joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78d340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0xbcbae0]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x18]
xor eax, esp
mov dword [esp + 0x1c], eax
call fcn.0078d320
xor esi, esi
test edi, edi
js 0x78d483
cmp dword [esp + 0x18], edi
jle 0x78d483
mov eax, fcn.0078ccd0
not eax
and eax, 1
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edi, dword [esi*4 + 0xb4aa90]
mov ebp, dword [esi*4 + 0xb4aab0]
mov dword [esp + 0x14], esi
add ecx, fcn.0078ccd0
sete al
mov ecx, eax
not ecx
and ecx, 0x809
lea edx, [eax + ecx*2 + 0x666c63f6]
mov eax, 1
xor edx, dword [esi*4 + str.p_aYW]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x78d46a
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x78d3ef
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x78d411
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x78d406
jmp 0x78d46a
mov dword [esp + 8], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x78d460
lea ecx, [ebp - 4]
shr ecx, 2
je 0x78d458
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x78d42e
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x14]
inc esi
cmp esi, 5
jne 0x78d381
mov eax, dword [esp + 0x34]
mov esi, dword [eax*4 + 0xb48700]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x78dec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, fcn.0079b9c0
mov esi, fcn.0079b9c0
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 4], ecx
xor esi, 2
or eax, 2
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
xor eax, eax
mov esi, dword [edx*4 + 0xb4d370]
mov ebp, dword [edx*4 + 0xb4d4b0]
mov dword [esp + 0x1c], edx
add ecx, dword [esp + 0x10]
sete al
mov ecx, eax
xor ecx, 0xd75a0b71
lea ebx, [ecx + eax*2 + 0x900]
mov eax, 1
xor ebx, dword [edx*4 + 0xb4aaf0]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [esi + ebp - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x78dfd0
mov dword [esp + 8], eax
mov al, byte [esi + ebp - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x78df53
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x78df75
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x78df6a
jmp 0x78dfd0
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x78dfca
lea ecx, [ebp - 4]
shr ecx, 2
je 0x78dfc2
xor eax, eax
mov edi, esi
mov dword [esp + 0x18], ecx
mov ecx, edi
mov dword [esp + 0x20], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x20]
add edi, 4
cmp eax, ecx
jne 0x78df8e
mov eax, dword [esp + 8]
or byte [esi + ebp - 1], al
not dl
and byte [esi + ebp - 1], dl
mov edx, dword [esp + 0x1c]
inc edx
cmp edx, 0x50
jne 0x78dee9
xor ebx, ebx
cmp dword [esp + 0xc], 0
sete bl
push 0
push 0
push 0xffffffffffffffff
push dword [esp + 0x10]
push 0
push ebx
call dword [0xbabd78]
mov ebp, eax
add ebp, eax
je 0x78e035
shl eax, 2
xor edx, edx
xor esi, esi
mov ecx, eax
call fcn.0077b7b0
test eax, eax
je 0x78e037
mov edi, eax
push ebp
push eax
push 0xffffffffffffffff
push dword [esp + 0x10]
push 0
push ebx
call dword [0xbabd78]
test eax, eax
mov esi, edi
jne 0x78e037
push edi
call fcn.00775660
add esp, 4
xor esi, esi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x78e050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.00800e20
mov dword [esp + 4], ecx
xor ecx, ecx
mov dword [esp + 0xc], edx
and eax, 1
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ebp, dword [ecx*4 + 0xb4d370]
mov esi, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x18], ecx
xor eax, fcn.00800e20
mov eax, 1
sete bl
xor ebx, 0xf3e369fd
add ebx, 4
xor ebx, dword [ecx*4 + 0xb4ac30]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x78e150
mov dword [esp + 8], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x78e0d3
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x78e0f5
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x78e0ea
jmp 0x78e150
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x78e14a
lea ecx, [esi - 4]
shr ecx, 2
je 0x78e142
xor eax, eax
mov edi, ebp
mov dword [esp + 0x14], ecx
mov ecx, edi
mov dword [esp + 0x1c], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x1c]
add edi, 4
cmp eax, ecx
jne 0x78e10e
mov eax, dword [esp + 8]
or byte [ebp + esi - 1], al
not dl
and byte [ebp + esi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x78e06e
xor ebx, ebx
cmp dword [esp + 0xc], 0
sete bl
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esp + 0x18]
push 0
push ebx
call dword [0xbabdf0]
xor edi, edi
test eax, eax
je 0x78e1bf
mov edx, eax
mov ecx, eax
mov ebp, eax
sar edx, 0x1f
call fcn.0077b7b0
test eax, eax
je 0x78e1bf
mov esi, eax
push 0
push 0
push ebp
push eax
push 0xffffffffffffffff
push dword [esp + 0x18]
push 0
push ebx
call dword [0xbabdf0]
test eax, eax
je 0x78e1b6
mov edi, esi
jmp 0x78e1bf
push esi
call fcn.00775660
add esp, 4
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7911b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1fc
mov eax, dword [0xbcbae0]
mov ebx, dword [esp + 0x214]
mov esi, ecx
mov edi, edx
mov ecx, edx
mov edx, 0x1f4
xor eax, esp
mov dword [esp + 0x1f8], eax
lea eax, [esp + 4]
mov byte [esp + 4], 0
push eax
call fcn.00791430
add esp, 4
test ebx, ebx
mov edx, 0xc1f221
mov eax, 0x2401
cmovne edx, ebx
xor ebp, ebp
movzx ecx, byte [esp + ebp + 4]
cmp ecx, 0xd
ja 0x79120c
bt eax, ecx
jb 0x79120f
inc ebp
jmp 0x7911fd
mov ebx, 0x77fba0
movzx ecx, byte [0xbace43]
and ebx, 1
inc ebx
mov eax, ebx
xor eax, 0x77fba0
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7913e3
mov al, byte [0xbace43]
mov ecx, ebx
mov ah, 1
xor ecx, 0x77fba0
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbace43], ah
jne 0x79123e
mov ecx, 0x77fba0
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, 0x77fba0
movzx ebx, al
sete ah
not ah
and ah, 3
xor ah, 7
movzx eax, ah
bt ebx, eax
jae 0x7912aa
mov eax, ecx
movzx ebx, byte [0xbace43]
xor eax, 0x77fba0
sete al
not al
and al, 3
movzx eax, al
bt ebx, eax
jae 0x791288
jmp 0x7913e3
xor ecx, 0x77fba0
movzx ecx, byte [0xbace43]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7913c0
mov eax, 0x77fba0
xor ecx, ecx
and eax, 1
inc eax
xor eax, 0x77fba0
mov eax, dword [0xbace20]
sete cl
xor ecx, 0x8fe4e00b
or ecx, 0xce0
xor eax, ecx
mov dword [esp], ecx
mov dword [0xbace20], eax
not eax
mov ebx, dword [0xbace24]
imul ecx, eax, 0x8fe4eceb
lea eax, [ecx + ecx]
xor ebx, ecx
shr ecx, 0x1e
mov dword [0xbace24], ebx
or eax, ecx
not ebx
imul ebx, eax
mov eax, dword [0xbace28]
lea ecx, [ebx*4]
xor eax, ebx
shr ebx, 0x1d
mov dword [0xbace28], eax
or ecx, ebx
not eax
imul eax, ecx
mov ecx, dword [0xbace2c]
lea ebx, [eax*8]
xor ecx, eax
shr eax, 0x1c
mov dword [0xbace2c], ecx
or ebx, eax
not ecx
mov eax, dword [0xbace30]
imul ecx, ebx
mov ebx, ecx
shl ebx, 4
xor eax, ecx
shr ecx, 0x1b
mov dword [0xbace30], eax
or ecx, ebx
not eax
imul eax, ecx
mov ecx, dword [0xbace34]
mov ebx, eax
shl ebx, 5
xor ecx, eax
shr eax, 0x1a
mov dword [0xbace34], ecx
or eax, ebx
not ecx
imul ecx, eax
mov eax, dword [0xbace38]
mov ebx, ecx
shl ebx, 6
xor eax, ecx
shr ecx, 0x19
mov dword [0xbace38], eax
or ecx, ebx
not eax
imul eax, ecx
mov ecx, dword [esp]
xor dword [0xbace3c], eax
mov al, 1
and cl, 3
shl al, cl
or byte [0xbace43], al
mov eax, 0x77fba0
and eax, 1
inc eax
xor eax, 0x77fba0
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbace43], al
lea eax, [esp + 4]
mov byte [esp + ebp + 4], 0
push eax
push edx
push dword [esp + 0x218]
push edi
push dword [esp + 0x228]
push 0xbace20
push esi
call fcn.00777b70
add esp, 0x1c
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x1fc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x791950
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.0077c9f0
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 4], edx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp dword [esp + 0x10], 1
mov ebp, dword [ecx*4 + 0xb4d370]
mov esi, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x18], ecx
mov eax, 1
seta bl
or ebx, 0x65437e96
add ebx, 0x280
xor ebx, dword [ecx*4 + 0xb4bc90]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x791a51
mov dword [esp + 8], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x7919d4
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x7919f6
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x7919eb
jmp 0x791a51
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x791a4b
lea ecx, [esi - 4]
shr ecx, 2
je 0x791a43
xor eax, eax
mov edi, ebp
mov dword [esp + 0x14], ecx
mov ecx, edi
mov dword [esp + 0x1c], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x1c]
add edi, 4
cmp eax, ecx
jne 0x791a0f
mov eax, dword [esp + 8]
or byte [ebp + esi - 1], al
not dl
and byte [ebp + esi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x791970
call dword [0xbabc58]
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
cmp ecx, dword [0xbace84]
jge 0x791a8c
cmp eax, 0x36
jg 0x791a9a
mov edx, eax
add edx, 0xfffffffb
cmp edx, 0x1c
ja 0x791a8c
mov esi, 0x18000001
bt esi, edx
jb 0x791ab7
mov edx, dword [esp + 4]
xor ecx, ecx
test edx, edx
je 0x791acf
mov dword [edx], eax
jmp 0x791acf
cmp eax, 0x78
jg 0x791aab
cmp eax, 0x37
je 0x791ab7
cmp eax, 0x40
jne 0x791a8c
jmp 0x791ab7
cmp eax, 0x4cf
je 0x791ab7
cmp eax, 0x79
jne 0x791a8c
inc ecx
imul ecx, dword [0xbace88]
push ecx
call fcn.00778070
add esp, 4
inc dword [edi]
mov ecx, 1
mov eax, ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7925c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov edx, fcn.0079aa70
xor ecx, ecx
mov eax, dword [0xbcbae0]
imul edx, edx
and edx, 3
xor eax, esp
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], edx
xor ebx, ebx
cmp dword [esp + 0x10], 3
mov ebp, dword [ecx*4 + 0xb4d370]
mov edi, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x18], ecx
mov eax, 1
sete bl
xor ebx, 0x24619b83
or ebx, 0x60
xor ebx, dword [ecx*4 + 0xb4c050]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7926c9
mov dword [esp + 8], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x79264c
mov ecx, dword [esp + 8]
movzx eax, al
test edx, eax
je 0x79266e
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x792663
jmp 0x7926c9
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x7926c3
lea ecx, [edi - 4]
shr ecx, 2
je 0x7926bb
xor eax, eax
mov esi, ebp
mov dword [esp + 0x14], ecx
mov ecx, esi
mov dword [esp + 0x1c], esi
mov esi, dword [esi]
mov dword [esp], ebx
xor esi, ebx
mov dword [ecx], esi
mov ecx, eax
not esi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, esi
mov esi, dword [esp + 0x1c]
add esi, 4
cmp eax, ecx
jne 0x792687
mov eax, dword [esp + 8]
or byte [ebp + edi - 1], al
not dl
and byte [ebp + edi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x7925eb
mov eax, dword [0xc1f184]
cmp eax, 2
je 0x7926ea
call fcn.007781a0
test eax, eax
je 0x792731
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x58]
push 0
push dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [0xbabd60]
jmp 0x792749
push 0
push dword [esp + 0x54]
push 0
push dword [esp + 0x58]
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [0xbabd54]
mov ecx, dword [esp + 0x34]
mov esi, eax
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x792c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov ecx, fcn.007b8470
mov edx, fcn.007b8470
xor edi, edi
mov eax, dword [0xbcbae0]
and ecx, 1
xor ecx, edx
xor eax, esp
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], ecx
xor eax, eax
cmp dword [esp + 0x14], 0xffffffff
mov ebp, dword [edi*4 + 0xb4d370]
mov esi, dword [edi*4 + 0xb4d4b0]
mov dword [esp + 0x1c], edi
sete al
mov ecx, eax
not ecx
and ecx, 0x861
lea edx, [eax + ecx*2 - 0x75ed48f2]
mov eax, 1
xor edx, dword [edi*4 + 0xb4c410]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x792d43
mov dword [esp + 0xc], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x792cc8
mov ecx, dword [esp + 0xc]
movzx eax, al
test ebx, eax
je 0x792cea
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x792cdf
jmp 0x792d43
mov dword [esp + 0x10], ebx
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x792d39
lea ecx, [esi - 4]
shr ecx, 2
je 0x792d31
xor eax, eax
mov ebx, ebp
mov dword [esp + 0x18], ecx
mov edi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor edi, edx
shr edx, cl
mov ecx, dword [esp + 0x18]
or edx, dword [esp]
mov dword [ebx], edi
not edi
add ebx, 4
imul edx, edi
cmp eax, ecx
jne 0x792d07
mov eax, dword [esp + 0xc]
or byte [ebp + esi - 1], al
mov eax, dword [esp + 0x10]
not al
and byte [ebp + esi - 1], al
mov edi, dword [esp + 0x1c]
inc edi
cmp edi, 0x50
jne 0x792c5f
mov eax, dword [0xc1f184]
cmp eax, 2
je 0x792d64
call fcn.007781a0
test eax, eax
je 0x792da7
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x54]
push 0
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [0xbabdd8]
jmp 0x792dbf
push 0
push dword [esp + 0x50]
push 0
push dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [0xbabdcc]
mov ecx, dword [esp + 0x34]
mov esi, eax
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7947b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov edx, 3
push 1
push pe_nt_image_headers32
call fcn.007949a0
add esp, 8
test eax, eax
jne 0x794967
cmp byte [esi + 0x50], 0
je 0x7947ff
mov byte [esi + 0x51], 1
mov ecx, esi
mov edx, 1
push 1
push pe_nt_image_headers32
call fcn.007949a0
add esp, 8
mov esi, 0x508
jmp 0x79495d
lea eax, [esi + 8]
push 0
push 0
push eax
call fcn.0078ee10
add esp, 0xc
mov edi, eax
mov ecx, esi
mov edx, 1
push 1
push pe_nt_image_headers32
call fcn.007949a0
add esp, 8
test edi, edi
je 0x794967
mov eax, fcn.0082fdf0
xor ecx, ecx
mov dword [esp + 8], esi
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor edx, edx
cmp dword [esp + 0x10], 1
mov edi, dword [ecx*4 + 0xb4ca80]
mov ebp, dword [ecx*4 + 0xb4cbd0]
mov dword [esp + 0x18], ecx
mov eax, 1
seta dl
xor edx, 0xcdf7b2e3
add edx, 0xa28
xor edx, dword [ecx*4 + str.__8]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x794923
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7948a8
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x7948ca
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7948bf
jmp 0x794923
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x794919
lea ecx, [ebp - 4]
shr ecx, 2
je 0x794911
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7948e7
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x51
jne 0x794844
mov eax, dword [esp + 8]
mov edi, dword [eax + 4]
call dword [0xbabc58]
mov esi, 0x120a
mov ecx, 0x120a
mov edx, eax
push 0x317a
push edi
push 0xbad180
call fcn.007911b0
add esp, 0xc
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, 2
push 1
push pe_nt_image_headers32
call fcn.007949a0
add esp, 0x24
jmp 0x794962
Function at 0x7949a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ebx, ecx
cmp edx, 3
je 0x7949d2
mov edi, edx
mov edx, 1
cmp edi, 1
jne 0x7949d7
lea ecx, [ebx + 0x10]
mov edx, eax
push esi
call fcn.00792c30
add esp, 4
jmp 0x7949e4
mov edx, 3
lea ecx, [ebx + 0x10]
push esi
push eax
call fcn.007925c0
add esp, 8
xor ecx, ecx
test eax, eax
jne 0x794b00
mov eax, fcn.0081b010
mov dword [esp + 8], ebx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor edx, edx
cmp dword [esp + 0x10], 2
mov edi, dword [ecx*4 + 0xb4d370]
mov ebp, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x18], ecx
mov eax, 1
sete dl
xor edx, 0xe5735e97
add edx, 0x210
xor edx, dword [ecx*4 + 0xb4ce70]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x794ae0
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x794a65
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x794a87
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x794a7c
jmp 0x794ae0
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x794ad6
lea ecx, [ebp - 4]
shr ecx, 2
je 0x794ace
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x794aa4
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x794a01
call dword [0xbabc58]
mov ecx, dword [esp + 8]
mov dword [ecx + 0x58], eax
mov ecx, 5
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x794b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [0xc1f224]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
test ebx, ebx
je 0x794cef
mov eax, fcn.00821470
mov edi, 0xc1f224
and eax, 1
inc eax
mov dword [esp + 0x1c], eax
cmp dword [ebx + 0x5c], 0
jne 0x794ce0
mov eax, dword [ebx]
mov dword [esp + 0x10], edi
test eax, eax
je 0x794b5c
push eax
call fcn.00775300
add esp, 4
cmp dword [ebx + 0x4c], 0
jle 0x794c8a
xor edi, edi
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov edi, dword [ecx*4 + 0xb4d370]
mov ebp, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x24], ecx
mov edx, 1
xor eax, fcn.00821470
mov eax, 1
sete bl
or ebx, 0x5ffd7460
add ebx, 0x400
xor ebx, dword [ecx*4 + 0xb4cfb0]
mov ecx, ebx
and cl, 7
shl eax, cl
movzx esi, cl
xor cl, 7
shl edx, cl
movzx ecx, byte [edi + ebp - 1]
bt ecx, esi
jb 0x794c51
mov dword [esp], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x794bd3
mov ecx, dword [esp]
movzx eax, al
test edx, eax
je 0x794bf4
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x794be9
jmp 0x794c51
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x794c4b
lea ecx, [ebp - 4]
shr ecx, 2
je 0x794c44
xor eax, eax
mov esi, edi
mov dword [esp + 0x20], ecx
mov ecx, esi
mov dword [esp + 0x28], esi
mov esi, dword [esi]
mov dword [esp + 4], ebx
xor esi, ebx
mov dword [ecx], esi
mov ecx, eax
not esi
inc eax
shl dword [esp + 4], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x20]
or ebx, dword [esp + 4]
imul ebx, esi
mov esi, dword [esp + 0x28]
add esi, 4
cmp eax, ecx
jne 0x794c0d
mov eax, dword [esp]
or byte [edi + ebp - 1], al
not dl
and byte [edi + ebp - 1], dl
mov ecx, dword [esp + 0x24]
inc ecx
cmp ecx, 0x50
jne 0x794b72
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [ebx + 0x54]
push dword [eax + edi*8 + 4]
call dword [0xbabde4]
mov eax, dword [ebx + 0x54]
push dword [eax + edi*8]
call dword [0xbabb44]
inc edi
cmp edi, dword [ebx + 0x4c]
jl 0x794b6c
mov eax, dword [ebx + 0x10]
inc eax
cmp eax, 2
jb 0x794c9f
lea eax, [ebx + 8]
push eax
call fcn.0078e1d0
add esp, 4
cmp dword [esp + 0xc], 0
mov edi, dword [esp + 0x10]
je 0x794cc5
call fcn.00791930
push 0
push dword [ebx + 4]
push dword [esp + 0x10]
call fcn.007791a0
add esp, 0xc
call fcn.00791940
mov eax, dword [ebx + 0x64]
mov dword [edi], eax
push dword [ebx + 0x54]
call fcn.00775660
add esp, 4
push ebx
call fcn.00775660
add esp, 4
jmp 0x794ce5
add ebx, 0x64
mov edi, ebx
mov ebx, dword [edi]
test ebx, ebx
jne 0x794b3f
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret