b740
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x69b7da
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add ebx, 3
add edi, 4
dec eax
jne 0x69b75f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x69b7f0
dec edx
je 0x69b825
jmp 0x69b876
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x69b876
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x69b890
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x69b8af
add edx, 3
sar edx, 2
test edx, edx
jle 0x69b9bd
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x69b8e4
je 0x69b927
sub ecx, 0x2b
je 0x69b91d
sub ecx, 4
je 0x69b922
dec ecx
sub ecx, 0xa
jb 0x69b90f
jmp 0x69b92a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x69b8f6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x69b901
jmp 0x69b92a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x69b92a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x69b92a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x69b92a
mov byte [eax], 0x3e
jmp 0x69b92a
mov byte [eax], 0x3f
jmp 0x69b92a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x69b8c7
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x69b97b
cmp byte [esp + 7], 0xff
jne 0x69b97b
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x69b9b2
cmp dl, 0xff
je 0x69b9b2
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x69b8be
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x6f0a30
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x6f0aca
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x6f0a4f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x6f0ae0
dec edx
je 0x6f0b15
jmp 0x6f0b66
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x6f0b66
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6f0bdc
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x6f0bfb
add edx, 3
sar edx, 2
test edx, edx
jle 0x6f0d09
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x6f0c30
je 0x6f0c73
sub ecx, 0x2b
je 0x6f0c69
sub ecx, 4
je 0x6f0c6e
dec ecx
sub ecx, 0xa
jb 0x6f0c5b
jmp 0x6f0c76
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x6f0c42
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x6f0c4d
jmp 0x6f0c76
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x6f0c76
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x6f0c76
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x6f0c76
mov byte [eax], 0x3e
jmp 0x6f0c76
mov byte [eax], 0x3f
jmp 0x6f0c76
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x6f0c13
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x6f0cc7
cmp byte [esp + 7], 0xff
jne 0x6f0cc7
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x6f0cfe
cmp dl, 0xff
je 0x6f0cfe
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x6f0c0a
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x6f2ba4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x6f2bc5
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x6f2bb2
pop edi
pop esi
pop ebx
ret

Function at 0x6f43d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x6f442c
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x821e30]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x822230]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x822630]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x822a30]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x6f43e6
pop edi
pop esi
pop ebx
ret
Function at 0x6f8f96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add eax, 0x3c
mov dword [ebp - 4], eax
mov esi, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x38]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
cmp esi, dword [edx]
jbe 0x6f8ffb
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
add ecx, 0x28
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
add dword [eax + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x6f911f
cmp ebx, edi
jne 0x6f9009
mov eax, 0x1001
jmp 0x6f911f
mov edx, esi
sub edx, dword [ebp - 8]
push edx
push edi
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
add ecx, 0x28
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, esi
sub eax, dword [ebp - 8]
add edi, eax
mov edx, esi
sub edx, dword [ebp - 8]
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
mov edx, dword [ebp + 8]
xor eax, dword [edx + 0x28]
mov dword [ebx], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x1c]
mov edx, dword [ebp + 8]
xor eax, dword [edx + 0x2c]
mov dword [ebx + 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x20]
mov edx, dword [ebp + 8]
xor eax, dword [edx + 0x30]
mov dword [ebx + 8], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x24]
mov edx, dword [ebp + 8]
xor eax, dword [edx + 0x34]
mov dword [ebx + 0xc], eax
push ebx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
add ebx, esi
cmp esi, dword [ebp + 0x10]
ja 0x6f90c8
mov ecx, ebx
sub ecx, esi
mov eax, dword [ecx]
xor eax, dword [edi]
mov dword [ebx], eax
mov edx, ebx
sub edx, esi
mov ecx, dword [edx + 4]
xor ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov eax, ebx
sub eax, esi
mov edx, dword [eax + 8]
xor edx, dword [edi + 8]
mov dword [ebx + 8], edx
mov ecx, ebx
sub ecx, esi
mov eax, dword [ecx + 0xc]
xor eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
push ebx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
add edi, esi
add ebx, esi
sub dword [ebp + 0x10], esi
cmp esi, dword [ebp + 0x10]
jbe 0x6f907f
mov edx, ebx
sub edx, esi
mov ecx, dword [edx]
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], ecx
mov edx, ebx
sub edx, esi
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], ecx
mov edx, ebx
sub edx, esi
mov ecx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], ecx
sub ebx, esi
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], edx
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
call fcn.006f9f80
add esp, 0xc
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x6f9126
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x6f9189
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.006f9f80
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x6f926c
cmp esi, edi
jne 0x6f9197
mov eax, 0x1001
jmp 0x6f926c
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
add edi, eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
sub dword [ebp + 0x10], edx
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
mov eax, dword [ebx + 0x18]
xor eax, dword [ebx + 0x28]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
xor edx, dword [ebx + 0x2c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
xor ecx, dword [ebx + 0x30]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
xor eax, dword [ebx + 0x34]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jb 0x6f9243
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
mov eax, dword [edi]
xor eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [edi + 4]
xor edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
xor ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [edi + 0xc]
xor eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jae 0x6f91fe
push dword [ebp + 0x10]
push edi
lea eax, [ebx + 0x28]
push eax
call fcn.006f9f80
add esp, 0xc
mov edx, dword [ebx + 0x38]
and edx, 0xf0000000
add edx, dword [ebp + 0x10]
mov dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f9273
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x6f92d6
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.006f9f80
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x6f93d0
cmp esi, edi
jne 0x6f92e4
mov eax, 0x1001
jmp 0x6f93d0
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
add edi, eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
sub dword [ebp + 0x10], edx
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
xor dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
xor dword [ebx + 0x24], eax
mov edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
add esi, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jb 0x6f93a8
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
mov edx, dword [edi]
xor dword [ebx + 0x18], edx
mov ecx, dword [edi + 4]
xor dword [ebx + 0x1c], ecx
mov eax, dword [edi + 8]
xor dword [ebx + 0x20], eax
mov edx, dword [edi + 0xc]
xor dword [ebx + 0x24], edx
mov ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jae 0x6f9357
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f9551
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], 0x10
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
lea edx, [ebx + 0x18]
push edx
push eax
call fcn.006f6782
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x6f9596
mov cl, byte [ebx + eax + 0x28]
xor cl, byte [ebx + eax + 0x18]
mov byte [edi + eax], cl
inc eax
cmp esi, eax
ja 0x6f9586
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6f99d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x6f9a38
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x6f9b25
cmp edi, esi
jne 0x6f9a46
mov eax, 0x1001
jmp 0x6f9b25
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push edi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.006f9f80
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add edi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x6f9afd
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.006f6782
add esp, 8
mov ecx, dword [edi]
xor ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [edi + 4]
xor eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
xor edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [edi + 0xc]
xor ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x6f9ab8
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.006f9f80
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret