joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45be90
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x478240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x9dd804]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], eax
test esi, esi
jne 0x478289
push dword [ebp + 0x20]
push eax
push ecx
call fcn.00435900
add esp, 0xc
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00698575
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x20]
xor eax, eax
push edi
mov dword [ebp - 0x38], ebx
cmp byte [esi + 0x1c], al
jne 0x4782c2
cmp byte [esi + 0x1a], al
je 0x4782a3
movzx edi, byte [esi + 0x19]
jmp 0x4782a5
xor edi, edi
push dword [esi + 4]
call fcn.00436420
add esp, 4
lea ecx, [edi + eax]
cmp ebx, ecx
jae 0x4782be
push 0xc3
jmp 0x47832f
mov eax, ebx
sub eax, ecx
push eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push esi
call fcn.004785f0
movzx ebx, byte [esi + 0x18]
add esp, 0x18
mov dword [ebp - 0x3c], eax
mov al, byte [esi + 0x1f]
mov byte [ebp - 0x25], al
test al, al
je 0x478305
movzx ecx, byte [esi + 0x19]
lea eax, [ebp - 0x14]
mov edi, ebx
sub edi, ecx
push edi
push 0
push eax
mov dword [ebp - 0x2c], edi
call fcn.0069a540
mov eax, edi
jmp 0x478318
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0069a6e0
mov eax, ebx
mov dword [ebp - 0x2c], eax
movzx edi, byte [esi + 0x19]
add esp, 0xc
cmp byte [esi + 0x1a], 0
je 0x478379
cmp dword [ebp + 0x20], edi
jae 0x478355
push 0xdd
push 0x928168
push 0x70
push 0
push 0x10
call fcn.00447a40
add esp, 0x14
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00698575
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x30]
lea ecx, [ebp - 0x14]
add eax, ecx
push eax
call fcn.0069a6e0
mov edx, dword [ebp - 0x30]
add esp, 0xc
mov eax, dword [ebp + 0x20]
add edx, edi
sub eax, edi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], eax
jmp 0x47838e
push edi
push dword [ebp - 0x34]
lea ecx, [ebp - 0x14]
add eax, ecx
push eax
call fcn.0069a6e0
mov edx, dword [ebp - 0x30]
add esp, 0xc
mov eax, dword [ebp - 0x2c]
add eax, edi
cmp byte [ebp - 0x25], 0
mov dword [ebp - 0x2c], eax
je 0x4783b2
xor ecx, ecx
test ebx, ebx
je 0x4783b2
mov al, byte [esi + ecx + 0xc]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, ebx
jb 0x4783a2
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x38]
push ecx
push edx
push eax
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x40]
push eax
push edx
lea eax, [esi + 4]
push eax
call fcn.004362d0
add esp, 0x28
test eax, eax
je 0x478342
push dword [ebp - 0x40]
push dword [ebp - 0x30]
push dword [ebp - 0x44]
call fcn.00435900
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 1
pop edi
pop ebx
pop esi
call fcn.00698575
mov esp, ebp
pop ebp
ret
Function at 0x478410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x9dd804]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], edi
test esi, esi
jne 0x478487
cmp ebx, dword [ebp + 0x14]
jbe 0x478475
push 0x106
push 0x928168
push 0x79
push 0
push 0x10
call fcn.00447a40
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00698575
mov esp, ebp
pop ebp
ret
push ebx
push edx
push eax
call fcn.00699ae0
add esp, 0xc
mov dword [edi], ebx
jmp 0x4785d0
push ebx
push ecx
push dword [ebp + 0x1c]
lea eax, [ebp - 0x24]
push dword [ebp + 0x18]
push eax
push esi
call fcn.004785f0
movzx edi, byte [esi + 0x18]
add esp, 0x18
cmp byte [esi + 0x1f], 0
mov dword [ebp - 0x38], eax
je 0x4784bd
movzx ecx, byte [esi + 0x19]
lea eax, [ebp - 0x14]
sub edi, ecx
push edi
push 0
push eax
call fcn.0069a540
jmp 0x4784cb
push edi
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0069a6e0
movzx eax, byte [esi + 0x19]
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
add eax, edi
cmp byte [esi + 0x1b], 0
je 0x4784fc
push eax
call fcn.00453c60
add esp, 8
test eax, eax
jne 0x478508
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00698575
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x2c]
push eax
call fcn.0069a6e0
add esp, 0xc
movzx edx, byte [esi + 0x19]
add edi, edx
mov dword [ebp - 0x2c], 0
cmp byte [esi + 0x1a], 0
je 0x478577
cmp dword [ebp + 0x14], edx
jae 0x47852a
push 0x132
jmp 0x47844f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
add eax, ebx
cmp ecx, eax
jae 0x478552
lea eax, [edx + ecx]
cmp dword [ebp - 0x30], eax
jae 0x478552
push 0x136
push 0x928168
push 0xbd
jmp 0x478456
movzx eax, byte [esi + 0x18]
push edx
lea edx, [ebp - 0x14]
add eax, edx
push eax
push ecx
call fcn.0069a6e0
movzx ecx, byte [esi + 0x19]
add esp, 0xc
mov eax, dword [ebp + 0x14]
add dword [ebp - 0x28], ecx
sub eax, ecx
mov dword [ebp - 0x2c], ecx
jmp 0x47857a
mov eax, dword [ebp + 0x14]
cmp byte [esi + 0x1f], 0
mov dword [ebp - 0x34], eax
je 0x47859d
movzx edx, byte [esi + 0x18]
xor ecx, ecx
test edx, edx
je 0x47859d
nop dword [eax]
mov al, byte [esi + ecx + 0xc]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, edx
jb 0x478590
push dword [ebp - 0x38]
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x30]
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push edi
push eax
push dword [ebp - 0x34]
lea eax, [esi + 4]
push ebx
push dword [ebp - 0x28]
push eax
call fcn.00436360
add esp, 0x28
test eax, eax
je 0x478462
mov eax, dword [ebp - 0x2c]
add dword [ebx], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00698575
mov esp, ebp
pop ebp
ret
Function at 0x48dd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp + 0x10], ecx
test eax, eax
je 0x48de62
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x48de62
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x48de62
mov edx, dword [esi + 0x18]
cmp edx, 2
je 0x48de62
cmp edx, 1
jne 0x48ddaa
cmp dword [esi + 4], 0x2a
jne 0x48de62
test edx, edx
je 0x48ddc3
push edi
push ebx
push dword [eax + 0x30]
call fcn.0048eb20
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ecx + 0x30], eax
mov ecx, edi
cmp edi, 3
jb 0x48de5b
mov eax, dword [esi + 0x2c]
cmp edi, eax
jbe 0x48dddc
mov ecx, eax
sub edi, ecx
mov dword [ebp + 0x10], ecx
add ebx, edi
push ecx
push ebx
push dword [esi + 0x38]
call fcn.0069a6e0
mov eax, dword [esi + 0x38]
add esp, 0xc
mov edi, dword [ebp + 0x10]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x470], edi
mov dword [esi + 0x460], edi
movzx edx, byte [eax]
mov dword [esi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
lea eax, [edi - 3]
and edx, dword [esi + 0x54]
xor ebx, ebx
mov dword [esi + 0x48], edx
mov dword [ebp + 8], eax
nop word [eax + eax]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x34]
and edx, ebx
movzx edi, byte [eax + ebx + 2]
mov eax, dword [esi + 0x48]
shl eax, cl
mov ecx, dword [esi + 0x40]
xor edi, eax
and edi, dword [esi + 0x54]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x48], edi
mov ax, word [eax + edi*2]
mov word [ecx + edx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], bx
inc ebx
cmp ebx, dword [ebp + 8]
jbe 0x48de20
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
pop ebp
ret
Function at 0x48df30
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, 0x1505
push edi
mov edi, dword [eax + 0x38]
add edi, ecx
cmp esi, 0x102
jae 0x48e04a
test esi, esi
je 0x48e04a
xor edx, edx
test esi, esi
je 0x48df79
movzx ecx, byte [edx + edi]
mov eax, ebx
shl eax, 5
inc edx
add ebx, eax
add ebx, ecx
cmp edx, esi
jb 0x48df64
mov ecx, dword [ebp + 0xc]
movzx eax, bl
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + eax*4 + 0x60]
mov dword [ebx + eax*4 + 0x60], ecx
mov dword [ebp + 0x10], edx
mov dword [ebx + 0x474], 0
test edx, edx
je 0x48e04a
sub ecx, edx
cmp ecx, esi
jbe 0x48e04a
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
cmp ecx, eax
jae 0x48e04a
cmp esi, dword [ebx + 0x478]
ja 0x48e04a
xor edi, edi
test esi, esi
je 0x48e014
mov eax, dword [ebx + 0x38]
mov ebx, edx
mov ecx, dword [ebp + 0xc]
add ecx, eax
sub eax, ecx
add eax, edx
sub ecx, edx
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], ecx
nop
mov edx, dword [ebp + 0xc]
add ecx, ebx
mov al, byte [ecx]
cmp al, byte [ecx + edx]
jne 0x48e04a
mov eax, dword [ebp + 8]
mov edx, ebx
shr edx, 3
mov cl, bl
and cl, 7
mov eax, dword [eax + 0x5c]
mov al, byte [edx + eax]
shr al, cl
test al, 1
je 0x48e04a
mov ecx, dword [ebp - 4]
inc edi
inc ebx
cmp edi, esi
jb 0x48dfe0
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x38]
lea ecx, [edx + esi]
cmp byte [ecx + eax - 1], 0x3b
je 0x48e03b
mov eax, dword [ebx + 0x5c]
lea ecx, [edx + esi]
mov edx, ecx
and cl, 7
shr edx, 3
mov al, byte [edx + eax]
shr al, cl
test al, 1
jne 0x48e04a
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
mov dword [ebx + 0x474], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48eda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x48edac
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.0048edc0

Function at 0x4b0910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b66e0

Function at 0x4b4980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xc
call fcn.00698526
add esp, 4
test eax, eax
je 0x4b49a5
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
jmp 0x4b49a7
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x4b49f0
push 0x80000
push 0
call fcn.006a2097
add esp, 0x18
cmp eax, 0xffffffff
je 0x4b49d8
test eax, eax
je 0x4b49d8
push eax
call dword [0x702080]
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.0069f851
mov eax, dword [eax]
mov esp, ebp
pop ebp
ret
Function at 0x4ca230
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4ca262
mov eax, dword [edi + 4]
mov al, byte [ecx + eax - 1]
cmp al, 0x5b
je 0x4ca262
cmp al, 0x7b
je 0x4ca262
cmp al, 0x3a
je 0x4ca262
cmp al, 0x2c
je 0x4ca262
push 0x2c
lea ecx, [edi + 4]
call fcn.004b37d0
add edi, 4
push 0x22
mov ecx, edi
call fcn.004b37d0
mov ecx, dword [ebp + 0xc]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
sub ecx, edx
mov dword [ebp - 8], edx
mov dword [ebp + 0xc], ecx
test ecx, ecx
jle 0x4ca32e
mov eax, dword [ebp + 8]
dec ecx
inc eax
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov ecx, dword [ebp - 4]
push ebx
mov ebx, edx
shr ebx, 1
inc ebx
nop
movzx esi, byte [ecx - 1]
movzx eax, byte [ecx]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 1]
shl esi, 8
mov ecx, edi
or esi, eax
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + 0x939740]
push eax
call fcn.004b37d0
mov eax, esi
mov ecx, edi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x939740]
push eax
call fcn.004b37d0
mov eax, esi
mov ecx, edi
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x939740]
push eax
call fcn.004b37d0
and esi, 0x3f
mov ecx, edi
movzx eax, byte [esi + 0x939740]
push eax
call fcn.004b37d0
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
sub ebx, 1
jne 0x4ca2b0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
pop ebx
cmp edx, 1
jne 0x4ca36a
mov eax, dword [ebp + 8]
movzx esi, byte [ecx + eax]
mov ecx, edi
shl esi, 0x10
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + 0x939740]
push eax
call fcn.004b37d0
shr esi, 0xc
mov ecx, edi
and esi, 0x3f
movzx eax, byte [esi + 0x939740]
push eax
call fcn.004b37d0
push 0x3d
jmp 0x4ca3bc
cmp edx, 2
jne 0x4ca3cc
mov eax, dword [ebp + 8]
movzx esi, byte [ecx + eax + 1]
movzx eax, byte [ecx + eax]
mov ecx, edi
shl eax, 8
or esi, eax
shl esi, 8
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + 0x939740]
push eax
call fcn.004b37d0
mov eax, esi
mov ecx, edi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x939740]
push eax
call fcn.004b37d0
shr esi, 6
and esi, 0x3f
movzx eax, byte [esi + 0x939740]
push eax
mov ecx, edi
call fcn.004b37d0
push 0x3d
mov ecx, edi
call fcn.004b37d0
push 0x22
mov ecx, edi
call fcn.004b37d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4e0d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x10
push esi
mov esi, ecx
test edx, edx
je 0x4e0de1
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov eax, dword [ecx - 1]
and eax, 0xffff0000
cmp eax, 0x490000
jne 0x4e0d9a
mov edi, dword [ebp + 0xc]
add edi, 0xb
add edi, ecx
test edx, edx
jle 0x4e0de0
movzx eax, byte [edi]
lea edi, [edi + 1]
add eax, dword [esi]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
mov dword [esi], eax
sub edx, 1
jne 0x4e0d76
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
call fcn.00509680
test al, al
je 0x4e0de0
nop
mov eax, dword [esi]
add eax, dword [ebp - 0xc]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
lea ecx, [ebp - 0x10]
mov dword [esi], eax
call fcn.00509680
test al, al
jne 0x4e0dc0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f7cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dc7c0

Function at 0x4f7db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dc810
Function at 0x661b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi + 0x24], 0
jne 0x661c2c
cmp byte [edi + 0x24], 0
je 0x661bb8
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x10], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x20], xmm0
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edi]
jge 0x661c2c
push ebx
lea eax, [ecx + ecx*2]
add eax, eax
lea ebx, [esi + 4]
add ebx, eax
add eax, 6
add eax, edi
sub esi, edi
movzx edx, word [eax - 2]
cmp dx, word [ebx]
jne 0x661bea
mov cx, word [eax]
cmp cx, word [esi + eax]
jne 0x661bea
cmp byte [esi + eax + 2], 0
jne 0x661bee
mov byte [eax + 2], 0
mov cx, word [ebx]
add ebx, 6
and cx, dx
and word [eax], cx
mov word [eax - 2], cx
movzx ecx, cx
and word [esi + eax], cx
movzx ecx, word [esi + eax]
movzx edx, word [eax]
xor ecx, edx
not ecx
and word [eax - 2], cx
movzx ecx, word [eax - 2]
and ecx, edx
mov word [eax], cx
add eax, 6
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [edi]
jl 0x661bd1
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x68aca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x9dd804]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 6
call fcn.006807d0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 7
mov ecx, esi
mov byte [ebp - 9], 0x18
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 0x14
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0
mov ecx, esi
call fcn.00680940
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 6
mov ecx, esi
mov byte [ebp - 9], 0x10
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 1
mov ecx, esi
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
mov ecx, esi
call fcn.00680940
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
push 1
push 0
mov ecx, esi
call fcn.00680e00
push 0
mov ecx, esi
call fcn.0067f500
push 0
mov ecx, esi
call fcn.006807d0
push 2
push 2
mov ecx, esi
call fcn.006811b0
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
mov ecx, esi
mov dword [ebp - 0x60], 0
call fcn.0067bf90
mov word [ebp - 0xb], 0x9744
lea eax, [ebp - 0xc]
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
push eax
push 0
mov ecx, esi
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9644
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.006809a0
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9344
push eax
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.0067fb20
push 2
mov ecx, esi
call fcn.0067f500
push 1
mov ecx, esi
call fcn.0067f140
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 5
call fcn.0067f550
push 1
mov ecx, esi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.0067d300
push 1
mov ecx, esi
call fcn.0067f140
push 1
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
push 4
call fcn.0067f550
lea eax, [ebp - 0xbc]
mov dword [ebp - 0xbc], 0
push eax
mov ecx, esi
mov dword [ebp - 0xb8], 0
call fcn.0067bf90
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9744
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
mov ecx, esi
call fcn.00680a00
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9344
push eax
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.0067fb20
push 2
mov ecx, esi
call fcn.0067f500
push 1
mov ecx, esi
call fcn.0067f140
push 1
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
push 5
call fcn.0067f550
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.0067bf90
push 6
mov ecx, esi
call fcn.0067d300
mov ecx, esi
call fcn.00680840
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00698575
mov esp, ebp
pop ebp
ret
Function at 0x68af20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x9dd804]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 7
mov ecx, esi
mov word [ebp - 0xb], 0x2444
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb47
push eax
push 1
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 4
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x4344
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.0067f800
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], 0x301
push eax
push 2
mov ecx, esi
call fcn.0067fbc0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.0067fc20
push 1
push 2
mov ecx, esi
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
call fcn.0067c280
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 4
call fcn.0067f550
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xfc43
push eax
push 0
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.0067fbc0
push 1
mov ecx, esi
call fcn.0067f170
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.0067bf90
mov word [ebp - 0xb], 0xf47
mov byte [ebp - 0xc], 2
push 0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0067fb20
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
push 0
mov ecx, esi
call fcn.0067fc20
mov ecx, esi
call fcn.00680840
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00698575
mov esp, ebp
pop ebp
ret
Function at 0x68b080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x9dd804]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 6
call fcn.006807d0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 7
mov ecx, esi
mov byte [ebp - 9], 0x14
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 1
mov ecx, esi
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
mov ecx, esi
call fcn.00680940
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
push 1
push 6
mov ecx, esi
call fcn.0067fb80
lea eax, [ebp - 8]
mov dword [ebp - 8], 5
push eax
push 6
mov ecx, esi
call fcn.00680940
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb344
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.0067f800
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 6
mov ecx, esi
mov byte [ebp - 9], 0x10
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 6
mov ecx, esi
call fcn.00680940
push 6
mov ecx, esi
call fcn.0067f140
push 0
push 0
mov ecx, esi
call fcn.006811b0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb744
push eax
mov byte [ebp - 9], 7
mov ecx, esi
mov byte [ebp - 0xc], 3
push 2
call fcn.0067fbc0
push 1
push 2
push 0
mov ecx, esi
call fcn.00680a90
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb344
push eax
mov ecx, esi
mov byte [ebp - 9], 4
mov byte [ebp - 0xc], 3
call fcn.0067fb20
lea eax, [ebp - 8]
mov dword [ebp - 0xbc], 0
push eax
push 6
mov ecx, esi
mov dword [ebp - 0xb8], 0
mov dword [ebp - 8], 0
call fcn.0067eb30
push 1
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
push 4
call fcn.0067f550
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
mov ecx, esi
mov dword [ebp - 0x60], 0
call fcn.0067bf90
push 2
push 0
mov ecx, esi
call fcn.0067fb80
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb744
push eax
push 2
mov ecx, esi
mov byte [ebp - 9], 3
mov byte [ebp - 0xc], 3
call fcn.0067fbc0
push 1
push 2
push 0
mov ecx, esi
call fcn.00680a90
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb304
push eax
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.0067fb20
push 6
mov ecx, esi
call fcn.0067f140
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 5
call fcn.0067f550
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
call fcn.0067bf90
push 1
push 6
push 2
mov ecx, esi
call fcn.00680a90
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], 0x301
push eax
mov ecx, esi
call fcn.0067fb20
push 6
mov ecx, esi
call fcn.0067d300
mov ecx, esi
call fcn.00680840
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00698575
mov esp, ebp
pop ebp
ret