joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f8330
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x6f8352
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x6f8340
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x6f8370
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x4254b0]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0x4b445a48
mov dword [ebp - 0x1d], 0x4042455f
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x6f83a0
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x767d6c79
mov dword [ebp - 0x13], 0x72793277
mov word [ebp - 0xf], 0x73
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x6f83d0
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
call dword [0x40c064]
lea ecx, [ebp - 0x31]
push ecx
push eax
call dword [0x40c0d8]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call dword [0x40c0f8]
mov dword [ebp - 4], eax
test eax, eax
je 0x6f848b
mov esi, dword [0x43448c]
push esi
push edi
push eax
call dword [0x40c0cc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call ebx
mov ebx, eax
mov eax, dword [0x40c1ec]
cmp ebx, 0xc0000004
jne 0x6f846c
mov ebx, dword [ebp - 4]
push edi
push 0
push ebx
call eax
add esi, esi
cmp esi, 0x10000000
ja 0x6f8481
push esi
push 0
push ebx
call dword [0x40c0cc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [0x40c1ec]
cmp ebx, 0xc0000004
je 0x6f8435
test ebx, ebx
jns 0x6f8491
push edi
push 0
push dword [ebp - 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [0x43448c]
cmp esi, 0x200000
cmovbe eax, esi
mov dword [0x43448c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6f84c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x6f84e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x6f84d0
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x6f84f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x6f8512
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x6f8500
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret

Function at 0x6f8630
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x6f8652
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x6f8640
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret
Function at 0x6f8660
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x6f8682
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x6f8670
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret
Function at 0x6f8a90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x6f8ab2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x6f8aa0
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret
Function at 0x6f97a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x6f97c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x6f97b0
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret

Function at 0x6f97d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x6f97f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x6f97e0
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x6f9800
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402be6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1007a65
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x6f9864
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.007d08e0
mov edi, eax
add esp, 8
test edi, edi
je 0x6f98fd
push 2
push 0
push edi
call fcn.007d46b6
push edi
call fcn.007d046b
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.007d46b6
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x6f98d1
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x6f98c8
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x6f98e0
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00756210
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x6f98ea
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.007d915f
push edi
call fcn.007d4168
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x6f992e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x6f9924
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6f993f
push ecx
push edx
call fcn.007caa91
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.007cfd30
int3
Function at 0x6f9950
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402c26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.00757930
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1007a65
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x6f9994
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.007d08e0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x6f9a2a
push edi
push 2
push 0
push ebx
call fcn.007d46b6
push ebx
call fcn.007d046b
push 0
push 0
push ebx
mov edi, eax
call fcn.007d46b6
mov ecx, dword [esi]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0x6f9a00
cmp dword [ecx + 0x14], 0x10
jb 0x6f99f8
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0x6f9a0c
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.00756210
mov eax, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x6f9a16
mov eax, dword [eax]
push ebx
push edi
push 1
push eax
call fcn.007d915f
push ebx
call fcn.007d4168
add esp, 0x14
pop edi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x6f9a5b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x6f9a51
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6f9a6c
push ecx
push edx
call fcn.007caa91
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.007cfd30
int3
Function at 0x6f9a80
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402c26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.00757930
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1007a65
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x6f9ac4
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.007d08e0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x6f9b64
push esi
push 2
push 0
push ebx
call fcn.007d46b6
push ebx
call fcn.007d046b
push 0
push 0
push ebx
mov esi, eax
call fcn.007d46b6
mov ecx, dword [edi]
mov eax, 0x1e8481
mov edx, dword [ecx + 0x10]
add esp, 0x1c
cmp esi, eax
cmova esi, eax
lea eax, [ecx + 0x10]
cmp esi, edx
ja 0x6f9b3a
cmp dword [ecx + 0x14], 0x10
jb 0x6f9b32
mov ecx, dword [ecx]
mov dword [eax], esi
mov byte [ecx + esi], 0
jmp 0x6f9b46
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00756210
mov eax, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x6f9b50
mov eax, dword [eax]
push ebx
push esi
push 1
push eax
call fcn.007d915f
push ebx
call fcn.007d4168
add esp, 0x14
pop esi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x6f9b95
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x6f9b8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6f9ba6
push ecx
push edx
call fcn.007caa91
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.007cfd30
int3

Function at 0x6f9bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x1007a65
xor ecx, ecx
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x6f9bc0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push esi
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.007d08e0
mov esi, eax
add esp, 8
test esi, esi
je 0x6f9c0b
push 2
push 0
push esi
call fcn.007d46b6
push esi
call fcn.007d046b
push esi
mov edi, eax
call fcn.007d4168
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0x6f9c3c
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x6f9c32
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6f9c43
push ecx
push edx
call fcn.007caa91
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.007cfd30
int3
Function at 0x6f9c90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0x5d756c45
xor ecx, ecx
mov dword [ebp - 0x16], 0x7b4b687e
mov dword [ebp - 0x12], 0x4d48536d
mov word [ebp - 0xe], 0x4d
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x6f9cc0
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x767d6c59
mov dword [ebp - 7], 0x72793277
mov word [ebp - 3], 0x73
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x6f9cf0
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call dword [0x40c064]
lea ecx, [ebp - 0x1a]
push ecx
push eax
call dword [0x40c0d8]
test eax, eax
je 0x6f9d25
lea ecx, [ebp - 0xb8]
push ecx
call eax
jmp 0x6f9d32
lea eax, [ebp - 0xb8]
push eax
call dword [0x40c0ac]
mov eax, dword [ebp - 0xb4]
cmp eax, 0xb
je 0x6f9d42
cmp eax, 0xa
jne 0x6f9d51
cmp dword [ebp - 0xb0], 0
je 0x6f9d6b
xor al, al
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x6f9d4b
mov eax, dword [ebp - 0xb0]
cmp eax, 3
je 0x6f9d6b
cmp eax, 2
sete al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x6f9e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x1007a65
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x6f9e30
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.007d08e0
add esp, 8
test eax, eax
je 0x6f9e6b
push eax
call fcn.007d4168
add esp, 4
mov bl, 1
jmp 0x6f9e6d
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x6f9e9d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x6f9e93
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6f9ea4
push ecx
push edx
call fcn.007caa91
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.007cfd30
int3
Function at 0x6fa740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0x64
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [0x40c350]
test eax, eax
jne 0x6fa947
mov esi, dword [0x40c2f4]
push 1
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
call dword [0x40c304]
mov dword [esp + 0x14], eax
test eax, eax
je 0x6fa93d
push eax
call dword [0x40c03c]
mov dword [esp + 0x10], eax
test eax, eax
je 0x6fa931
push edi
push esi
push dword [esp + 0x1c]
call dword [0x40c034]
mov dword [esp + 0x20], eax
test eax, eax
je 0x6fa927
push eax
push dword [esp + 0x14]
call dword [0x40c038]
push 0xcc0020
push 0
push 0
push dword [esp + 0x20]
push edi
push esi
push 0
push 0
push dword [esp + 0x30]
call dword [0x40c044]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x28]
call dword [0x40c364]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
call dword [0x40c360]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x6fa8d1
push eax
call fcn.007d94ac
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x6fa8d1
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [0x40c368]
xor esi, esi
cmp dword [esp + 8], esi
jbe 0x6fa8c8
add edi, 0x30
nop dword [eax]
mov eax, dword [edi]
mov ecx, 0x420d78
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6fa8ad
test dx, dx
je 0x6fa8a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6fa8ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x6fa887
xor eax, eax
jmp 0x6fa8b2
sbb eax, eax
or eax, 1
test eax, eax
je 0x6fa94f
inc esi
add edi, 0x4c
cmp esi, dword [esp + 8]
jb 0x6fa880
mov edi, dword [esp + 0x18]
push edi
call fcn.007d8d56
add esp, 4
movups xmm0, xmmword [0x40dab8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x54], 1
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x60], xmm0
push esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 1
call dword [0x40c35c]
push dword [esp + 0x20]
call dword [0x40c040]
push esi
call dword [0x40c358]
push dword [esp + 0x10]
call dword [0x40c040]
push dword [esp + 0x14]
push 0
call dword [0x40c314]
push dword [esp + 0x2c]
call dword [0x40c354]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [esp + 0x44], xmm0
jmp 0x6fa8c9
Function at 0x6fb920
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x6fb942
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x6fb930
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret
Function at 0x6fcd30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x6fcd52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x6fcd40
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x6fcd60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x6fcd82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x6fcd70
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret

Function at 0x6fcd90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x6fcdb2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x6fcda0
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x6fcdc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x6fcde2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x6fcdd0
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x6fcdf0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x6fce12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x6fce00
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0x6fce20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x6fce42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x6fce30
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0x6fce50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x6fce72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x6fce60
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0x6fce80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x6fcea2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x6fce90
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0x6fceb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x6fced2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x6fcec0
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x6fcee0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x6fcf02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x6fcef0
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret
Function at 0x6fcf10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x6fcf32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x6fcf20
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x6fcf40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x6fcf62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x6fcf50
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0x6fe470
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x6fe492
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x6fe480
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0x701f80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x701fa2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x701f90
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x702bc0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [0x40c124]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x702c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x100
lea eax, [ebp - 0x118]
mov dword [ebp - 0x10], 0x100
push 0
push eax
mov dword [ebp - 0x14], 0x100
call fcn.007cca70
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [0x40c020]
push 0x100
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.007cca70
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x40c12c]
mov dword [ebp - 9], 0x7471775d
xor ecx, ecx
mov dword [ebp - 5], 0x78735f
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x702c80
lea eax, [ebp - 9]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.007cc0e0
add esp, 8
test eax, eax
jne 0x702ce6
mov dword [ebp - 8], 0x2355595f
xor ecx, ecx
mov dword [ebp - 4], 0x100544f
lea eax, [ecx + 0x17]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x702cb8
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.007cc0e0
add esp, 8
test eax, eax
jne 0x702ce6
xor al, al
mov esp, ebp
pop ebp
ret
push 0
call dword [0x40c1e8]
push eax
call dword [0x40c1dc]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x702d40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0x746b7d7c
mov dword [ebp - 0xa], 0x2c2e707e
xor eax, eax
mov dword [ebp - 6], 0x4e4d4431
mov word [ebp - 2], 0x100
lea ecx, [eax + 0x17]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x702d91
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
call dword [0x40c064]
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret