joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69a1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x69a1e0
sar esi, 1
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x6cf750]
mov ebx, dword [esp + 0x24]
mov edi, 0xffffffff
test ebx, ebx
jns 0x69a214
mov eax, 0xffffffff
jmp 0x69a217
lea eax, [ebx + ebx]
push eax
call fcn.0068c580
add esp, 4
lea ecx, [esp + 0x24]
push ecx
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x6cf750]
mov eax, dword [esp + 0x24]
mov ecx, eax
add ecx, 0xd
js 0x69a247
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0068c580
add esp, 4
mov edi, eax
mov dword [esp + 0x1f8], 0x13e611f4
mov dword [esp + 0x1fc], 0x1f8d1dfd
mov dword [esp + 0x200], 0x1b3a1984
mov dword [esp + 0x204], 0x7eb05fa
mov dword [esp + 0x208], 0x3910192
mov dword [esp + 0x20c], 0xf990de5
mov dword [esp + 0x210], 0xb0a099e
mov word [esp + 0x214], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1d
ja 0x69a317
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
movzx ecx, byte [esp + ecx + 0x1f8]
mov edx, eax
xor edx, 0x568653c4
and eax, 0xd68653c4
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x698], eax
mov eax, dword [esp + 0x698]
mov ecx, eax
not ecx
and ecx, 0xd4
and eax, 0x2b
sub eax, ecx
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1f8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1e
jb 0x69a2c0
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x69a341
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x69a330
mov word [eax], 0
movzx ecx, word [esp + 0x1f8]
test cx, cx
mov dword [esp + 0x1c], ebx
je 0x69a371
lea edx, [esp + 0x1fa]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x69a360
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.006c2ec0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x6c9fa8]
Function at 0x69e690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x40]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x69e6a0
sar ebp, 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x6cf750]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x69e6cf
mov eax, 0xffffffff
jmp 0x69e6d2
lea eax, [edi + edi]
push eax
call fcn.0068c580
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x6cf750]
lea ebx, [esp + 0x14]
push ebx
push esi
call fcn.006c3080
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x6ca2e4]

Function at 0x6a02d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x6a02e0
cmp eax, 0xffffffed
jge 0x6a02f7
mov eax, 0xffffffff
jmp 0x6a02fa
add eax, 0x12
push eax
call fcn.0068c580
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xd163cf10
mov dword [esp + 8], 0xd569d377
mov dword [esp + 0xc], 0xd938d720
mov dword [esp + 0x10], 0xdd78db7c
mov word [esp + 0x14], 0xdfdc
mov dword [esp + 0x16], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x15
ja 0x6a0389
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xe5e94c2d
and eax, 0xe5e94c2d
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x1f
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x16
jb 0x6a0350
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x6a03b1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x6a03a0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x6a03e1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x6a03d0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.006c3080
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x6ca3b4]
Function at 0x6a7370
Capabilities:
Copy file
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.006a7390
add esp, 4
test al, al
je 0x6a7bb0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x6cb578]
Function at 0x6b2d80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0068df50
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x6b2db9
jmp 0x6b2edf
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x6b2ed9
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0068c690
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x6b2eca
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [esi], 0xdf
mov byte [esi + 1], 0xf5
mov byte [esi + 2], 0xf7
mov byte [esi + 3], 0xef
mov byte [esi + 4], 0xfa
mov byte [esi + 5], 0xee
mov byte [esi + 6], 0xc3
mov byte [esi + 7], 0xd5
mov byte [esi + 8], 0xc4
mov byte [esi + 9], 0x93
mov byte [esi + 0xa], 0xd2
mov byte [esi + 0xb], 0xdf
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 0xa5
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x6b2e5c
jmp 0x6b2e6a
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x6b2ea8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov edi, edx
call fcn.006b5ae0
mov edx, edi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x6b2e71
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0068d0c0
mov bl, al
and bl, 1
jmp 0x6b2ec8
jmp 0x6b2eca
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b82c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x6b82e0
mov dword [esp + 4], 0xcecec8bf
mov byte [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 4
ja 0x6b8340
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0xbbbfe632
xor esi, edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
add bl, 6
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 5
jb 0x6b8310
test edx, edx
je 0x6b83ae
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x6b8371
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x6b8360
cmp edi, 3
jb 0x6b83ae
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x6b8380
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6bc600
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0xb9babb54
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x6bc66b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x772ebdf
and ecx, 0x772ebdf
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xa5
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x6bc630
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
mov edx, dword [0x6cd2d0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx

Function at 0x6bc6c0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x6cd308]
Function at 0x6bc760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x6bc7d1
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [edx + eax*2]
mov edx, eax
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x4a
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x6bc790
mov edi, dword [esp + 4]
mov eax, dword [0x6cf754]
test eax, eax
je 0x6bc826
xor ecx, ecx
mov edx, dword [0x6cf758]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x6bc800
inc ecx
cmp eax, ecx
jne 0x6bc7f0
jmp 0x6bc826
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x6bc826
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x6cf75c]
push eax
call fcn.006bf5f0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x6bc975
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.006bc600
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x6bc8b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x3b8cc0be
and edx, 0x3b8cc0be
lea edx, [edi + edx*2]
mov edi, edx
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x4a
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x6bc870
mov edi, dword [esp + 4]
mov edx, dword [0x6cf754]
test edx, edx
je 0x6bc906
xor ebx, ebx
mov ebp, dword [0x6cf758]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x6bc8e1
inc ebx
cmp edx, ebx
jne 0x6bc8d0
jmp 0x6bc906
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x6bc906
push 0
push ecx
push eax
push 5
push 4
push dword [0x6cf75c]
push edx
mov esi, eax
call fcn.006bf5f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x6bc96c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x6bc945
add ebx, 2
cmp bp, si
je 0x6bc930
cmp bp, si
je 0x6bc957
mov ebx, dword [edx]
test ebx, ebx
jne 0x6bc920
mov edi, 0xc0000225
jmp 0x6bc96c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.006bc6c0
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x6bc9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x6bcaa0
xor eax, eax
cmp dword [ecx], 0
jne 0x6bcb02
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x74750a0b
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x6bca71
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
mov esi, eax
xor esi, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [esi + eax*2]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0x4a
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x6bca30
mov eax, dword [esp + 0xc]
mov esi, dword [0x6cf754]
test esi, esi
je 0x6bcb02
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x6cf758]
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x6bcb0b
inc edi
cmp esi, edi
jne 0x6bca90
jmp 0x6bcb02
mov dword [esp + 0x14], 0xd3121118
mov word [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x6bcafe
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
mov edx, eax
xor edx, 0x412ffd04
and eax, 0xc12ffd04
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xec
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x6bcac0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x6bcb02
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x6cf75c]
push esi
call fcn.006bf5f0
add esp, 0x1c
jmp 0x6bcb02
Function at 0x6bcb50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x6bcc25
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x6bcbc3
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x3b8cc0be
and edx, 0x3b8cc0be
lea edx, [edi + edx*2]
mov edi, edx
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x4a
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x6bcb80
mov edx, dword [0x6cf754]
test edx, edx
je 0x6bcc18
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x6cf758]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x6bcbfa
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, edx
jb 0x6bcbe0
jmp 0x6bcc18
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x6bcc18
push eax
push 1
push dword [0x6cf75c]
push edx
mov esi, ecx
call fcn.006bf5f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6bcc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x6bcce6
mov edx, dword [ecx]
test edx, edx
je 0x6bcce6
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x6bccb1
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, eax
xor edi, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [edi + eax*2]
mov edi, eax
and edi, esi
add eax, esi
add edi, edi
sub eax, edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x4a
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x6bcc70
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 4]
mov ebx, dword [0x6cf754]
test ebx, ebx
je 0x6bcd76
xor edi, edi
mov esi, dword [0x6cf758]
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x6bcd52
inc edi
cmp ebx, edi
jne 0x6bccd0
mov edi, dword [ebp + 0x10]
jmp 0x6bcd76
mov dword [esp + 4], 0xf4e4970
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x6bcd49
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x1903de92
and eax, 0x1903de92
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x26
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x6bcd10
mov eax, dword [esp + 4]
jmp 0x6bce72
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x6bcd76
push dword [ebp + 8]
push edx
push 2
push dword [0x6cf75c]
push esi
mov esi, ecx
call fcn.006bf5f0
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x6bce65
cmp eax, 0xc000010a
jne 0x6bce65
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x6bce14
nop
nop
nop
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
movzx esi, byte [esp + esi + 4]
mov edi, eax
xor edi, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [edi + eax*2]
mov edi, eax
and edi, esi
add eax, esi
add edi, edi
sub eax, edi
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x4a
mov esi, dword [esp + 0xc]
mov byte [esp + esi + 4], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 5
jb 0x6bcdd0
mov eax, dword [esp + 4]
mov esi, dword [0x6cf754]
test esi, esi
je 0x6bce65
xor edi, edi
mov ebx, dword [0x6cf758]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x6bce40
inc edi
cmp esi, edi
jne 0x6bce30
jmp 0x6bce65
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x6bce65
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 3
push dword [0x6cf75c]
push esi
mov esi, ecx
call fcn.006bf5f0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x6bce72
mov esi, eax
call fcn.006bcb50
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x6bce80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x6bcf12
push 0xfb1631b0
push dword [0x6cf748]
call fcn.006c2380
add esp, 8
test eax, eax
je 0x6bcedd
mov ecx, dword [esi]
test ecx, ecx
je 0x6bcf0f
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x6bceeb
cmp dword [esp + 4], 0
je 0x6bceeb
mov dword [esi + 4], 3
jmp 0x6bcf0f
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x6bcfb7
lea eax, [esp + 0xc]
push eax
call fcn.006c2cb0
add esp, 4
test al, al
je 0x6bcf0f
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x6bcf0c
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x6bcfb7
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x6bcf81
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [esi + eax*2]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x4a
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x6bcf40
mov eax, dword [esp + 4]
mov edx, dword [0x6cf754]
test edx, edx
je 0x6bd084
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x6cf758]
nop
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x6bd060
inc esi
cmp edx, esi
jne 0x6bcfa0
jmp 0x6bd084
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x6bd021
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [esi + eax*2]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x4a
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x6bcfe0
mov eax, dword [esp + 4]
mov edx, dword [0x6cf754]
test edx, edx
je 0x6bd084
xor esi, esi
mov ebx, dword [0x6cf758]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x6bd050
inc esi
cmp edx, esi
jne 0x6bd040
jmp 0x6bd084
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x6bd084
push ebp
push edi
push dword [esp + 0x30]
jmp 0x6bd06e
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x6bd084
push dword [esp + 0x30]
push edi
push ebp
push dword [esp + 0x30]
push ecx
push 5
push dword [0x6cf75c]
push edx
call fcn.006bf5f0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x6bd400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x6bd419
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x6bd42a
cmp eax, 2
je 0x6bd4a0
jmp 0x6bd4cd
push 0xfb1631b0
push dword [0x6cf748]
call fcn.006c2380
add esp, 8
test eax, eax
je 0x6bd46b
mov ecx, dword [esi]
test ecx, ecx
je 0x6bd498
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x6bd474
cmp dword [esp + 4], 0
je 0x6bd474
mov dword [esi + 4], 3
jmp 0x6bd498
mov dword [esi + 4], 1
jmp 0x6bd4cd
lea eax, [esp + 0xc]
push eax
call fcn.006c2cb0
add esp, 4
test al, al
je 0x6bd498
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x6bd495
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x6bd4cd
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x6d7768]
call fcn.006c2380
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x6bd584
mov ecx, dword [esi]
mov dword [esp + 4], 0x74750a0b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x6bd531
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x3b8cc0be
and eax, 0x3b8cc0be
lea eax, [esi + eax*2]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x4a
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x6bd4f0
mov eax, dword [esp + 4]
mov edx, dword [0x6cf754]
test edx, edx
je 0x6bd584
xor esi, esi
mov ebx, dword [0x6cf758]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x6bd560
inc esi
cmp edx, esi
jne 0x6bd550
jmp 0x6bd584
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x6bd584
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x6cf75c]
push edx
call fcn.006bf5f0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18