joyce8/EMBER2024-capa huggingface dataset:
Function at 0x778070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, fcn.00778070
mov eax, fcn.00778070
xor edx, edx
xor eax, 2
or ecx, 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ebp, dword [edx*4 + 0xb4d370]
mov edi, dword [edx*4 + 0xb4d4b0]
mov dword [esp + 0x18], edx
add eax, dword [esp + 0xc]
mov eax, 1
sete bl
xor ebx, 0x43fa2937
add ebx, 0x800
xor ebx, dword [edx*4 + 0xb48870]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x778173
mov dword [esp + 4], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x7780f8
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x77811a
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x77810f
jmp 0x778173
mov dword [esp + 8], edx
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x778169
lea ecx, [edi - 4]
shr ecx, 2
je 0x778161
xor eax, eax
mov edx, ebp
mov dword [esp + 0x14], ecx
mov esi, dword [edx]
mov ecx, eax
mov dword [esp], ebx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, ebx
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
mov dword [edx], esi
not esi
add edx, 4
imul ebx, esi
cmp eax, ecx
jne 0x778137
mov eax, dword [esp + 4]
or byte [ebp + edi - 1], al
mov eax, dword [esp + 8]
not al
and byte [ebp + edi - 1], al
mov edx, dword [esp + 0x18]
inc edx
cmp edx, 0x50
jne 0x778091
push dword [esp + 0x30]
call dword [0xbabdb4]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7781a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb0
mov eax, dword [0xbcbae0]
mov edx, fcn.00795680
mov ecx, 3
xor ebx, ebx
sub ecx, edx
xor eax, esp
mov dword [esp + 0xac], eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edi, dword [ebx*4 + 0xb4d370]
mov esi, dword [ebx*4 + 0xb4d4b0]
mov dword [esp + 0x14], ebx
xor ecx, fcn.00795680
sete al
mov ecx, eax
xor ecx, 0x18d35327
lea edx, [ecx + eax*2 + 0x920]
mov eax, 1
xor edx, dword [ebx*4 + 0xb489b0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x7782b1
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x778236
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x778258
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x77824d
jmp 0x7782b1
mov dword [esp + 8], ebx
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x7782a7
lea ecx, [esi - 4]
shr ecx, 2
je 0x77829f
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov ebp, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor ebp, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], ebp
not ebp
add ebx, 4
imul edx, ebp
cmp eax, ecx
jne 0x778275
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + esi - 1], al
mov ebx, dword [esp + 0x14]
inc ebx
cmp ebx, 0x50
jne 0x7781ca
push 0
push 0
push 0xc1f184
call dword [0xbabeb0]
test eax, eax
jne 0x7782fe
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push eax
call dword [0xbabcb8]
xor eax, eax
cmp dword [esp + 0x28], 2
sete al
inc eax
push 0
push eax
push 0xc1f184
call dword [0xbabeb0]
push 2
push 2
push 0xc1f184
call dword [0xbabeb0]
mov ecx, dword [esp + 0xac]
xor ebx, ebx
cmp eax, 2
sete bl
xor ecx, esp
call fcn.00980459
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7784c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, fcn.00821ad0
mov dword [esp + 4], ecx
xor ecx, ecx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor edx, edx
cmp dword [esp + 0x10], 1
mov edi, dword [ecx*4 + 0xb4d370]
mov ebp, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x18], ecx
mov eax, 1
seta dl
or edx, 0x3625294c
xor edx, dword [ecx*4 + 0xb48c30]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7785b5
mov dword [esp + 8], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x77853a
mov ecx, dword [esp + 8]
movzx eax, al
test ebx, eax
je 0x77855c
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x778551
jmp 0x7785b5
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7785ab
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7785a3
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x778579
mov eax, dword [esp + 8]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x7784dc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esp + 0x18]
push 0
push 0xfde9
call dword [0xbabdf0]
xor edi, edi
test eax, eax
je 0x778622
mov edx, eax
mov ecx, eax
mov ebp, eax
sar edx, 0x1f
call fcn.0077b7b0
test eax, eax
je 0x778622
mov ebx, eax
push 0
push 0
push ebp
push eax
push 0xffffffffffffffff
push dword [esp + 0x18]
push 0
push 0xfde9
call dword [0xbabdf0]
test eax, eax
je 0x778619
mov edi, ebx
jmp 0x778622
push ebx
call fcn.00775660
add esp, 4
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x778870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, fcn.00799bc0
xor ecx, ecx
not eax
and eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
xor edx, edx
mov edi, dword [ecx*4 + 0xb48ff0]
mov esi, dword [ecx*4 + 0xb49140]
mov dword [esp + 0x14], ecx
add eax, fcn.00799bc0
mov eax, 1
sete dl
xor edx, 0x35b590e9
add edx, 0xe28
xor edx, dword [ecx*4 + 0xb49290]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x77896a
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x7788ef
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x778911
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x778906
jmp 0x77896a
mov dword [esp + 8], ebx
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x778960
lea ecx, [esi - 4]
shr ecx, 2
je 0x778958
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov ebp, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor ebp, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], ebp
not ebp
add ebx, 4
imul edx, ebp
cmp eax, ecx
jne 0x77892e
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + esi - 1], al
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x54
jne 0x778887
mov dword [0xc1f1b0], 0
mov dword [0xc1f1ac], 0
mov dword [0xc1f1a8], 0
mov dword [0xc1f1a4], 0
mov dword [0xc1f1a0], 0
mov dword [0xc1f19c], 0
mov dword [0xc1f198], 0
mov dword [0xc1f194], 0
mov dword [0xc1f190], 0
push 0xc1f190
call dword [0xbabc70]
push 1
push 0xbabee4
call fcn.00775160
add esp, 8
push 0
push 0xbabf54
call fcn.00775160
add esp, 8
push 0
push 0xbabfc4
call fcn.00775160
add esp, 8
push 0
push 0xbac038
call fcn.00775160
add esp, 8
mov ecx, 0xb
call fcn.00775140
mov dword [0xc1f1b4], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77ae20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0xbcbae0]
mov ecx, 0x98b248
mov edx, 0x98b248
xor esi, esi
and ecx, 1
xor ecx, edx
xor eax, esp
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ecx
xor edx, edx
cmp dword [esp + 0xc], 0xffffffff
mov edi, dword [esi*4 + 0xb4d370]
mov ebp, dword [esi*4 + 0xb4d4b0]
mov eax, 1
mov dword [esp + 0x14], esi
sete dl
or edx, 0xf15346e4
add edx, 0x1224
xor edx, dword [esi*4 + 0xb4a060]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x77af26
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x77aeab
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x77aecd
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x77aec2
jmp 0x77af26
mov dword [esp + 8], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x77af1c
lea ecx, [ebp - 4]
shr ecx, 2
je 0x77af14
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x77aeea
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x14]
inc esi
cmp esi, 0x50
jne 0x77ae47
lea eax, [esp + 0x18]
push eax
call dword [0xbabc88]
push 0
push 0x2710
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00980470
mov ecx, dword [esp + 0x3c]
add eax, 0xd9cba00
adc edx, 0xb531
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00980459
xor eax, eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77d640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [ecx]
mov esi, ecx
call fcn.007a1e90
cmp dword [esi + 0x24], 0
js 0x77d67a
mov ecx, esi
call fcn.007a21a0
mov eax, dword [esi + 0x98]
test al, 0x40
je 0x77d7fa
and eax, 0xfffffffc
or eax, 1
mov dword [esi + 0x98], eax
jmp 0x77d7fa
mov ebp, dword [esi + 0x28]
test ebp, ebp
je 0x77d7fa
test byte [esi + 0x98], 3
je 0x77d7fa
mov ebx, fcn.0077ddf0
xor eax, eax
movzx edx, byte [0xbad48b]
and ebx, 1
inc ebx
mov ecx, ebx
xor ecx, fcn.0077ddf0
sete al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x77d7e1
mov al, byte [0xbad48b]
mov dword [esp], ebp
mov ebp, ebx
xor edx, edx
xor ebp, fcn.0077ddf0
sete dl
mov ecx, edx
xor ecx, 5
lea ecx, [ecx + edx*2 + 4]
mov dl, 1
and cl, 7
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbad48b], dl
jne 0x77d6ce
mov ecx, fcn.0077ddf0
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, fcn.0077ddf0
sete dl
mov ebx, edx
xor ebx, 5
lea edx, [ebx + edx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x77d759
mov ebp, dword [esp]
mov edx, ecx
xor eax, eax
movzx ebx, byte [0xbad48b]
xor edx, fcn.0077ddf0
sete al
mov edx, eax
xor edx, 5
lea eax, [edx + eax*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x77d72d
jmp 0x77d7e1
xor eax, eax
xor ecx, fcn.0077ddf0
movzx edx, byte [0xbad48b]
mov ebp, dword [esp]
sete al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x77d7b5
mov eax, fcn.0077ddf0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0077ddf0
sete cl
mov eax, ecx
xor eax, 0xea5d9675
lea ecx, [eax + ecx*2 + 0x304]
mov al, 1
xor dword [0xbad484], ecx
and cl, 7
shl al, cl
or byte [0xbad48b], al
mov eax, fcn.0077ddf0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0077ddf0
sete cl
mov eax, ecx
xor eax, 5
lea ecx, [eax + ecx*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbad48b], al
mov eax, dword [esi + 0x7c]
mov ecx, 0xbad484
test eax, eax
cmove ecx, eax
push eax
push ecx
push ebp
push edi
call fcn.0077b710
add esp, 0x10
mov edx, dword [esi + 0x7c]
mov ecx, edi
call fcn.00774f10
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0x48fa9f76
mov eax, dword [edi + 0x44]
and eax, dword [esi + 0x28]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77e5c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, fcn.0074bb70
mov edi, fcn.0074bb70
movzx ecx, byte [0xbac10b]
mov edx, dword [esp + 0x10]
or esi, 2
xor edi, 2
mov eax, esi
add eax, edi
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x77e75b
mov al, byte [0xbac10b]
mov ecx, esi
mov ah, 1
add ecx, edi
sete cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbac10b], ah
jne 0x77e5f8
mov ecx, fcn.0074bb70
mov esi, fcn.0074bb70
or ecx, 2
xor esi, 2
mov edi, ecx
add edi, esi
sete ah
or ah, 4
xor ah, 7
movzx edi, ah
movzx eax, al
bt eax, edi
jae 0x77e65a
mov eax, ecx
movzx edi, byte [0xbac10b]
add eax, esi
sete al
or al, 4
movzx eax, al
bt edi, eax
jae 0x77e63d
jmp 0x77e75b
add ecx, esi
movzx ecx, byte [0xbac10b]
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x77e736
mov eax, fcn.0074bb70
mov esi, fcn.0074bb70
xor ecx, ecx
xor esi, 2
or eax, 2
add eax, esi
mov eax, dword [0xbac0f0]
sete cl
or ecx, 0x9de044f0
add ecx, 0x1214
mov esi, ecx
xor eax, ecx
shr esi, 0x1f
mov dword [0xbac0f0], eax
not eax
or esi, ecx
and cl, 7
imul esi, eax
mov eax, dword [0xbac0f4]
mov ebx, esi
lea edi, [esi + esi]
shr ebx, 0x1e
or edi, ebx
xor eax, esi
mov dword [0xbac0f4], eax
not eax
mov esi, dword [0xbac0f8]
imul eax, edi
lea edi, [eax*4]
xor esi, eax
shr eax, 0x1d
mov dword [0xbac0f8], esi
or edi, eax
not esi
mov eax, dword [0xbac0fc]
imul esi, edi
lea edi, [esi*8]
xor eax, esi
shr esi, 0x1c
mov dword [0xbac0fc], eax
or edi, esi
not eax
mov esi, dword [0xbac100]
imul eax, edi
mov edi, eax
shl edi, 4
xor esi, eax
shr eax, 0x1b
mov dword [0xbac100], esi
or eax, edi
not esi
imul esi, eax
mov ah, 1
xor dword [0xbac104], esi
shl ah, cl
or byte [0xbac10b], ah
mov eax, fcn.0074bb70
mov ecx, fcn.0074bb70
xor ecx, 2
or eax, 2
add eax, ecx
mov al, 0xfe
sete cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbac10b], al
mov dword [edx + 0x14], 0x12
mov ecx, dword [edx]
mov edx, 0xbac0f0
push 0
push 1
push 0xffffffffffffffff
call fcn.0077de60
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x77e900
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x77eb8d
push ebx
push edi
push esi
mov edx, fcn.007f44c0
mov esi, fcn.007f44c0
xor eax, eax
movzx edi, byte [0xbad5af]
or edx, 2
xor esi, 2
mov ecx, edx
add ecx, esi
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jb 0x77eb75
mov al, byte [0xbad5af]
mov edi, edx
xor ecx, ecx
mov ah, 1
add edi, esi
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbad5af], ah
jne 0x77e947
mov ecx, fcn.007f44c0
mov edx, fcn.007f44c0
xor ebx, ebx
movzx eax, al
or ecx, 2
xor edx, 2
mov esi, ecx
add esi, edx
sete bl
mov esi, ebx
xor ebx, 1
lea ebx, [esi + ebx*2 + 6]
and bl, 7
xor bl, 7
movzx esi, bl
bt eax, esi
jae 0x77e9ca
mov esi, ecx
xor eax, eax
add esi, edx
movzx esi, byte [0xbad5af]
sete al
mov ebx, eax
xor ebx, 1
lea eax, [eax + ebx*2 + 6]
and al, 7
movzx eax, al
bt esi, eax
jae 0x77e9a2
jmp 0x77eb75
xor eax, eax
add ecx, edx
movzx edx, byte [0xbad5af]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x77eb45
mov ecx, fcn.007f44c0
mov edx, fcn.007f44c0
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x181
lea ecx, [eax + ecx*2 + 0x594a3626]
mov eax, dword [0xbad580]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbad580], eax
not eax
imul edx, eax
mov eax, dword [0xbad584]
lea esi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbad584], eax
or esi, edx
not eax
mov edx, dword [0xbad588]
imul eax, esi
lea esi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbad588], edx
or esi, eax
not edx
mov eax, dword [0xbad58c]
imul edx, esi
lea esi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbad58c], eax
or esi, edx
not eax
mov edx, dword [0xbad590]
imul eax, esi
mov esi, eax
shl esi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbad590], edx
or eax, esi
not edx
mov edi, dword [0xbad594]
imul edx, eax
mov esi, edx
shl esi, 5
xor edi, edx
shr edx, 0x1a
mov dword [0xbad594], edi
or edx, esi
not edi
imul edi, edx
mov edx, dword [0xbad598]
mov esi, edi
shl esi, 6
xor edx, edi
shr edi, 0x19
mov dword [0xbad598], edx
or edi, esi
not edx
mov ebx, dword [0xbad59c]
imul edx, edi
mov esi, edx
shl esi, 7
xor ebx, edx
shr edx, 0x18
mov dword [0xbad59c], ebx
or edx, esi
not ebx
imul ebx, edx
mov edx, dword [0xbad5a0]
mov esi, ebx
shl esi, 8
xor edx, ebx
shr ebx, 0x17
mov dword [0xbad5a0], edx
or ebx, esi
not edx
mov edi, dword [0xbad5a4]
imul edx, ebx
mov esi, edx
shl esi, 9
xor edi, edx
shr edx, 0x16
mov dword [0xbad5a4], edi
or edx, esi
not edi
imul edi, edx
mov dl, 1
xor dword [0xbad5a8], edi
shl dl, cl
or byte [0xbad5af], dl
mov eax, fcn.007f44c0
mov ecx, fcn.007f44c0
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
xor eax, 1
lea ecx, [edx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbad5af], al
push 0xbad580
push 0x15
call fcn.00777b70
add esp, 8
mov eax, 1
pop esi
pop edi
pop ebx
ret
jmp fcn.0077d230
Function at 0x784590
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x7845a6
mov ecx, 7
pop esi
pop edi
jmp fcn.0077e340
mov ecx, esi
call fcn.0078a030
test eax, eax
jne 0x7845c2
mov ecx, 0x9f7
call fcn.00774740
mov ecx, 0x15
jmp 0x78459f
push dword [esi + 0xc]
call fcn.007748d0
add esp, 4
cmp byte [esi + 0x51], 0
mov ecx, 7
jne 0x7845f9
cmp dword [esi + 0x40], 0
jne 0x7845e2
xor ecx, ecx
jmp 0x7845f9
push dword [esi + 0x10c]
call fcn.0077d9c0
add esp, 4
mov edi, eax
test eax, eax
jne 0x784600
mov ecx, dword [esi + 0x40]
call fcn.0077e340
mov edi, eax
push dword [esi + 0xc]
call fcn.007748e0
add esp, 4
mov eax, edi
pop esi
pop edi
ret
Function at 0x787e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, fcn.007b78f0
xor ecx, ecx
imul eax, eax
and eax, 3
mov dword [esp + 0xc], eax
xor edx, edx
cmp dword [esp + 0xc], 3
mov edi, dword [ecx*4 + 0xb4a770]
mov esi, dword [ecx*4 + 0xb4a870]
mov dword [esp + 0x14], ecx
mov eax, 1
sete dl
xor edx, 0xe8523833
add edx, 0xd88
xor edx, dword [ecx*4 + 0xb4a970]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x787f57
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x787edc
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x787efe
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x787ef3
jmp 0x787f57
mov dword [esp + 8], ebx
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x787f4d
lea ecx, [esi - 4]
shr ecx, 2
je 0x787f45
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov ebp, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor ebp, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], ebp
not ebp
add ebx, 4
imul edx, ebp
cmp eax, ecx
jne 0x787f1b
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + esi - 1], al
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x3e
jne 0x787e78
call fcn.00832e80
call fcn.00833370
call fcn.008334a0
mov ecx, 0xbb4958
mov edx, 0x3e
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
jmp 0x8335c0
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, ecx
xor esi, esi
mov dword [esp + 8], edx
mov dword [esp], ecx
lea edi, [esi + esi*4]
mov ebp, dword [eax + edi*8 + 0x20]
lea ecx, [eax + edi*8]
mov dword [esp + 4], ecx
mov ecx, ebp
call fcn.00777870
movsx ecx, byte [ebp]
mov edx, 0xb21642c9
add ecx, eax
mov eax, ecx
imul edx
mov ebx, edx
mov edx, ebp
add ebx, ecx
mov eax, ebx
sar ebx, 4
shr eax, 0x1f
add ebx, eax
lea eax, [ebx + ebx*2]
shl eax, 3
sub ebx, eax
add ebx, ecx
mov ecx, ebx
call fcn.0083a210
test eax, eax
je 0x83362c
mov ecx, eax
mov eax, dword [eax + 0xc]
mov edx, dword [esp]
add ecx, 0xc
mov dword [edx + edi*8 + 0xc], eax
jmp 0x833649
mov edx, dword [esp]
lea ecx, [ebx*4 + 0xc1f1bc]
mov dword [edx + edi*8 + 0xc], 0
mov eax, dword [ebx*4 + 0xc1f1bc]
mov dword [edx + edi*8 + 0x24], eax
inc esi
mov edi, dword [esp + 4]
mov eax, edx
cmp esi, dword [esp + 8]
mov dword [ecx], edi
jne 0x8335d2
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x788a50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
jmp 0x788a60
push ebp
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x788c3c
mov ebx, edx
mov esi, ecx
call fcn.0078a030
test eax, eax
jne 0x788a8f
mov ecx, 0x4ce
call fcn.00774740
mov edi, 0x15
jmp 0x788c3c
push dword [esi + 0xc]
call fcn.007748d0
add esp, 4
test byte [esi + 0x58], 8
je 0x788ab4
push 0
push esi
push dword [esi + 0xd0]
push 8
call dword [esi + 0xcc]
add esp, 0x10
mov ecx, esi
call fcn.0083afb0
mov ecx, esi
call fcn.007a3900
test ebx, ebx
jne 0x788c2e
mov ecx, esi
call fcn.0083b030
test eax, eax
je 0x788c2e
mov edx, 0x790c50
movzx ecx, byte [0xbb614b]
imul edx, edx
and edx, 3
cmp edx, 2
sete al
xor al, 5
add al, 0x24
and al, 7
movzx eax, al
bt ecx, eax
jb 0x788c0c
mov al, byte [0xbb614b]
cmp edx, 2
mov ah, 1
sete cl
xor cl, 5
add cl, 0x24
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb614b], ah
jne 0x788b08
mov ecx, 0x790c50
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
xor dl, 5
add dl, 0x24
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x788b72
cmp ecx, 2
movzx edx, byte [0xbb614b]
sete al
xor al, 5
add al, 0x24
and al, 7
movzx eax, al
bt edx, eax
jae 0x788b52
jmp 0x788c0c
xor edx, edx
cmp ecx, 2
movzx ecx, byte [0xbb614b]
sete dl
xor edx, 0xb32043ed
add edx, 0x1024
mov eax, edx
and al, 7
movzx eax, al
bt ecx, eax
jb 0x788be5
mov edi, 0xbb6100
xor eax, eax
mov ebx, dword [edi]
mov ecx, eax
mov ebp, edx
inc eax
shl ebp, cl
xor cl, 0x1f
xor ebx, edx
shr edx, cl
mov dword [edi], ebx
or edx, ebp
not ebx
add edi, 4
imul edx, ebx
cmp eax, 0x12
jne 0x788ba0
mov eax, 0x790c50
imul eax, eax
and eax, 3
cmp eax, 2
mov al, 1
sete cl
xor cl, 5
add cl, 0x24
and cl, 7
shl al, cl
or byte [0xbb614b], al
mov eax, 0x790c50
imul eax, eax
and eax, 3
cmp eax, 2
mov al, 0xfe
sete cl
xor cl, 5
add cl, 0x24
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb614b], al
push 0xbb6100
push 5
push esi
call fcn.0077b710
add esp, 0xc
push dword [esi + 0xc]
call fcn.007748e0
add esp, 4
mov edi, 5
jmp 0x788c3c
mov ecx, esi
mov dword [esi + 0x60], 0x64cffc7f
call fcn.0077cfb0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x78a030
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx + 0x60]
mov eax, 1
cmp ecx, 0xa029a697
je 0x78a1a7
cmp ecx, 0xf03b7906
je 0x78a1a7
cmp ecx, 0x4b771290
je 0x78a1a7
push esi
mov edx, fcn.007bc720
movzx ecx, byte [0xbb65e3]
and edx, 1
inc edx
mov eax, edx
xor eax, fcn.007bc720
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x78a19a
mov al, byte [0xbb65e3]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007bc720
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb65e3], ah
jne 0x78a08c
mov ecx, fcn.007bc720
movzx eax, al
and ecx, 1
inc ecx
mov edx, ecx
xor edx, fcn.007bc720
sete dl
not dl
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x78a0f8
mov eax, ecx
movzx edx, byte [0xbb65e3]
xor eax, fcn.007bc720
sete al
not al
and al, 3
movzx eax, al
bt edx, eax
jae 0x78a0d6
jmp 0x78a19a
xor ecx, fcn.007bc720
movzx ecx, byte [0xbb65e3]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x78a177
mov eax, fcn.007bc720
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007bc720
mov eax, dword [0xbb65d4]
sete cl
xor ecx, 0x9124670b
add ecx, 0x11e0
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb65d4], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb65d8]
lea esi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb65d8], eax
or esi, edx
not eax
mov dl, 1
imul eax, esi
shl dl, cl
xor dword [0xbb65dc], eax
or byte [0xbb65e3], dl
mov eax, fcn.007bc720
and eax, 1
inc eax
xor eax, fcn.007bc720
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb65e3], al
mov ecx, 0xbb65d4
call fcn.007c7b20
xor eax, eax
pop esi
ret