joyce8/EMBER2024-capa huggingface dataset:
Function at 0x772610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x776b20
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
cmp dword [edx + 0x14], 8
mov esi, edx
jb 0x77264a
mov esi, dword [edx]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], 0
push esi
call fcn.008d0b91
add esp, 4
cmp eax, 7
jbe 0x772694
sub esp, 0xc
movzx ecx, byte [ebp - 0x28]
mov byte [esp + 4], cl
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x40]
call fcn.00672660
cmp dword [ebp - 0x2c], 8
jae 0x7726b8
lea eax, [ebp - 0x40]
jmp 0x7726bb
mov dword [ebp - 0x30], eax
mov ecx, eax
add ecx, eax
lea edx, [ebp - 0x40]
push ecx
push esi
push edx
mov esi, eax
call fcn.00901d90
add esp, 0xc
mov word [ebp + esi*2 - 0x40], 0
cmp dword [ebp - 0x2c], 8
jb 0x77268f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], 1
sub esp, 0x1c
movaps xmm0, xmmword [0x9a75b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2200000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x77272e
mov eax, dword [ebp - 0x40]
lea esi, [ecx*2 + 2]
cmp esi, 0x1000
jb 0x772721
mov edx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, edx
cmp eax, 0x20
jae 0x772800
add ecx, ecx
add ecx, 0x25
mov esi, ecx
mov eax, edx
push esi
push eax
call fcn.008ea1ad
add esp, 8
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x772752
mov dword [ebp - 0x10], 3
mov ecx, dword [ebp - 0x24]
mov edx, eax
push dword [ebp + 8]
push dword [ebp - 0x20]
call fcn.00773ac0
add esp, 8
jmp 0x7727d6
mov dword [ebp - 0x10], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov esi, dword [ebp + 8]
jne 0x7727c5
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x14], 8
mov eax, ecx
jb 0x772774
mov eax, dword [ecx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp eax, 0xffffffff
mov esi, dword [ebp + 8]
je 0x7727bc
mov eax, 5
test ecx, 0x400
jne 0x7727c5
push ecx
push dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
call fcn.00774cb0
mov ecx, dword [ebp - 0x20]
add esp, 8
and ecx, 0x10
cmp ecx, 1
mov ecx, 3
sbb ecx, 0
mov edx, dword [ebp - 0x24]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x7727d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov edx, eax
push esi
push dword [ebp - 0x20]
call fcn.00773c70
add esp, 8
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x7727ec
mov dword [ebp - 0x10], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.008cd651
nop dword [eax]
push ebp
sub esp, 0x1c
add ebp, 0xc
call fcn.00901a00
nop dword [eax]
push ebp
sub esp, 0x1c
add ebp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00659e60
add esp, 0x1c
pop ebp
ret
Function at 0x7750f0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebx
push edi
push esi
mov ebx, edx
mov esi, ecx
test bl, 1
je 0x775117
mov eax, ebx
and eax, 0xfffffffe
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x77510b
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x77516e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x775121
mov eax, dword [esi]
test bl, 0x10
jne 0x77512f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x775136
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, eax
mov al, 1
test ecx, ecx
je 0x775142
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, eax
call fcn.00773d70
test al, al
jne 0x775194
test bl, 1
je 0x775181
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x775164
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x775181
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, eax
call fcn.00773d70
test al, al
jne 0x775194
push 0x9a7972
push dword [esp + 0x14]
push esi
push edi
call fcn.0077d080
add esp, 0x10
xor eax, eax
jmp 0x77513e
Function at 0x77e050
Capabilities:
Parse pe header

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
movzx edx, word [ecx]
xor esi, esi
cmp edx, 0x5a4d
mov edx, 0
cmove edx, ecx
mov edx, dword [edx + 0x3c]
lea edi, [ecx + edx]
cmp dword [ecx + edx], 0x4550
cmovne edi, esi
cmp dword [edi + 0x74], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + eax*8 + 0x78]
cmovb eax, esi
mov edx, dword [eax + 4]
mov dword [ecx], edx
mov eax, dword [eax]
pop esi
pop edi
ret 8
Function at 0x784000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
movzx eax, byte [0xa24890]
cmp al, 8
je 0x784030
mov cl, 0xd3
nop word cs:[eax + eax]
mov al, 0xb3
lock cmpxchg byte [0xa24890], cl
je 0x78403a
cmp al, 8
jne 0x784020
push 0xa24880
call fcn.008ebdaa
mov ebx, 0xfffffff0
lea edx, [0xe02b0fee]
mov ecx, 0x206f74f2
lea ebp, [0xe02b0fef]
mov esi, 0x206f74f1
nop word cs:[eax + eax]
mov dword [esp], edx
mov eax, ecx
mov edx, 0xf0f0f0f1
mul edx
mov edi, edx
mov eax, esi
mov edx, 0xf0f0f0f1
mul edx
mov eax, edx
shr eax, 4
and edx, 0xfffffff0
add edx, eax
movzx eax, byte [ebp + edx]
mov edx, dword [esp]
xor al, 0x4f
add byte [ebx + 0xa24890], al
mov eax, edi
shr eax, 4
and edi, 0xfffffff0
add edi, eax
movzx eax, byte [edx + edi]
xor al, 0x4f
add byte [ebx + 0xa24891], al
add edx, 0xfffffffe
add ecx, 2
add ebp, 0xfffffffe
add esi, 2
add ebx, 2
jne 0x784060
mov al, 8
xchg byte [0xa24890], al
push 0xa24880
call fcn.008ebdaa
int3
Function at 0x785a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
mov ebx, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x7895b0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
cmp dword [ebx + 0x14], 0
mov dword [ebp - 0x40], ebx
lea edi, [ebp - 0x149]
je 0x785af3
push 0x104
push 0
push edi
call fcn.00901a10
add esp, 0xc
mov dword [ebp - 0x44], 0
cmp dword [ebx + 0x18], 0x10
jb 0x785b54
mov eax, dword [ebx + 4]
jmp 0x785b57
push 0x105
push 0
push edi
call fcn.00901a10
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea esi, [ebp - 0x38]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push edi
call fcn.008d08c0
add esp, 4
cmp eax, 0xf
jbe 0x785c0a
sub esp, 0xc
movzx ecx, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 8], edi
mov dword [esp], eax
mov ecx, esi
call fcn.0066cb40
jmp 0x785c1f
lea eax, [ebx + 4]
lea ecx, [ebp - 0x44]
push ecx
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea esi, [ebp - 0x38]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push edi
call fcn.008d08c0
add esp, 4
cmp eax, 0xf
jbe 0x785ba6
sub esp, 0xc
movzx ecx, byte [ebp - 0x20]
mov byte [esp + 4], cl
mov dword [esp + 8], edi
mov dword [esp], eax
mov ecx, esi
call fcn.0066cb40
jmp 0x785bbb
mov dword [ebp - 0x28], eax
push eax
push edi
push esi
mov esi, eax
call fcn.00901d90
add esp, 0xc
mov byte [ebp + esi - 0x38], 0
mov dword [ebp - 0x3c], 0x922910
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x3c]
mov ecx, ebx
push eax
call fcn.0078a100
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
mov edi, dword [ebp - 0x40]
jb 0x785c6f
mov ecx, dword [ebp - 0x38]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x785c65
mov esi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, esi
cmp ecx, 0x20
jb 0x785c5e
mov dword [ebp - 0x10], 2
call fcn.008cd651
mov dword [ebp - 0x28], eax
push eax
push edi
push esi
mov esi, eax
call fcn.00901d90
add esp, 0xc
mov byte [ebp + esi - 0x38], 0
mov dword [ebp - 0x3c], 0x922910
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x3c]
mov ecx, ebx
push eax
call fcn.0078a100
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
mov edi, dword [ebp - 0x40]
jb 0x785c6f
mov ecx, dword [ebp - 0x38]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x785c65
mov esi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, esi
cmp ecx, 0x20
jae 0x785c85
add eax, 0x24
mov edx, eax
mov ecx, esi
push edx
push ecx
call fcn.008ea1ad
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x140
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.008cd651
nop word cs:[eax + eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.00901a00
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.00657390
add esp, 0x10
pop ebp
ret
Function at 0x7868f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov ebx, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x7895e0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea edi, [ebp - 0x145]
push 0x105
push 0
push edi
call fcn.00901a10
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
push edi
call fcn.008d08c0
add esp, 4
cmp eax, 0xf
jbe 0x786982
sub esp, 0xc
movzx ecx, byte [ebp - 0x20]
mov byte [esp + 4], cl
mov dword [esp + 8], edi
mov dword [esp], eax
mov ecx, esi
call fcn.0066cb40
jmp 0x786997
mov dword [ebp - 0x2c], eax
push eax
push edi
push esi
mov esi, eax
call fcn.00901d90
add esp, 0xc
mov byte [ebp + esi - 0x3c], 0
mov dword [ebp - 0x40], 0x922910
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x40]
mov dword [ebp - 0x24], ebx
mov ecx, ebx
push eax
call fcn.0078a100
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
mov edi, dword [ebp - 0x24]
jb 0x7869ea
mov ecx, dword [ebp - 0x3c]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x7869e0
mov esi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, esi
cmp ecx, 0x20
jae 0x786a00
add eax, 0x24
mov edx, eax
mov ecx, esi
push edx
push ecx
call fcn.008ea1ad
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.008cd651
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.00901a00
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00657390
add esp, 0xc
pop ebp
ret

Function at 0x787c30
Capabilities:
Get file attributes

Disassembly:
cmp dword [ecx + 0x18], 0x10
jb 0x787c3b
mov ecx, dword [ecx + 4]
jmp 0x787c3e
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
sete al
ret
Function at 0x78e9f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x78ebd0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [edx + 0x18], 0xf
mov dword [edx], 0x922910
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x145]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x145]
push edi
call fcn.008d08c0
add esp, 4
cmp eax, 0xf
mov dword [ebp - 0x24], esi
jbe 0x78ea9b
sub esp, 0xc
movzx ecx, byte [ebp - 0x20]
mov byte [esp + 4], cl
mov dword [esp + 8], edi
mov dword [esp], eax
mov ecx, esi
call fcn.0066cb40
jmp 0x78eab0
mov dword [ebp - 0x2c], eax
push eax
push edi
push esi
mov esi, eax
call fcn.00901d90
add esp, 0xc
mov byte [ebp + esi - 0x3c], 0
mov dword [ebp - 0x40], 0x920fc0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x28], 0x10
jb 0x78eac6
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
lea esi, [ebx + 4]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
mov edi, edx
sub edi, ecx
cmp edi, eax
jae 0x78eb03
mov dword [ebp - 0x10], 2
sub esp, 0x10
movzx ecx, byte [ebp - 0x20]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov ecx, esi
call fcn.0066d8c0
jmp 0x78eb24
lea edi, [ecx + eax]
mov dword [ebx + 0x14], edi
cmp edx, 0x10
jb 0x78eb11
mov esi, dword [ebx + 4]
add ecx, esi
push eax
push dword [ebp - 0x24]
push ecx
call fcn.00901d90
add esp, 0xc
mov byte [esi + edi], 0
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
mov edi, dword [ebp + 8]
jb 0x78eb5b
mov ecx, dword [ebp - 0x3c]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x78eb51
mov esi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, esi
cmp ecx, 0x20
jae 0x78eb71
add eax, 0x24
mov edx, eax
mov ecx, esi
push edx
push ecx
call fcn.008ea1ad
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.008cd651
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.00901a00
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00657390
add esp, 0x10
pop ebp
ret
Function at 0x78f090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x790e00
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ecx], 0x921198
lea edx, [ecx + 4]
mov dword [ecx + 8], 0
mov dword [ebp - 0x20], ecx
mov dword [ecx + 4], 0
lea eax, [esi + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], edx
push edx
push eax
call fcn.00901d07
add esp, 8
mov ecx, dword [ebp - 0x20]
mov dword [ecx], 0x9a8850
mov byte [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
lea eax, [ecx + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0xf
mov byte [ecx + 0x18], 0
mov dword [ecx + 0x14], 0x920fc0
lea eax, [ecx + 0x30]
mov dword [ebp - 0x2c], eax
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0xf
mov byte [ecx + 0x34], 0
mov dword [ecx + 0x30], 0x920fc0
lea eax, [ecx + 0x4c]
mov dword [ebp - 0x28], eax
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0xf
mov byte [ecx + 0x50], 0
mov dword [ecx + 0x4c], 0x920fc0
lea eax, [ecx + 0x68]
mov dword [ebp - 0x24], eax
movaps xmm0, xmmword [0x920580]
movups xmmword [ecx + 0x7c], xmm0
mov byte [ecx + 0x6c], 0
mov dword [ecx + 0x68], 0x920fc0
mov dword [ebp - 0x10], 1
push dword [ebp + 8]
call fcn.0078f200
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x795ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0xa47d50]
xor eax, esp
mov dword [esp + 0x28], eax
call fcn.00798360
xor edi, edi
cmp dword [esp + 0x40], 0
je 0x7960ca
mov ecx, dword [esp + 0x48]
cmp ecx, 0x11
jb 0x7960ca
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x44]
mov ebx, ecx
and ebx, 0xf
cmp ecx, 0x20
mov dword [esp], eax
jb 0x795f56
mov edi, ecx
and edi, 0xfffffff0
lea esi, [edi - 0x10]
mov ebp, dword [esp + 0x40]
mov ecx, dword [ebp + 0x18]
call dword [0xa0535c]
push dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x54]
push dword [esp + 0x4c]
push ebp
call ecx
add esp, 0x10
mov eax, dword [esp + 0x44]
add eax, edi
add eax, 0xfffffff0
mov dword [esp + 4], eax
add esi, edi
add esi, 0xfffffff0
mov edi, dword [esp + 4]
jmp 0x795f5a
mov ebp, dword [esp + 0x40]
movups xmm0, xmmword [ebp + 0x28]
movups xmm1, xmmword [edi]
xorps xmm1, xmm0
movups xmmword [esp + 0x18], xmm1
mov ecx, dword [ebp + 0x10]
call dword [0xa0535c]
lea eax, [esp + 0x18]
push eax
push eax
push ebp
call ecx
add esp, 0xc
test ebx, ebx
je 0x796011
add edi, 0x10
mov eax, dword [0xa25020]
mov ecx, dword [0xa25010]
mov ebp, edi
mov edi, 0x7def
sub edi, dword [esp]
sub ecx, edi
add ecx, eax
call dword [0xa0535c]
lea eax, [esp + 8]
push ebx
push ebp
push eax
call ecx
add esp, 0xc
mov dword [esp], esi
add esi, 0x10
mov eax, dword [0xa25020]
mov ecx, dword [0xa25010]
sub ecx, edi
add ecx, eax
call dword [0xa0535c]
push ebx
lea eax, [esp + 0x1c]
push eax
push esi
call ecx
add esp, 0xc
mov ebp, dword [esp + 0x48]
and ebp, 3
xor ecx, ecx
cmp ebx, 4
jb 0x796059
test byte [0xa570d8], 1
mov eax, dword [esp + 0x40]
jne 0x79605d
sub ebx, ebp
xor ecx, ecx
nop word [eax + eax]
mov edx, dword [esp + ecx + 8]
xor dword [esp + ecx + 0x18], edx
add ecx, 4
cmp ebx, ecx
jne 0x796000
jmp 0x79605d
lea edi, [esi - 0x10]
mov eax, dword [0xa25020]
mov ecx, dword [0xa25010]
mov ebx, 0x7def
sub ebx, dword [esp]
sub ecx, ebx
add ecx, eax
call dword [0xa0535c]
push 0x10
push edi
push esi
call ecx
add esp, 0xc
mov eax, dword [0xa25020]
mov ecx, dword [0xa25010]
sub ecx, ebx
add ecx, eax
call dword [0xa0535c]
push 0x10
lea eax, [esp + 0x1c]
push eax
push edi
jmp 0x7960c1
mov eax, dword [esp + 0x40]
lea esi, [eax + 0x28]
test ebp, ebp
je 0x79608c
test byte [0xa57018], 1
jne 0x79608c
lea edx, [esp + ecx]
add edx, 8
add ecx, esp
add ecx, 0x18
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [edx + ebx]
xor byte [ecx + ebx], al
inc ebx
cmp ebp, ebx
jne 0x796080
mov ebx, dword [esp + 0x40]
mov ecx, dword [ebx + 0x10]
call dword [0xa0535c]
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call ecx
add esp, 0xc
mov eax, dword [0xa25020]
mov ecx, dword [0xa25010]
sub ecx, edi
add ecx, eax
call dword [0xa0535c]
push 0x10
push esi
push dword [esp + 8]
call ecx
add esp, 0xc
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.008ea1d3
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x797940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x44]
mov eax, dword [0xa47d50]
xor eax, esp
mov dword [esp + 0x24], eax
xor esi, esi
test ebx, ebx
je 0x797af1
cmp dword [esp + 0x3c], 0
je 0x797af1
mov ebp, dword [esp + 0x40]
test ebp, ebp
je 0x797af1
mov edi, dword [esp + 0x48]
test edi, edi
je 0x797af1
cmp ebx, 0xf
ja 0x7979ba
mov esi, 0x10
sub esi, ebx
mov eax, dword [esp + 0x3c]
add eax, ebx
add eax, 0x28
lea ecx, [esp + 0x14]
push esi
push eax
push ecx
call fcn.00901d90
add esp, 0xc
lea eax, [esp + esi]
add eax, 0x14
push ebx
push ebp
push eax
call fcn.00901d90
add esp, 0xc
jmp 0x797a33
movups xmm0, xmmword [ebp + ebx - 0x10]
movups xmmword [esp + 0x14], xmm0
mov esi, ebx
shr esi, 4
mov eax, dword [esp + 0x3c]
add eax, 0x28
mov dword [esp], eax
mov ebx, dword [esp]
nop word cs:[eax + eax]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
call dword [0xa0535c]
lea eax, [esp + 4]
push eax
push ebx
push dword [esp + 0x44]
call ecx
add esp, 0xc
movups xmm0, xmmword [ebp]
movups xmmword [ebx], xmm0
mov eax, dword [esp + 4]
xor eax, dword [ebp]
mov dword [edi], eax
mov eax, dword [esp + 8]
xor eax, dword [ebp + 4]
mov dword [edi + 4], eax
mov eax, dword [esp + 0xc]
xor eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x10]
xor eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
add edi, 0x10
add ebp, 0x10
dec esi
jne 0x7979e0
mov esi, dword [esp + 0x44]
and esi, 0xf
je 0x797ae0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
lea ebx, [eax + 0x28]
call dword [0xa0535c]
lea eax, [esp + 4]
push eax
push ebx
push dword [esp + 0x44]
call ecx
add esp, 0xc
mov eax, dword [esp + 0x44]
and eax, 3
xor ecx, ecx
cmp esi, 4
jb 0x797aba
sub esi, eax
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [esp + ecx + 4]
xor dl, byte [ebp + ecx]
mov byte [edi + ecx], dl
movzx edx, byte [esp + ecx + 5]
xor dl, byte [ebp + ecx + 1]
mov byte [edi + ecx + 1], dl
movzx edx, byte [esp + ecx + 6]
xor dl, byte [ebp + ecx + 2]
mov byte [edi + ecx + 2], dl
movzx edx, byte [esp + ecx + 7]
xor dl, byte [ebp + ecx + 3]
mov byte [edi + ecx + 3], dl
add ecx, 4
cmp esi, ecx
jne 0x797a80
test eax, eax
je 0x797ae0
add edi, ecx
lea edx, [esp + ecx]
add edx, 4
add ebp, ecx
xor ecx, ecx
nop word [eax + eax]
movzx ebx, byte [edx + ecx]
xor bl, byte [ebp + ecx]
mov byte [edi + ecx], bl
inc ecx
cmp eax, ecx
jne 0x797ad0
movups xmm0, xmmword [esp + 0x14]
mov eax, dword [esp + 0x3c]
movups xmmword [eax + 0x28], xmm0
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.008ea1d3
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a7700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
cmp byte [0xa576c4], 0
jne 0x7a7833
movdqa xmm6, xmmword [0x9205c0]
mov ecx, 0xfffffc00
movdqa xmm1, xmmword [0x9a9250]
movdqa xmm7, xmmword [0x9a92b0]
nop word cs:[eax + eax]
movdqa xmm2, xmm6
psrld xmm2, 1
movdqa xmm0, xmm6
pslld xmm0, 0x1f
psrad xmm0, 0x1f
pand xmm0, xmm1
pxor xmm0, xmm2
movdqa xmm3, xmm0
psrld xmm3, 1
movdqa xmm2, xmm6
pslld xmm2, 0x1e
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm3
movdqa xmm3, xmm6
pslld xmm3, 0x1d
psrad xmm3, 0x1f
pand xmm3, xmmword [0x9a9260]
movdqa xmm4, xmm6
pslld xmm4, 0x1c
psrad xmm4, 0x1f
pand xmm4, xmmword [0x9a9270]
pxor xmm4, xmm3
movdqa xmm5, xmm6
pslld xmm5, 0x1b
psrad xmm5, 0x1f
pand xmm5, xmmword [0x9a9280]
movdqa xmm3, xmm6
pslld xmm3, 0x1a
psrad xmm3, 0x1f
pand xmm3, xmmword [0x9a9290]
pxor xmm3, xmm5
pxor xmm3, xmm4
movdqa xmm4, xmm2
psrld xmm4, 6
pxor xmm3, xmm4
pslld xmm2, 0x1a
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm3
pslld xmm0, 0x1a
psrad xmm0, 0x1f
pand xmm0, xmmword [0x9a92a0]
pxor xmm2, xmm0
movdqu xmmword [ecx + 0xa57ac8], xmm2
paddd xmm6, xmm7
add ecx, 0x10
jne 0x7a7740
mov byte [0xa576c4], 1
test esi, esi
je 0x7a79a0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x7a79a0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esi]
test ebp, ebp
je 0x7a799c
mov eax, ebx
jmp 0x7a797c
mov ebx, eax
xor al, byte [ecx + 1]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov eax, ebx
xor bl, byte [ecx + 2]
shr eax, 8
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
mov ebx, eax
xor al, byte [ecx + 3]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov eax, ebx
xor bl, byte [ecx + 4]
shr eax, 8
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
mov ebx, eax
xor al, byte [ecx + 5]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov eax, ebx
xor bl, byte [ecx + 6]
shr eax, 8
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
mov ebx, eax
xor al, byte [ecx + 7]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov eax, ebx
xor bl, byte [ecx + 8]
shr eax, 8
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
mov ebx, eax
xor al, byte [ecx + 9]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov eax, ebx
xor bl, byte [ecx + 0xa]
shr eax, 8
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
mov ebx, eax
xor al, byte [ecx + 0xb]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov edx, ebx
xor bl, byte [ecx + 0xc]
shr edx, 8
movzx eax, bl
xor edx, dword [eax*4 + 0xa576c8]
mov eax, edx
xor dl, byte [ecx + 0xd]
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0xa576c8]
mov ebx, eax
shr ebx, 8
xor al, byte [ecx + 0xe]
movzx eax, al
xor ebx, dword [eax*4 + 0xa576c8]
mov eax, ebx
shr eax, 8
xor bl, byte [ecx + 0xf]
add ecx, 0x10
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
mov edi, 0xfffffff0
mov ebx, eax
add ebp, edi
je 0x7a799e
shr eax, 8
xor bl, byte [ecx]
movzx edx, bl
xor eax, dword [edx*4 + 0xa576c8]
cmp ebp, 0x10
jae 0x7a7860
inc ecx
mov edi, 0xffffffff
jmp 0x7a7976
mov eax, ebx
mov dword [esi], eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x81b010
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [0xa31d00]
cmp al, 0xc
je 0x81b030
mov cl, 0x17
nop dword [eax]
mov al, 0xc1
lock cmpxchg byte [0xa31d00], cl
je 0x81b03a
cmp al, 0xc
jne 0x81b020
push 0xa31cf0
call fcn.008ebdaa
mov eax, 0xd
nop
lea ecx, [eax - 1]
and ecx, 0xe
xor ecx, 0xf
movzx ecx, byte [ecx + 0x9b6bd0]
xor cl, 0xb4
add byte [eax + 0xa31ce3], cl
mov ecx, eax
not ecx
and ecx, 0xe
movzx ecx, byte [ecx + 0x9b6bd0]
xor cl, 0xb4
add byte [eax + 0xa31ce4], cl
add eax, 2
cmp eax, 0x1d
jne 0x81b040
mov al, 0xc
xchg byte [0xa31d00], al
push 0xa31cf0
call fcn.008ebdaa
int3