joyce8/EMBER2024-capa huggingface dataset:
Function at 0x619cd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x619ce7
call fcn.0051fee0
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x619d58
push eax
call fcn.005220df
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x619d53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x619d2d
call fcn.0051fee0
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x619d58
cmp eax, 5
jne 0x619d46
call fcn.0051fee0
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.00619a10
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x61a0e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x61a0f7
call fcn.0051fee0
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.005220df
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x61a141
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x61a134
call fcn.0051fee0
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.00619a10
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x61a350
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x61a396
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x61a38e
push 8
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x61a396
mov eax, 0xffffffe7
pop esi
pop ecx
ret
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
mov eax, 0xffffffe7
test esi, esi
pop esi
cmovne eax, ecx
pop ecx
ret
Function at 0x62a9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xa4]
push edi
mov dword [esp + 0x24], ebx
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x20], eax
push dword [eax + 0x10]
call fcn.00611170
mov ecx, edx
mov dword [esp + 0x1c], eax
add esp, 4
mov dword [esp + 0x14], ecx
test ecx, ecx
jg 0x62aa14
jl 0x62aa0c
cmp eax, 0x40
jae 0x62aa14
mov ebp, eax
mov dword [esp + 0x10], eax
jmp 0x62aa1d
mov ebp, 0x40
mov dword [esp + 0x10], ebp
mov eax, dword [ebx + 0x154]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x62aa35
cmp ecx, ebp
jb 0x62aa35
mov edi, dword [esp + 0x30]
jmp 0x62aa72
cmp eax, ebp
jge 0x62aa6c
mov esi, 0x40
sub esi, eax
cmp esi, ecx
cmova esi, ecx
add eax, 0x114
push esi
push dword [esp + 0x34]
add eax, ebx
push eax
call fcn.0052d690
add dword [ebx + 0x154], esi
add esp, 0xc
cmp dword [ebx + 0x154], ebp
jl 0x62abc8
lea edi, [ebx + 0x114]
and dword [ebx + 0x110], 0xfffffffe
mov eax, dword [edi]
cmp eax, dword [0x6cd890]
jne 0x62abc8
mov eax, dword [edi + 4]
cmp eax, dword [0x6cd894]
jne 0x62abc8
movzx ebx, byte [edi + 0xb]
movzx eax, byte [edi + 0xa]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 9]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 8]
shl ebx, 8
or ebx, eax
cmp ebx, 0x18
jb 0x62abc8
cmp byte [edi + 0xc], 4
jne 0x62abc8
mov cl, byte [edi + 0xd]
mov byte [esp + 0x2c], cl
lea eax, [ecx - 7]
cmp al, 0x17
ja 0x62abc8
xor eax, eax
movzx esi, cl
xor edx, edx
mov ecx, esi
bts eax, ecx
cmp ecx, 0x20
cmovae edx, eax
xor eax, edx
cmp ecx, 0x40
cmovae edx, eax
add eax, ebx
adc edx, 0
sub eax, 1
sbb edx, 0
call fcn.006783c0
cmp dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
lea ebp, [eax*4 + 0x14]
jl 0x62abc8
jg 0x62ab26
cmp dword [esp + 0x18], ebp
jb 0x62abc8
mov ecx, dword [esp + 0x10]
lea esi, [edi + 0x10]
add ecx, edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
test edi, edi
je 0x62abab
nop dword [eax + eax]
lea eax, [esi + 8]
cmp eax, ecx
ja 0x62abab
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
cmp edx, ebp
jne 0x62abc8
movzx eax, byte [esi + 7]
add esi, 4
shl eax, 8
movzx ecx, byte [esi + 2]
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, edx
jb 0x62abc8
xor ecx, ecx
cmp ecx, dword [esp + 0x14]
jg 0x62abc8
jl 0x62ab9e
cmp eax, dword [esp + 0x18]
ja 0x62abc8
mov ecx, dword [esp + 0x10]
sub eax, edx
add ebp, eax
sub edi, 1
jne 0x62ab40
mov eax, dword [esp + 0x20]
mov cl, byte [esp + 0x2c]
mov dword [eax + 0x78], ebx
mov byte [eax + 0x74], 4
mov byte [eax + 0x75], cl
mov eax, dword [esp + 0x24]
and dword [eax + 0x110], 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x635070
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xf0000000
push dword [esp + 0x14]
lea edi, [esi + 4]
mov dword [esi], 0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x6350b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x6350da
push 8
push dword [esp + 0x14]
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x6350da
lea eax, [esi + 8]
push eax
push 0
push 0
push dword [esp + 0x20]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x6350e2
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, 0xffffffe7
pop esi
ret
pop edi
mov dword [esi], 1
xor eax, eax
pop esi
ret
Function at 0x639c90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edx, dword [esi + 0xaa0]
mov eax, dword [esi + 0x1f0]
and edx, dword [esp + 0x20]
shl eax, 4
cmp ebx, 0xffffffff
jne 0x639dfc
mov ebx, dword [esp + 0x14]
add edx, 0x3556
add eax, edx
push ebp
lea ecx, [esi + eax*2]
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x20], 0
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
mov ebp, dword [esi + 0x18]
inc ebp
mov dword [esi + 0x18], ebp
mov edi, dword [ebx]
mov eax, edi
mov edx, dword [ebx + 0x18]
sub eax, edx
mov ecx, dword [ebx + 0x14]
mov dword [esp + 0x14], edx
movzx edx, byte [eax + ecx - 1]
mov ecx, 8
sub cl, byte [esi + 0xaa4]
mov eax, dword [esi + 0xaa8]
and eax, dword [esp + 0x24]
shr edx, cl
mov ecx, dword [esi + 0xaa4]
shl eax, cl
add edx, eax
mov eax, edi
sub eax, dword [ebx + 0x18]
imul ecx, edx, 0x600
mov edx, dword [ebx + 0x14]
movzx edx, byte [eax + edx]
add ecx, 0xaac
add ecx, esi
cmp dword [esi + 0x1f0], 7
mov dword [esp + 0x24], ecx
jge 0x639d4f
push edx
push 8
push ecx
push esi
call fcn.0063acf0
add esp, 0x10
jmp 0x639db0
sub edi, dword [esi + 0x1f4]
sub edi, dword [esp + 0x14]
mov eax, dword [ebx + 0x14]
mov ebx, 0x100
add edx, ebx
movzx edi, byte [edi + eax - 1]
mov eax, edx
add edi, edi
shr eax, 7
mov ecx, ebx
and eax, 1
and ecx, edi
mov dword [esi + ebp*4 + 0x20], eax
add ecx, ebx
mov eax, edx
add edx, edx
shr eax, 8
add eax, ecx
mov ecx, dword [esp + 0x24]
lea ecx, [ecx + eax*2]
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
mov eax, edi
inc dword [esi + 0x18]
xor eax, edx
mov ebp, dword [esi + 0x18]
not eax
and ebx, eax
cmp edx, 0x10000
jb 0x639d68
mov ebx, dword [esp + 0x18]
mov eax, dword [esi + 0x1f0]
pop ebp
cmp eax, 3
jg 0x639dcf
xor eax, eax
mov dword [esi + 0x1f0], eax
mov eax, dword [esp + 0x1c]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
ret
cmp eax, 9
jg 0x639de8
add eax, 0xfffffffd
mov dword [esi + 0x1f0], eax
mov eax, dword [esp + 0x1c]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
ret
add eax, 0xfffffffa
mov dword [esi + 0x1f0], eax
mov eax, dword [esp + 0x1c]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
ret
add eax, 0x3556
mov edi, dword [esp + 0x1c]
add eax, edx
push edi
lea ecx, [esi + eax*2]
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x20], 1
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
mov eax, dword [esi + 0x18]
inc eax
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x1f0]
add ecx, 0x3616
lea eax, [esi + eax*4]
lea ecx, [esi + ecx*2]
cmp ebx, 4
jae 0x639e68
mov dword [eax + 0x20], 1
mov eax, dword [esi + 0x18]
push ebx
push edx
push esi
mov dword [esi + eax*4 + 0x108], ecx
inc dword [esi + 0x18]
call fcn.0063afd0
mov eax, dword [esp + 0x24]
add esp, 0x10
sub dword [eax + 0x18], edi
pop edi
pop esi
pop ebx
ret
mov dword [eax + 0x20], 0
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
lea eax, [ebx - 4]
inc dword [esi + 0x18]
push eax
push edx
push esi
call fcn.0063abc0
mov eax, dword [esp + 0x24]
add esp, 0x10
sub dword [eax + 0x18], edi
pop edi
pop esi
pop ebx
ret
Function at 0x639f80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push edi
mov dword [ebx], 0x4000400
test edx, edx
je 0x639fc1
lea eax, [ebx + 0x104]
mov ecx, edx
nop
movaps xmm0, xmmword [0x6cfbb0]
lea eax, [eax + 0x10]
movups xmmword [eax - 0x110], xmm0
movaps xmm0, xmmword [0x6cfbb0]
movups xmmword [eax - 0x10], xmm0
sub ecx, 1
jne 0x639fa0
cmp byte [esp + 0x30], 0
lea edi, [ebx + 0x204]
mov ecx, 0x80
mov eax, 0x4000400
rep stosd dword es:[edi], eax
jne 0x63a1c5
mov dword [esp + 8], 0
test edx, edx
je 0x63a1c5
push ebp
lea ebp, [ebx + 0x404]
lea ecx, [ebx + 0x4808]
mov dword [esp + 0x10], ebp
push esi
mov dword [esp + 0x1c], ecx
mov edi, dword [ebx + 0x4804]
xor esi, esi
mov dword [ecx], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0x30], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov dword [esp + 0x38], esi
movzx eax, byte [eax + 0x6cfe38]
movzx edx, byte [ecx + 0x6cfe38]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x20], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x6cfe38]
add eax, edx
mov dword [esp + 0x24], eax
movzx eax, byte [ecx + 0x6cfe38]
add eax, edx
mov dword [esp + 0x28], eax
test edi, edi
je 0x63a19b
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
shl edi, 3
mov dword [esp + 0x18], edi
nop dword [eax]
cmp esi, 8
jae 0x63a0e5
lea edx, [esi + 8]
xor ebp, ebp
mov esi, dword [esp + 0x10]
nop
mov ecx, edx
lea edi, [esi*8]
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
and ecx, 0x7f
lea eax, [edi + edx]
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x6cfe38]
add ebp, eax
cmp edx, 1
jne 0x63a090
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x38]
add eax, ebp
mov ebp, dword [esp + 0x14]
mov dword [ebp + esi*4], eax
inc esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], esi
cmp esi, eax
jb 0x63a080
jmp 0x63a19b
cmp esi, eax
jae 0x63a19b
nop dword [eax]
cmp esi, 0x10
jae 0x63a152
mov edx, esi
xor ebp, ebp
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edi + edx]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
mov edi, esi
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x6cfe38]
add ebp, eax
cmp edx, 1
jne 0x63a100
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
add eax, ebp
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [ebp + esi*4], eax
inc esi
mov dword [esp + 0x38], esi
cmp esi, dword [esp + 0x30]
jb 0x63a0f0
jmp 0x63a19b
xor edi, edi
lea eax, [esi + 0xf0]
nop word [eax + eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x6cfe38]
add edi, ecx
cmp eax, 1
jne 0x63a160
mov eax, dword [esp + 0x28]
add eax, edi
mov dword [ebp + esi*4], eax
inc esi
cmp esi, dword [esp + 0x30]
jb 0x63a152
mov eax, dword [esp + 0x10]
add ebp, 0x440
mov ecx, dword [esp + 0x1c]
inc eax
add ecx, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebp
cmp eax, dword [esp + 0x34]
jb 0x63a004
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x63a1d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
mov edi, dword [ebx + 0x4804]
mov dword [ebx + eax*4 + 0x4808], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0xc], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x6cfe38]
movzx edx, byte [ecx + 0x6cfe38]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x6cfe38]
add eax, edx
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 0x6cfe38]
mov ecx, dword [esp + 0x28]
add eax, edx
mov dword [esp + 0x1c], eax
imul eax, ecx, 0x440
add eax, 0x404
add eax, ebx
mov dword [esp + 0x24], eax
test edi, edi
je 0x63a37c
lea eax, [ecx*8]
push ebp
mov dword [esp + 0x1c], eax
mov ebp, eax
nop dword [eax + eax]
cmp esi, 8
jae 0x63a2cd
xor edi, edi
lea edx, [esi + 8]
lea ebp, [ecx*8]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x6cfe38]
add edi, eax
cmp edx, 1
jne 0x63a281
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [esp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov ecx, dword [esp + 0x2c]
cmp esi, edi
jb 0x63a270
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
cmp esi, edi
jae 0x63a37b
cmp esi, 0x10
jae 0x63a32d
xor edi, edi
mov edx, esi
nop
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x6cfe38]
add edi, eax
cmp edx, 1
jne 0x63a2e0
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x63a2d5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x28]
xor edi, edi
lea eax, [esi + 0xf0]
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x6cfe38]
add edi, ecx
cmp eax, 1
jne 0x63a340
mov eax, dword [esp + 0x20]
add eax, edi
mov dword [ebp + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x63a331
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x63c530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x7e993c], 0
push esi
push edi
jne 0x63c5ec
mov byte [0x7e993c], 1
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x7eaa20], eax
inc esi
cmp esi, 0x100
jb 0x63c548
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
not eax
test edi, edi
je 0x63c61a
mov esi, dword [esp + 0xc]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x7eaa20]
sub edi, 1
jne 0x63c600
pop edi
not eax
pop esi
ret

Function at 0x63c620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x7e993c], 0
jne 0x63c6dc
push esi
mov byte [0x7e993c], 1
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x7eaa20], eax
inc esi
cmp esi, 0x100
jb 0x63c637
pop esi
ret
Function at 0x63c6e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x7ea140], 0
push ebx
push esi
push edi
jne 0x63c7f7
mov byte [0x7ea140], 1
xor esi, esi
nop dword [eax]
xor eax, eax
mov edx, esi
shrd edx, eax, 1
mov ecx, esi
and ecx, 1
shr eax, 1
or ecx, 0
je 0x63c71f
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x63c73a
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x63c755
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x63c770
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x63c78b
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x63c7a6
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x63c7c1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x63c7dc
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x7e9940], ecx
mov dword [esi*8 + 0x7e9944], eax
inc esi
cmp esi, 0x100
jb 0x63c700
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x63c835
mov esi, dword [esp + 0x10]
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x7e9940]
xor edx, dword [ecx*8 + 0x7e9944]
sub edi, 1
jne 0x63c810
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x63eee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x24], edx
lea esi, [edi + 0x105a4]
lea ebp, [edi + 0x101a0]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
mov eax, dword [edi + 0x10da0]
xor ebx, ebx
test eax, eax
je 0x63ef68
mov ebp, dword [esp + 0x24]
lea eax, [ebx + 0x40]
xor esi, esi
nop word [eax + eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
lea ecx, [eax + ebp]
and edx, 0x7f
movzx ecx, word [edi + ecx*2 + 0x6e0c]
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x6cfe38]
add esi, ecx
cmp eax, 1
jne 0x63ef20
mov ebp, dword [esp + 0x10]
mov dword [ebp + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x10da0]
cmp ebx, eax
jb 0x63ef11
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov ecx, 0xe
cmp eax, ecx
jbe 0x63ef88
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x10da0]
jb 0x63ef71
mov eax, dword [ebp]
add edx, 0x40
mov dword [esi - 4], eax
mov eax, dword [ebp + 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
add ebp, 0x100
mov dword [esi + 8], eax
add esi, 0x200
mov dword [esp + 0x10], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], esi
cmp edx, 0x100
jb 0x63ef05
mov ebx, 4
lea eax, [edi + 0x107b0]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
nop dword [eax]
cmp ebx, 4
ja 0x63efe9
mov esi, ebx
jmp 0x63eff9
bsr edx, ebx
mov eax, ebx
lea ecx, [edx - 1]
shr eax, cl
and eax, 1
lea esi, [eax + edx*2]
mov eax, esi
mov edx, esi
shr eax, 1
and edx, 1
dec eax
or edx, 2
mov ecx, eax
mov dword [esp + 0x18], eax
shl edx, cl
mov eax, ebx
mov ebx, dword [esp + 0x18]
mov ecx, 1
sub eax, edx
mov dword [esp + 0x1c], edx
xor ebp, ebp
mov dword [esp + 0x24], ecx
mov edx, eax
sub ecx, esi
add ecx, dword [esp + 0x1c]
and edx, 1
shr eax, 1
mov dword [esp + 0x18], eax
mov eax, edx
neg eax
movzx ecx, word [edi + ecx*2 + 0x700a]
shr eax, 4
shr ecx, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x6cfe38]
mov ecx, dword [esp + 0x24]
add ebp, eax
mov eax, dword [esp + 0x18]
lea ecx, [edx + ecx*2]
mov dword [esp + 0x24], ecx
sub ebx, 1
jne 0x63f025
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + esi*4 + 0x101a0]
mov ebx, dword [esp + 0x14]
add eax, ebp
inc ebx
mov dword [ecx - 0x200], eax
mov eax, dword [edi + esi*4 + 0x102a0]
add eax, ebp
mov dword [esp + 0x14], ebx
mov dword [ecx], eax
mov eax, dword [edi + esi*4 + 0x103a0]
add eax, ebp
mov dword [ecx + 0x200], eax
mov eax, dword [edi + esi*4 + 0x104a0]
add eax, ebp
mov dword [ecx + 0x400], eax
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, 0x80
jb 0x63efe0
mov dword [edi + 0x10da4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x63f0e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, 8
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov edx, dword [edi + 0xaa4]
lea ebp, [edi + 0xaac]
mov eax, dword [edi + 0xaa8]
sub ecx, edx
and eax, dword [esp + 0x18]
shr esi, cl
mov ecx, edx
shl eax, cl
add esi, eax
imul eax, esi, 0x600
add ebp, eax
cmp byte [esp + 0x20], bl
jne 0x63f135
push dword [esp + 0x28]
push 8
push ebp
call fcn.00640720
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x28]
mov esi, 0x100
mov edi, dword [esp + 0x24]
add edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x6cfe38]
mov ecx, edi
xor ecx, edx
add ebx, eax
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x63f144
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret