joyce8/EMBER2024-capa huggingface dataset:
Function at 0x81e310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [0xbcbae0]
mov esi, ecx
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [ecx + 0x28]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x81e339
test byte [esi + 0x39], 4
je 0x81e554
mov edi, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
lea ebx, [esp + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edi
mov dword [esp + 8], ecx
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
cmp word [esi + 0x34], 0
je 0x81e554
mov ebp, fcn.007c39b0
xor edi, edi
mov dword [esp + 4], esi
not ebp
and ebp, 1
mov eax, dword [esi + 4]
movsx ebx, word [eax + edi*2]
cmp ebx, 0xfffffffe
jne 0x81e3e1
mov ecx, dword [esp + 0xc]
lea eax, [edi + edi*4]
mov ecx, dword [ecx + eax*4 + 4]
mov dword [esp + 0x10], ecx
call fcn.007eee70
test eax, eax
jne 0x81e547
mov eax, 0x81e7f0
jmp 0x81e513
test bx, bx
js 0x81e547
mov eax, dword [esp + 8]
lea ecx, [ebx + ebx*4]
mov eax, dword [eax + 4]
test byte [eax + ecx*4 + 0x10], 0x20
je 0x81e547
mov edx, dword [eax + ecx*4 + 8]
test edx, edx
je 0x81e50a
mov ecx, ebp
xor eax, eax
add ecx, fcn.007c39b0
movzx ecx, byte [0xbac233]
sete al
bt ecx, eax
jb 0x81e4fa
mov al, byte [0xbac233]
mov ecx, ebp
mov ah, 1
add ecx, fcn.007c39b0
sete cl
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbac233], ah
jne 0x81e42d
mov ecx, ebp
movzx eax, al
add ecx, fcn.007c39b0
sete cl
xor cl, 7
movzx ecx, cl
bt eax, ecx
jae 0x81e47f
mov ecx, ebp
xor eax, eax
add ecx, fcn.007c39b0
movzx ecx, byte [0xbac233]
sete al
bt ecx, eax
jae 0x81e464
jmp 0x81e4fa
mov ecx, ebp
xor eax, eax
add ecx, fcn.007c39b0
movzx ecx, byte [0xbac233]
sete al
bt ecx, eax
jb 0x81e4e3
mov eax, ebp
xor ecx, ecx
add eax, fcn.007c39b0
mov eax, dword [str.2_p0]
sete cl
or ecx, 0x713e5c68
add ecx, 0x408
mov dword [esp], ecx
xor eax, ecx
mov ecx, dword [esp]
mov dword [str.2_p0], eax
not eax
shr ecx, 0x1f
or ecx, dword [esp]
imul ecx, eax
mov al, 1
xor dword [0xbac22c], ecx
mov ecx, dword [esp]
and cl, 7
shl al, cl
or byte [0xbac233], al
mov eax, ebp
add eax, fcn.007c39b0
mov al, 0xfe
sete cl
xor cl, 7
rol al, cl
and byte [0xbac233], al
mov ecx, edx
mov edx, str.2_p0
call fcn.00777e20
test eax, eax
jne 0x81e547
mov eax, 0x81e860
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], edi
lea esi, [esp + 0x2c]
mov ecx, esi
mov edx, dword [eax + 0x10]
mov ebx, eax
call fcn.007f1950
mov edx, dword [ebx + 8]
mov ecx, esi
call fcn.007f1a80
mov edx, dword [ebx + 0xc]
mov ecx, esi
call fcn.007f1a80
mov esi, dword [esp + 4]
movzx eax, word [esi + 0x34]
inc edi
cmp edi, eax
jb 0x81e3af
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00980459
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x81e9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
cmp dword [ecx + 0x58], 0
mov eax, 1
jne 0x81eb4d
mov eax, fcn.00839ed0
mov edx, 3
sub edx, eax
mov dword [esp + 0x10], edx
xor edi, edi
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov esi, dword [edi*4 + 0xb4ed30]
mov ebp, dword [edi*4 + 0xb4ed40]
mov dword [esp + 0x18], edi
xor ecx, fcn.00839ed0
sete al
mov ecx, eax
xor ecx, 0x923cbc1f
lea edx, [ecx + eax*2 + 0x3c0]
mov eax, 1
xor edx, dword [edi*4 + 0xb4ed50]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [esi + ebp - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x81eb03
mov dword [esp + 4], eax
mov al, byte [esi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x81ea88
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x81eaaa
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x81ea9f
jmp 0x81eb03
mov dword [esp + 0xc], ebx
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x81eaf9
lea ecx, [ebp - 4]
shr ecx, 2
je 0x81eaf1
xor eax, eax
mov ebx, esi
mov dword [esp + 0x14], ecx
mov edi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor edi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], edi
not edi
add ebx, 4
imul edx, edi
cmp eax, ecx
jne 0x81eac7
mov eax, dword [esp + 4]
or byte [esi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [esi + ebp - 1], al
mov edi, dword [esp + 0x18]
inc edi
cmp edi, 4
jne 0x81ea1c
mov ecx, dword [esp + 8]
mov eax, dword [ecx + 0x2c]
mov edx, dword [eax + 0x20]
mov eax, 1
cmp edx, 0xbb0e8c
je 0x81eb4d
cmp edx, 0xbb0e80
je 0x81eb4d
cmp edx, 0xbb22c4
je 0x81eb4d
cmp edx, 0xbb22e0
je 0x81eb4d
mov ecx, dword [ecx + 0x24]
test ecx, ecx
jne 0x81ea16
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x81ee90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebp, edx
mov esi, ecx
call fcn.007ebd10
mov ecx, esi
mov ebx, eax
call fcn.007f1720
mov ecx, ebx
mov edx, 0x45
mov dword [esp + 0x10], eax
push eax
push 0
call fcn.007c57e0
add esp, 8
cmp edi, 3
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
jl 0x81ef28
mov ecx, esi
call fcn.007f1720
mov esi, ebp
mov ebp, eax
mov ecx, ebx
mov edx, 0x73
push 0xffffffffffffffff
push 0xc1f2cd
push 0
push eax
push 0
call fcn.007ebd50
add esp, 0x14
mov ecx, ebx
call fcn.007f2430
add eax, 2
mov ecx, ebx
mov edx, 0x39
push esi
push eax
push ebp
call fcn.007c5800
add esp, 0xc
mov ecx, ebx
mov edx, 0x53
call fcn.00782720
jmp 0x81ef43
mov ecx, ebx
call fcn.007f2430
add eax, 2
mov ecx, ebx
mov edx, 0xf
push eax
push ebp
call fcn.007c57e0
add esp, 8
mov eax, fcn.007b6f50
mov ecx, 3
xor edx, edx
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov edi, dword [edx*4 + 0xb4ed60]
mov esi, dword [edx*4 + str._8__8]
mov dword [esp + 0x24], edx
xor eax, fcn.007b6f50
mov eax, 1
sete bl
xor ebx, 0x333c7561
add ebx, 0x104
xor ebx, dword [edx*4 + 0xb4eda0]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x81f03b
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x81efbd
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x81efdf
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x81efd4
jmp 0x81f03b
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x81f035
lea ecx, [esi - 4]
shr ecx, 2
je 0x81f02d
xor eax, eax
mov ebp, edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ebp
mov ecx, ebp
mov ebp, dword [ebp]
mov dword [esp], ebx
xor ebp, ebx
mov dword [ecx], ebp
mov ecx, eax
not ebp
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x20]
or ebx, dword [esp]
imul ebx, ebp
mov ebp, dword [esp + 0x28]
add ebp, 4
cmp eax, ecx
jne 0x81eff8
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
not dl
and byte [edi + esi - 1], dl
mov edx, dword [esp + 0x24]
inc edx
cmp edx, 5
jne 0x81ef55
mov ebp, dword [esp + 0xc]
mov ecx, ebp
call fcn.007f2430
mov edi, dword [esp + 0x14]
add eax, 2
mov ecx, ebp
mov edx, dword [edi*4 + str.99699]
push dword [esp + 8]
push eax
mov ebx, dword [esp + 0x18]
push ebx
call fcn.007c5800
add esp, 0xc
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.007f0b40
mov ecx, ebp
mov edx, 0x44
push 2
push 1
call fcn.007c57e0
add esp, 8
mov edx, dword [edi*4 + 0xb48008]
mov ecx, ebp
push 0xffffffffffffffff
call fcn.007ec2f0
add esp, 4
mov ecx, esi
mov edx, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007f0bc0
Function at 0x81f0c0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
mov ebp, dword [ecx + 4]
mov esi, edx
mov ecx, eax
call fcn.007ebd10
test ebp, ebp
je 0x81f1d2
mov edi, eax
mov ebx, ebp
cmp dword [ebp + 0x58], 0
jne 0x81f146
mov eax, dword [ebx + 0x2c]
test byte [eax + 5], 0x10
je 0x81f146
cmp byte [ebx + 0x11], 0x5a
je 0x81f146
mov ecx, edi
mov edx, 0x48
push dword [ebx + 0x38]
push 0
call fcn.007c57e0
add esp, 8
mov ecx, edi
mov edx, 0x21
push dword [ebx + 0x3c]
call fcn.007edd80
add esp, 4
mov ecx, edi
mov edx, 0x59
push dword [ebx + 0x38]
push 0
push dword [ebx + 0x3c]
call fcn.007c5800
add esp, 0xc
mov ecx, edi
call fcn.007f2430
lea edx, [eax - 2]
mov ecx, edi
call fcn.007ebd40
jmp 0x81f1c7
cmp dword [ebx + 0x40], 0
jne 0x81f1c7
mov ecx, ebx
call fcn.0081ffc0
mov ecx, edi
test esi, esi
je 0x81f1a4
mov edx, 0x9d
push eax
push dword [ebx + 0x34]
call fcn.007c57e0
add esp, 8
mov edx, dword [ebx + 0x2c]
mov ecx, edi
push 0xfffffffffffffff8
call fcn.007ec2f0
add esp, 4
mov ecx, edi
mov edx, 0x4d
push dword [ebx + 0x38]
push dword [ebx + 0x34]
call fcn.007c57e0
add esp, 8
mov ecx, edi
mov edx, 0x48
push dword [ebx + 0x34]
push 0
call fcn.007c57e0
add esp, 8
jmp 0x81f1c7
mov edx, 0x9c
push dword [ebx + 0x38]
push eax
push dword [ebx + 0x34]
call fcn.007c5800
add esp, 0xc
mov edx, dword [ebx + 0x2c]
mov ecx, edi
push 0xfffffffffffffff8
call fcn.007ec2f0
add esp, 4
mov ebx, dword [ebx + 0x24]
test ebx, ebx
jne 0x81f0de
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x81fdb0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp + 8], edx
mov ebp, dword [ecx]
mov ebx, ecx
mov eax, dword [esp + 0x4c]
mov ecx, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
call fcn.007ebd10
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
mov ecx, ebp
mov edi, dword [eax + 0xc]
call fcn.007f1720
mov ecx, ebp
mov dword [esp + 0x20], eax
call fcn.007f1720
mov esi, dword [ebp + 0x2c]
mov dword [esp], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], edi
inc esi
mov dword [ebp + 0x2c], esi
test byte [edi + 0xc], 1
jne 0x81fe24
mov dword [esp + 0xc], 0x69
jmp 0x81fe4a
mov ecx, dword [esp + 8]
xor eax, eax
mov edx, 0x37
cmp ecx, 0x36
sete al
xor eax, 0x39
cmp ecx, 0x39
cmovne edx, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0x6a
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.008202a0
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, ebx
push dword [esp]
call fcn.008202a0
add esp, 4
mov edi, dword [esp + 0x18]
mov edx, 0x73
mov ecx, edi
push 0xffffffffffffffff
push 0xc1f2ce
push 0
push esi
push 0
call fcn.007ebd50
add esp, 0x14
mov ecx, edi
mov edx, 0x39
push ebp
push 0
push esi
call fcn.007c5800
add esp, 0xc
mov edx, dword [esp + 0xc]
mov ebx, eax
mov ecx, edi
push ebp
push ebp
push dword [esp + 0xc]
call fcn.007c5800
add esp, 0xc
mov ecx, edi
mov edx, ebx
call fcn.007ebd40
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 8]
test byte [eax + 0xc], 2
je 0x81ff7e
mov ecx, edi
mov edx, 0x33
push ebp
call fcn.007edd80
add esp, 4
cmp ebx, 0x36
mov dword [esp + 4], eax
je 0x81ff04
cmp ebx, 0x37
je 0x81ff0d
cmp ebx, 0x39
jne 0x81ff21
mov ecx, edi
mov edx, 0xb
push esi
push 0
jmp 0x81ff19
mov ecx, edi
mov edx, 0x33
jmp 0x81ff14
mov ecx, edi
mov edx, 0x32
push esi
push dword [esp + 4]
call fcn.007c57e0
add esp, 8
mov ecx, edi
call fcn.007f2430
add eax, 3
mov ecx, edi
mov edx, 0xb
push eax
push 0
call fcn.007c57e0
add esp, 8
mov edx, dword [esp + 4]
mov ecx, edi
call fcn.007ebd40
mov ecx, edi
mov edx, 0x32
push esi
push dword [esp + 4]
call fcn.007c57e0
add esp, 8
cmp ebx, 0x39
je 0x81ff66
cmp ebx, 0x36
jne 0x81ff7e
mov ecx, edi
call fcn.007f2430
inc eax
mov ecx, edi
mov edx, 0xffffffff
push eax
call fcn.007ebf30
add esp, 4
mov ecx, edi
mov edx, ebx
push ebp
push esi
mov ebx, dword [esp + 8]
push ebx
call fcn.007c5800
add esp, 0xc
mov ecx, edi
mov edx, pe_nt_image_headers32
call fcn.00782720
mov esi, dword [esp + 0x28]
mov edx, ebp
mov ecx, esi
call fcn.007f0bc0
mov ecx, esi
mov edx, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007f0bc0
Function at 0x8268f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edx, dword [esp + 0x14]
mov edi, ecx
movsx ebx, word [edx + 0x28]
test ebx, ebx
js 0x826a49
mov ebp, fcn.00778330
movzx ecx, byte [0xbb2c7b]
and ebp, 1
inc ebp
mov eax, ebp
xor eax, fcn.00778330
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x826a25
mov al, byte [0xbb2c7b]
mov ecx, ebp
mov ah, 1
xor ecx, fcn.00778330
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2c7b], ah
jne 0x826937
mov ecx, fcn.00778330
and ecx, 1
inc ecx
mov ebp, ecx
xor ebp, fcn.00778330
movzx ebp, al
sete ah
not ah
and ah, 3
xor ah, 7
movzx eax, ah
bt ebp, eax
jae 0x8269a3
mov eax, ecx
movzx ebp, byte [0xbb2c7b]
xor eax, fcn.00778330
sete al
not al
and al, 3
movzx eax, al
bt ebp, eax
jae 0x826981
jmp 0x826a25
xor ecx, fcn.00778330
movzx ecx, byte [0xbb2c7b]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x826a02
mov eax, fcn.00778330
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00778330
mov eax, dword [0xbb2c70]
sete cl
xor ecx, 0x2df3d03
add ecx, 0x538
xor eax, ecx
mov dword [0xbb2c70], eax
not eax
imul eax, ecx
and cl, 7
xor dword [0xbb2c74], eax
mov ah, 1
shl ah, cl
or byte [0xbb2c7b], ah
mov eax, fcn.00778330
and eax, 1
inc eax
xor eax, fcn.00778330
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb2c7b], al
mov eax, dword [edx + 4]
lea ecx, [ebx + ebx*4]
mov ebx, 0x613
push dword [eax + ecx*4]
push dword [edx]
push 0xbb2c70
push dword [edi]
call fcn.00782620
add esp, 0x10
jmp 0x826ba0
mov ebx, fcn.007a4bd0
movzx ecx, byte [0xbb2c8b]
not ebx
and ebx, 1
mov eax, ebx
add eax, fcn.007a4bd0
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x826b8a
mov al, byte [0xbb2c8b]
mov ecx, ebx
mov ah, 1
add ecx, fcn.007a4bd0
sete cl
not cl
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2c8b], ah
jne 0x826a79
mov ecx, fcn.007a4bd0
not ecx
and ecx, 1
mov ebx, ecx
add ebx, fcn.007a4bd0
movzx ebx, al
sete ah
not ah
and ah, 7
xor ah, 7
movzx eax, ah
bt ebx, eax
jae 0x826ae6
mov eax, ecx
movzx ebx, byte [0xbb2c8b]
add eax, fcn.007a4bd0
sete al
not al
and al, 7
movzx eax, al
bt ebx, eax
jae 0x826ac4
jmp 0x826b8a
add ecx, fcn.007a4bd0
movzx ecx, byte [0xbb2c8b]
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x826b66
mov eax, fcn.007a4bd0
xor ecx, ecx
not eax
and eax, 1
add eax, fcn.007a4bd0
mov eax, dword [0xbb2c7c]
sete cl
xor ecx, 0x6981440f
add ecx, 0x500
mov ebx, ecx
xor eax, ecx
shr ebx, 0x1f
mov dword [0xbb2c7c], eax
not eax
or ebx, ecx
and cl, 7
imul ebx, eax
mov eax, dword [0xbb2c80]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbb2c80], eax
or ebp, ebx
not eax
imul eax, ebp
xor dword [0xbb2c84], eax
mov ah, 1
shl ah, cl
or byte [0xbb2c8b], ah
mov eax, fcn.007a4bd0
not eax
and eax, 1
add eax, fcn.007a4bd0
mov al, 0xfe
sete cl
not cl
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb2c8b], al
mov ebx, 0xa13
push dword [edx]
push 0xbb2c7c
push dword [edi]
call fcn.00782620
add esp, 0xc
mov ecx, edi
mov edx, ebx
push 2
push 0xfffffffffffffff9
push eax
push esi
call fcn.007f0b50
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x828040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
movzx ebx, byte [edx + 7]
mov edi, edx
mov esi, ecx
mov al, 1
test ebx, ebx
je 0x828057
mov eax, ebx
movzx edx, al
mov ecx, esi
call fcn.007c5ac0
test ebx, ebx
jne 0x82807c
mov ecx, esi
xor edx, edx
push 0
push dword [edi]
push 0
call fcn.007c5b20
add esp, 0x34
jmp 0x8281c9
movzx edi, byte [edi + 6]
mov eax, fcn.0098216c
xor ebp, ebp
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
imul eax, eax
and eax, 3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
xor edi, edi
mov dword [esp + 0x10], ebp
xor eax, eax
cmp dword [esp + 0x1c], 2
mov esi, dword [edi*4 + 0xb4edc0]
mov ebp, dword [edi*4 + str._b_f_f_f_b]
mov dword [esp + 0x24], edi
sete al
mov ecx, eax
not ecx
and ecx, 0x129
lea edx, [eax + ecx*2 + 0xe3d8c16]
mov eax, 1
xor edx, dword [edi*4 + 0xb4ef60]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [esi + ebp - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x828187
mov dword [esp + 4], eax
mov al, byte [esi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x82810c
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x82812e
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x828123
jmp 0x828187
mov dword [esp + 0x18], ebx
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x82817d
lea ecx, [ebp - 4]
shr ecx, 2
je 0x828175
xor eax, eax
mov ebx, esi
mov dword [esp + 0x20], ecx
mov edi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor edi, edx
shr edx, cl
mov ecx, dword [esp + 0x20]
or edx, dword [esp]
mov dword [ebx], edi
not edi
add ebx, 4
imul edx, edi
cmp eax, ecx
jne 0x82814b
mov eax, dword [esp + 4]
or byte [esi + ebp - 1], al
mov eax, dword [esp + 0x18]
not al
and byte [esi + ebp - 1], al
mov edi, dword [esp + 0x24]
inc edi
cmp edi, 0x33
jne 0x8280a3
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, esi
mov edx, ebp
push 0
mov edi, dword [esp + 0x18]
push dword [edi*4 + 0xb44b78]
push 0
call fcn.007c5b20
add esp, 0xc
mov ebx, dword [esp + 8]
inc ebp
inc edi
cmp ebp, ebx
jne 0x828099
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x828280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
test ecx, ecx
je 0x828535
mov edx, 0x831760
mov eax, 0x831760
mov esi, ecx
movzx ecx, byte [0xbb33b7]
and edx, 1
xor edx, eax
cmp edx, 0xffffffff
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x8283cb
mov al, byte [0xbb33b7]
cmp edx, 0xffffffff
mov ah, 1
sete cl
not cl
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb33b7], ah
jne 0x8282be
mov ecx, 0x831760
mov edx, 0x831760
movzx eax, al
and ecx, 1
xor ecx, edx
cmp ecx, 0xffffffff
sete dl
not dl
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x828322
cmp ecx, 0xffffffff
movzx edx, byte [0xbb33b7]
sete al
not al
and al, 7
movzx eax, al
bt edx, eax
jae 0x828304
jmp 0x8283cb
cmp ecx, 0xffffffff
movzx ecx, byte [0xbb33b7]
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x8283a4
mov edx, 0x831760
mov eax, 0x831760
xor ecx, ecx
and edx, 1
xor edx, eax
mov eax, dword [0xbb33a8]
cmp edx, 0xffffffff
sete cl
xor ecx, 0xa5dba4ef
add ecx, 0x400
xor eax, ecx
mov edx, ecx
mov dword [0xbb33a8], eax
shr edx, 0x1f
not eax
mov ebx, dword [0xbb33ac]
or edx, ecx
and cl, 7
imul edx, eax
lea edi, [edx + edx]
xor ebx, edx
shr edx, 0x1e
mov dword [0xbb33ac], ebx
or edi, edx
not ebx
mov dl, 1
imul ebx, edi
shl dl, cl
xor dword [0xbb33b0], ebx
or byte [0xbb33b7], dl
mov ecx, 0x831760
mov eax, 0x831760
and ecx, 1
xor ecx, eax
mov al, 0xfe
cmp ecx, 0xffffffff
sete cl
not cl
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb33b7], al
mov ecx, esi
mov edx, 0xbb33a8
call fcn.00777e20
test eax, eax
jne 0x8283e5
mov eax, 1
jmp 0x82853a
mov edx, fcn.0077eff0
xor eax, eax
movzx edi, byte [0xbb33c3]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.0077eff0
sete al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edi, eax
jb 0x828521
mov al, byte [0xbb33c3]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, fcn.0077eff0
sete cl
mov ebx, ecx
xor ebx, 5
lea ecx, [ebx + ecx*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb33c3], ah
jne 0x828418
mov ecx, fcn.0077eff0
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov edi, ecx
xor edi, fcn.0077eff0
sete dl
mov ebx, edx
xor ebx, 5
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x828492
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb33c3]
xor edx, fcn.0077eff0
sete al
mov edx, eax
xor edx, 5
lea eax, [edx + eax*2]
bt edi, eax
jae 0x82846c
jmp 0x828521
xor eax, eax
xor ecx, fcn.0077eff0
movzx edx, byte [0xbb33c3]
sete al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x8284f9
mov eax, fcn.0077eff0
xor ecx, ecx
mov edi, dword [0xbb33b8]
and eax, 1
inc eax
xor eax, fcn.0077eff0
sete cl
mov eax, ecx
xor eax, 0x880c39a5
lea ecx, [eax + ecx*2]
mov edx, ecx
xor edi, ecx
and cl, 7
mov dword [0xbb33b8], edi
not edi
or edx, 1
imul edx, edi
xor dword [0xbb33bc], edx
mov dl, 1
shl dl, cl
or byte [0xbb33c3], dl
mov eax, fcn.0077eff0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0077eff0
sete cl
mov eax, ecx
xor eax, 5
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb33c3], al
mov ecx, esi
mov edx, 0xbb33b8
call fcn.00777e20
test eax, eax
jne 0x828535
xor eax, eax
jmp 0x82853a
mov eax, 0xffffffff
pop esi
pop edi
pop ebx
ret
Function at 0x828a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [ecx]
xor edi, edi
mov eax, dword [ebx + 0x10]
mov ebp, dword [eax + 0x14]
test ebp, ebp
je 0x828c2f
cmp byte [ebx + 0x4f], 0
mov esi, ecx
je 0x828a9d
mov ecx, ebp
call fcn.0077c3b0
test eax, eax
je 0x828c17
mov edx, fcn.007b5760
xor eax, eax
movzx edi, byte [0xbb3453]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.007b5760
sete al
mov ecx, eax
xor ecx, 1
lea eax, [ecx + eax*2]
or al, 4
movzx eax, al
bt edi, eax
jb 0x828c02
mov al, byte [0xbb3453]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, fcn.007b5760
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ebx + ecx*2]
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb3453], ah
jne 0x828ad5
mov ecx, fcn.007b5760
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov edi, ecx
xor edi, fcn.007b5760
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [ebx + edx*2]
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x828b5a
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb3453]
xor edx, fcn.007b5760
sete al
mov edx, eax
xor edx, 1
lea eax, [edx + eax*2]
or al, 4
movzx eax, al
bt edi, eax
jae 0x828b2f
jmp 0x828c02
xor eax, eax
xor ecx, fcn.007b5760
movzx edi, byte [0xbb3453]
sete al
mov ecx, eax
xor ecx, 0x34a042b1
lea edx, [ecx + eax*2 + 0xa84]
mov eax, edx
and al, 7
movzx eax, al
bt edi, eax
jb 0x828bd7
mov edi, 0xbb3410
xor eax, eax
mov ebx, dword [edi]
mov ecx, eax
mov ebp, edx
inc eax
shl ebp, cl
xor cl, 0x1f
xor ebx, edx
shr edx, cl
mov dword [edi], ebx
or edx, ebp
not ebx
add edi, 4
imul edx, ebx
cmp eax, 0x10
jne 0x828b8e
mov eax, fcn.007b5760
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007b5760
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [eax + ecx*2]
mov al, 1
or cl, 4
shl al, cl
or byte [0xbb3453], al
mov eax, fcn.007b5760
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007b5760
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [eax + ecx*2]
mov al, 0xfe
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb3453], al
push 0xbb3410
push esi
call fcn.00782570
add esp, 8
mov edi, 1
jmp 0x828c2f
mov ecx, ebp
call fcn.007a3330
mov eax, dword [ebx + 0x10]
mov ecx, ebx
mov dword [eax + 0x14], 0
call fcn.0077c990
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret