joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c0fc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0xbcbae0]
mov esi, dword [esp + 0x18]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x7c1176
dec eax
lea ecx, [esp + 0x20]
lea edi, [esi + 0x28]
mov dword [esi + 0x10], eax
inc dword [esi + 0x14]
mov dword [esp], ecx
cmp dword [esi + 0x38], 0
je 0x7c1141
mov edx, fcn.007f1a80
xor eax, eax
movzx ebx, byte [0xbae9f7]
imul edx, edx
and edx, 3
cmp edx, 2
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x7c1131
mov al, byte [0xbae9f7]
xor ecx, ecx
cmp edx, 2
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbae9f7], ah
jne 0x7c1031
mov ecx, fcn.007f1a80
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7c10ac
xor eax, eax
cmp ecx, 2
movzx ebx, byte [0xbae9f7]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x7c1085
jmp 0x7c1131
xor eax, eax
cmp ecx, 2
movzx edx, byte [0xbae9f7]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7c1105
mov ecx, fcn.007f1a80
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete al
mov ecx, eax
not ecx
and ecx, 0x4e1
lea ecx, [eax + ecx*2 + 0x797d931e]
mov al, 1
xor dword [0xbae9f0], ecx
and cl, 7
shl al, cl
or byte [0xbae9f7], al
mov eax, fcn.007f1a80
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbae9f7], al
push 1
push 0xbae9f0
push edi
call fcn.007774d0
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ebx, dword [esp + 0x1c]
test eax, eax
je 0x7c115c
push dword [esi + 0x24]
push dword [esi + 0x20]
push eax
push edi
call fcn.00777c30
add esp, 0x10
push dword [esp]
push ebx
push edi
call fcn.00775890
add esp, 0xc
cmp byte [esi + 0x3c], 7
jne 0x7c1176
mov dword [esi + 0x18], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00980459
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x7c5f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, fcn.007a0590
xor ebx, ebx
mov ebp, 0x47
mov dword [esp + 8], ecx
not eax
and eax, 1
mov dword [esp + 0x14], eax
xor ecx, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov esi, dword [ecx*4 + 0xb4e0f0]
mov edi, dword [ecx*4 + 0xb4e210]
mov dword [esp + 0x1c], ecx
mov edx, 1
add eax, fcn.007a0590
mov eax, 1
sete bl
xor ebx, 0x7ba5855f
add ebx, 0x1140
xor ebx, dword [ecx*4 + 0xb4e330]
mov ecx, ebx
and cl, 7
shl eax, cl
movzx ebp, cl
xor cl, 7
shl edx, cl
movzx ecx, byte [esi + edi - 1]
bt ecx, ebp
jb 0x7c602a
mov dword [esp], eax
mov al, byte [esi + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [esi + edi - 1], cl
jne 0x7c5fab
mov ecx, dword [esp]
movzx eax, al
test edx, eax
je 0x7c5fcc
movzx eax, byte [esi + edi - 1]
test ecx, eax
je 0x7c5fc1
jmp 0x7c602a
movzx eax, byte [esi + edi - 1]
test ecx, eax
jne 0x7c6024
lea ecx, [edi - 4]
shr ecx, 2
je 0x7c601d
xor eax, eax
mov ebp, esi
mov dword [esp + 0x18], ecx
mov ecx, ebp
mov dword [esp + 0x20], ebp
mov ebp, dword [ebp]
mov dword [esp + 4], ebx
xor ebp, ebx
mov dword [ecx], ebp
mov ecx, eax
not ebp
inc eax
shl dword [esp + 4], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp + 4]
imul ebx, ebp
mov ebp, dword [esp + 0x20]
add ebp, 4
cmp eax, ecx
jne 0x7c5fe5
mov eax, dword [esp]
or byte [esi + edi - 1], al
not dl
and byte [esi + edi - 1], dl
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0x48
jne 0x7c5f4a
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
lea eax, [ebx + ebp]
mov esi, eax
shr esi, 0x1f
add esi, eax
sar esi, 1
mov edi, esi
shl edi, 4
push dword [edi + 0xb446f8]
push dword [esp + 0xc]
call fcn.00777e00
add esp, 8
test eax, eax
je 0x7c607f
lea ecx, [esi - 1]
inc esi
test eax, eax
cmovns ebx, esi
cmovs ebp, ecx
cmp ebx, ebp
jle 0x7c5f40
xor eax, eax
jmp 0x7c6085
lea eax, [edi + 0xb446f8]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7c7530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [edx + 0x38]
mov edi, dword [ecx]
mov ebx, dword [esp + 0x24]
mov esi, edx
lea ebp, [eax*4 + 8]
add eax, 3
cmp eax, dword [edi + 0x74]
jl 0x7c7758
mov edx, fcn.0077db90
mov dword [esp + 4], ecx
mov dword [esp + 8], ebp
mov ebp, fcn.0077db90
xor eax, eax
mov dword [esp + 0xc], edi
or edx, 2
xor ebp, 2
movzx edi, byte [0xbafd6b]
mov ecx, edx
add ecx, ebp
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jb 0x7c773d
mov al, byte [0xbafd6b]
mov dword [esp], ebx
mov edi, edx
xor ebx, ebx
mov ah, 1
add edi, ebp
sete bl
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbafd6b], ah
jne 0x7c759f
mov ecx, fcn.0077db90
mov edi, fcn.0077db90
xor edx, edx
movzx eax, al
or ecx, 2
xor edi, 2
mov ebx, ecx
add ebx, edi
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7c7622
mov ebx, dword [esp]
mov edx, ecx
xor eax, eax
movzx ebp, byte [0xbafd6b]
add edx, edi
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2 + 4]
and al, 7
movzx eax, al
bt ebp, eax
jae 0x7c75fb
jmp 0x7c773d
xor eax, eax
add ecx, edi
movzx edx, byte [0xbafd6b]
mov ebx, dword [esp]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7c770e
mov ecx, fcn.0077db90
mov edx, fcn.0077db90
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x80b
lea ecx, [eax + ecx*2 + 0x47962504]
mov eax, dword [0xbafd50]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbafd50], eax
not eax
imul edx, eax
mov eax, dword [0xbafd54]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbafd54], eax
or edi, edx
not eax
mov edx, dword [0xbafd58]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbafd58], edx
or edi, eax
not edx
mov eax, dword [0xbafd5c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbafd5c], eax
or edi, edx
not eax
mov edx, dword [0xbafd60]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbafd60], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbafd64], edx
mov dl, 1
shl dl, cl
or byte [0xbafd6b], dl
mov eax, fcn.0077db90
mov ecx, fcn.0077db90
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
not eax
lea ecx, [edx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbafd6b], al
push dword [esi]
push 0xbafd50
push dword [esp + 0xc]
call fcn.00782570
add esp, 0xc
mov edi, dword [esp + 0xc]
mov ebp, dword [esp + 8]
mov edx, dword [esi + 0x3c]
mov ecx, edi
push 0
push ebp
call fcn.0078dc70
add esp, 8
test eax, eax
je 0x7c778b
mov ecx, dword [esi + 0x38]
lea edx, [ecx + 1]
mov dword [esi + 0x38], edx
mov dword [eax + ecx*4], ebx
mov dword [eax + ecx*4 + 4], 0
mov dword [esi + 0x3c], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00774f10
Function at 0x7c7b20
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, 0x835000
mov edx, ecx
movzx ecx, byte [0xbafdc3]
imul esi, esi
and esi, 3
cmp esi, 3
sete al
or al, 2
movzx eax, al
bt ecx, eax
jb 0x7c7d3c
mov al, byte [0xbafdc3]
cmp esi, 3
mov ah, 1
sete cl
or cl, 2
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbafdc3], ah
jne 0x7c7b4f
mov ecx, 0x835000
movzx esi, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete ah
or ah, 2
xor ah, 7
movzx eax, ah
bt esi, eax
jae 0x7c7ba9
cmp ecx, 3
movzx esi, byte [0xbafdc3]
sete al
or al, 2
movzx eax, al
bt esi, eax
jae 0x7c7b8d
jmp 0x7c7d3c
cmp ecx, 3
movzx esi, byte [0xbafdc3]
sete al
or al, 2
movzx eax, al
bt esi, eax
jb 0x7c7d1b
mov eax, 0x835000
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
mov eax, dword [0xbafd90]
sete cl
or ecx, 0x4543ba5a
xor eax, ecx
mov dword [0xbafd90], eax
not eax
mov esi, dword [0xbafd94]
imul eax, ecx
and cl, 3
lea edi, [eax + eax]
xor esi, eax
shr eax, 0x1e
mov dword [0xbafd94], esi
or edi, eax
not esi
mov eax, dword [0xbafd98]
imul esi, edi
lea edi, [esi*4]
xor eax, esi
shr esi, 0x1d
mov dword [0xbafd98], eax
or edi, esi
not eax
mov esi, dword [0xbafd9c]
imul eax, edi
lea edi, [eax*8]
xor esi, eax
shr eax, 0x1c
mov dword [0xbafd9c], esi
or edi, eax
not esi
mov eax, dword [0xbafda0]
imul esi, edi
mov edi, esi
shl edi, 4
xor eax, esi
shr esi, 0x1b
mov dword [0xbafda0], eax
or esi, edi
not eax
imul eax, esi
mov esi, dword [0xbafda4]
mov edi, eax
shl edi, 5
xor esi, eax
shr eax, 0x1a
mov dword [0xbafda4], esi
or eax, edi
not esi
imul esi, eax
mov eax, dword [0xbafda8]
mov edi, esi
shl edi, 6
xor eax, esi
shr esi, 0x19
mov dword [0xbafda8], eax
or esi, edi
not eax
imul eax, esi
mov esi, dword [0xbafdac]
mov edi, eax
shl edi, 7
xor esi, eax
shr eax, 0x18
mov dword [0xbafdac], esi
or eax, edi
not esi
imul esi, eax
mov eax, dword [0xbafdb0]
mov edi, esi
shl edi, 8
xor eax, esi
shr esi, 0x17
mov dword [0xbafdb0], eax
or esi, edi
not eax
imul eax, esi
mov esi, dword [0xbafdb4]
mov edi, eax
shl edi, 9
xor esi, eax
shr eax, 0x16
mov dword [0xbafdb4], esi
or eax, edi
not esi
imul esi, eax
mov eax, dword [0xbafdb8]
mov edi, esi
shl edi, 0xa
xor eax, esi
shr esi, 0x15
mov dword [0xbafdb8], eax
or esi, edi
not eax
imul eax, esi
xor dword [0xbafdbc], eax
mov ah, 1
shl ah, cl
or byte [0xbafdc3], ah
mov eax, 0x835000
imul eax, eax
and eax, 3
cmp eax, 3
mov al, 0xfe
sete cl
or cl, 2
xor cl, 7
rol al, cl
and byte [0xbafdc3], al
push edx
push 0xbafd90
push 0x15
call fcn.00777b70
add esp, 0xc
pop esi
pop edi
ret
Function at 0x7cbba0
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push esi
add edx, 0xffffff38
cmp dx, 0x6b
ja case.0x7cbbb7.1
mov eax, dword [ecx + 4]
mov esi, dword [esp + 8]
movzx ecx, dx
jmp dword [ecx*4 + 0xb50528]
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c0190
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c00e0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c00f0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c0320
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c03e0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c03c0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c0430
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c01a0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007c7f40
mov edx, dword [esi + 4]
jmp 0x7cbbfc
mov edx, dword [esi + 4]
jmp 0x7cbbca
pop esi
ret
Function at 0x7cbc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
lea ebx, [ecx + 8]
mov ebp, dword [ecx + 4]
mov esi, ecx
cmp dword [ecx], ebx
jbe 0x7cbc4c
mov ecx, esi
call fcn.007ebcf0
cmp dword [esi], ebx
ja 0x7cbc41
mov edi, 0x7bc8c0
mov ebx, 0x7bc8c0
xor eax, eax
movzx edx, byte [0xbb014b]
or edi, 2
xor ebx, 2
mov ecx, edi
add ecx, ebx
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2]
and al, 3
movzx eax, al
bt edx, eax
jb 0x7cbe22
mov al, byte [0xbb014b]
mov dword [esp], ebp
mov ebp, edi
xor edx, edx
add ebp, ebx
sete dl
mov ecx, edx
not ecx
lea ecx, [edx + ecx*2]
mov dl, 1
and cl, 3
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbb014b], dl
jne 0x7cbc89
mov ecx, 0x7bc8c0
mov edx, 0x7bc8c0
xor ebx, ebx
movzx eax, al
or ecx, 2
xor edx, 2
mov edi, ecx
add edi, edx
sete bl
mov edi, ebx
not ebx
lea ebx, [edi + ebx*2]
and bl, 3
xor bl, 7
movzx edi, bl
bt eax, edi
jae 0x7cbd09
mov ebp, dword [esp]
mov edi, ecx
xor eax, eax
add edi, edx
movzx edi, byte [0xbb014b]
sete al
mov ebx, eax
not ebx
lea eax, [eax + ebx*2]
and al, 3
movzx eax, al
bt edi, eax
jae 0x7cbce3
jmp 0x7cbe22
xor eax, eax
add ecx, edx
movzx edx, byte [0xbb014b]
mov ebp, dword [esp]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2]
and al, 3
movzx eax, al
bt edx, eax
jb 0x7cbdf4
mov ecx, 0x7bc8c0
mov edx, 0x7bc8c0
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x405
lea ecx, [eax + ecx*2 - 0x7f57b6c8]
mov eax, dword [0xbb0130]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb0130], eax
not eax
imul edx, eax
mov eax, dword [0xbb0134]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb0134], eax
or edi, edx
not eax
mov edx, dword [0xbb0138]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb0138], edx
or edi, eax
not edx
mov eax, dword [0xbb013c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb013c], eax
or edi, edx
not eax
mov edx, dword [0xbb0140]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb0140], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb0144], edx
mov dl, 1
shl dl, cl
or byte [0xbb014b], dl
mov eax, 0x7bc8c0
mov ecx, 0x7bc8c0
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
not eax
lea ecx, [edx + eax*2]
mov al, 0xfe
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb014b], al
push 0xbb0130
push ebp
call fcn.00782570
add esp, 8
mov dword [esi + 4], ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7cbff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edx, fcn.007f3ec0
mov edi, ecx
movzx ecx, byte [0xbb04b3]
and edx, 1
inc edx
mov eax, edx
xor eax, fcn.007f3ec0
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x7cc110
mov al, byte [0xbb04b3]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007f3ec0
sete cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb04b3], ah
jne 0x7cc025
mov ecx, fcn.007f3ec0
movzx eax, al
and ecx, 1
inc ecx
mov edx, ecx
xor edx, fcn.007f3ec0
sete dl
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7cc08b
mov eax, ecx
movzx edx, byte [0xbb04b3]
xor eax, fcn.007f3ec0
sete al
or al, 4
movzx eax, al
bt edx, eax
jae 0x7cc06b
jmp 0x7cc110
xor ecx, fcn.007f3ec0
movzx ecx, byte [0xbb04b3]
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x7cc0ef
mov eax, fcn.007f3ec0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007f3ec0
mov eax, dword [0xbb04a8]
sete cl
or ecx, 0x9f914144
add ecx, 0x1110
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb04a8], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
xor dword [0xbb04ac], edx
mov dl, 1
shl dl, cl
or byte [0xbb04b3], dl
mov eax, fcn.007f3ec0
and eax, 1
inc eax
xor eax, fcn.007f3ec0
mov al, 0xfe
sete cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb04b3], al
mov ebp, dword [edi]
mov ecx, edi
mov edx, 0x16
push 0
push 0
push 0xbb04a8
call fcn.007f4a50
add esp, 0xc
test eax, eax
jne 0x7cc181
mov ecx, edi
call fcn.007ebd10
test eax, eax
je 0x7cc181
mov edi, eax
cmp esi, 7
je 0x7cc171
cmp dword [ebp + 0x14], 0
jle 0x7cc171
xor ebx, ebx
cmp esi, 9
sete bl
xor esi, esi
inc ebx
mov ecx, edi
mov edx, 2
push ebx
push esi
call fcn.007c57e0
add esp, 8
mov ecx, edi
mov edx, esi
call fcn.007827e0
inc esi
cmp esi, dword [ebp + 0x14]
jl 0x7cc151
mov ecx, edi
mov edx, 1
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007ebd30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7d0860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [esp + 0x80]
mov ebp, edx
mov edx, dword [esp + 0x8c]
mov ebx, dword [esp + 0x7c]
xor esi, esi
mov dword [esp + 0x18], eax
mov eax, dword [0xbcbae0]
xor eax, esp
mov dword [esp + 0x60], eax
mov edi, dword [ecx]
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
cmp byte [edi + 0x51], 0
jne 0x7d3b5c
cmp dword [ecx + 0x24], 0
jg 0x7d3b5c
cmp byte [esp + 0x98], 2
je 0x7d08c9
cmp byte [ecx + 0xc8], 1
je 0x7d3b5c
mov dword [esp + 0xc], edx
mov esi, ecx
call fcn.007c5c50
test eax, eax
je 0x7d08e6
mov edx, dword [esp + 0x8c]
xor esi, esi
jmp 0x7d3b5c
mov edx, dword [esp + 0x80]
mov ecx, esi
call fcn.00803ef0
test eax, eax
jne 0x7d08d8
test ebx, ebx
mov dword [esp + 8], esi
je 0x7d0e0a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x44]
mov edx, ebp
push eax
push dword [esp + 0x7c]
call fcn.007f4ea0
add esp, 8
test eax, eax
mov esi, 0
jns 0x7d0930
mov edx, dword [esp + 0x8c]
jmp 0x7d3b5c
cmp byte [edi + 0xa5], 0
mov ebp, eax
jne 0x7d0966
mov ecx, dword [esp + 8]
mov edx, ebx
call fcn.008042f0
test eax, eax
je 0x7d0966
mov ecx, dword [esp + 0x78]
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x7d0966
mov eax, dword [eax + 0x48]
mov ecx, dword [edi + 0x10]
cmp eax, dword [ecx + 0x1c]
mov eax, 1
cmove ebp, eax
mov edx, fcn.008108c0
xor eax, eax
mov dword [esp + 0x20], ebp
not edx
movzx esi, byte [0xbb176f]
and edx, 1
mov ecx, edx
add ecx, fcn.008108c0
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt esi, eax
jb 0x7d0ad2
mov al, byte [0xbb176f]
mov ebp, ebx
mov esi, edx
xor ebx, ebx
mov ah, 1
add esi, fcn.008108c0
sete bl
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb176f], ah
jne 0x7d09a5
mov ecx, fcn.008108c0
xor edx, edx
movzx eax, al
not ecx
and ecx, 1
mov esi, ecx
add esi, fcn.008108c0
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7d0a2d
mov ebx, ebp
mov edx, ecx
xor eax, eax
movzx esi, byte [0xbb176f]
add edx, fcn.008108c0
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2 + 4]
and al, 7
movzx eax, al
bt esi, eax
jae 0x7d0a02
jmp 0x7d0ad2
xor eax, eax
add ecx, fcn.008108c0
movzx edx, byte [0xbb176f]
mov ebx, ebp
jmp 0x7d0a4e
xchg esp, eax
ror byte [ecx - 0x722e083f], 0x44
dec eax
add al, 0x24
pop es
movzx eax, al
mov eax, dword [esp + 8]
mov esi, 0
mov eax, dword [eax + 0xe4]
test eax, eax
jne 0x7d0e29
mov edx, dword [esp + 0x8c]
jmp 0x7d3b5c
mov edx, dword [eax + 0x48]
mov ecx, edi
mov ebp, ebx
mov dword [esp], eax
call fcn.007825f0
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x1c], 0
Function at 0x7d8160
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [edx + 0x34]
test ecx, ecx
je 0x7d83bc
mov dword [edx + 0x38], 0
or byte [edx + 5], 1
xor eax, eax
mov edi, edx
mov ebx, dword [ecx + 0x34]
mov dword [ecx + 0x38], edi
or byte [ecx + 5], 1
inc eax
mov edi, ecx
test ebx, ebx
mov ecx, ebx
jne 0x7d817f
test byte [edx + 5], 4
jne 0x7d83bc
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
jle 0x7d83bc
cmp eax, ecx
jl 0x7d83bc
mov eax, fcn.00823240
mov edx, 3
movzx ecx, byte [0xbb2967]
sub edx, eax
mov eax, edx
xor eax, fcn.00823240
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7d83ae
mov al, byte [0xbb2967]
mov ecx, edx
mov ah, 1
xor ecx, fcn.00823240
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2967], ah
jne 0x7d81e3
mov edx, fcn.00823240
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.00823240
sete dl
not dl
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7d8252
mov eax, ecx
movzx edx, byte [0xbb2967]
xor eax, fcn.00823240
sete al
not al
and al, 3
movzx eax, al
bt edx, eax
jae 0x7d8230
jmp 0x7d83ae
xor ecx, fcn.00823240
movzx ecx, byte [0xbb2967]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7d8387
mov eax, fcn.00823240
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb2940]
xor edx, fcn.00823240
sete cl
xor ecx, 0xddc932b3
add ecx, 0xa08
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb2940], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb2944]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb2944], eax
or edi, edx
not eax
mov edx, dword [0xbb2948]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb2948], edx
or edi, eax
not edx
mov eax, dword [0xbb294c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb294c], eax
or edi, edx
not eax
mov edx, dword [0xbb2950]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb2950], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbb2954]
mov edi, edx
shl edi, 5
xor eax, edx
shr edx, 0x1a
mov dword [0xbb2954], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb2958]
mov edi, eax
shl edi, 6
xor edx, eax
shr eax, 0x19
mov dword [0xbb2958], edx
or eax, edi
not edx
mov ebx, dword [0xbb295c]
imul edx, eax
mov edi, edx
shl edi, 7
xor ebx, edx
shr edx, 0x18
mov dword [0xbb295c], ebx
or edx, edi
not ebx
imul ebx, edx
mov dl, 1
xor dword [0xbb2960], ebx
shl dl, cl
or byte [0xbb2967], dl
mov eax, fcn.00823240
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.00823240
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb2967], al
push 0xbb2940
push esi
call fcn.00782570
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x7da420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
test edx, edx
je 0x7da5f1
mov eax, dword [ecx]
mov edx, dword [edx]
mov esi, ecx
cmp edx, dword [eax + 0x74]
jle 0x7da5f1
mov edi, 0x78da40
xor eax, eax
movzx edx, byte [0xbb2bbb]
mov ebp, dword [esp + 0x14]
imul edi, edi
and edi, 3
cmp edi, 1
seta al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x7da5e2
mov al, byte [0xbb2bbb]
xor ecx, ecx
cmp edi, 1
mov ah, 1
seta cl
mov ebx, ecx
xor ebx, 3
lea ecx, [ebx + ecx*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2bbb], ah
jne 0x7da46f
mov ecx, 0x78da40
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
mov ebx, edx
xor ebx, 3
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7da4dc
xor eax, eax
cmp ecx, 1
movzx edi, byte [0xbb2bbb]
seta al
mov edx, eax
xor edx, 3
lea eax, [edx + eax*2]
bt edi, eax
jae 0x7da4bb
jmp 0x7da5e2
xor eax, eax
cmp ecx, 1
movzx edx, byte [0xbb2bbb]
seta al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x7da5ba
mov eax, 0x78da40
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 0x6a7c7373
lea ecx, [eax + ecx*2 + 0x1108]
mov eax, dword [0xbb2ba0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb2ba0], eax
not eax
imul edx, eax
mov eax, dword [0xbb2ba4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb2ba4], eax
or edi, edx
not eax
mov edx, dword [0xbb2ba8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb2ba8], edx
or edi, eax
not edx
mov eax, dword [0xbb2bac]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb2bac], eax
or edi, edx
not eax
mov edx, dword [0xbb2bb0]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb2bb0], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb2bb4], edx
mov dl, 1
shl dl, cl
or byte [0xbb2bbb], dl
mov eax, 0x78da40
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 3
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb2bbb], al
push ebp
push 0xbb2ba0
push esi
call fcn.00782570
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret