joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660d99
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x7b428c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x9727c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
push edi
mov ecx, dword [eax + 4]
add ecx, esi
mov edx, dword [ecx + 0xc]
and edx, 0xfffffffe
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], edi
cmove edx, eax
push edx
call fcn.00497482
push ecx
push esi
lea ecx, [esp + 0x14]
call fcn.00661dd1
mov dword [esp + 0x38], edi
mov eax, dword [esi]
mov ecx, dword [eax + 4]
test byte [ecx + esi + 0xc], 6
jne 0x660e46
mov ecx, dword [ecx + esi + 0x38]
lea edx, [esp + 0x14]
push 1
push dword [ebp + 0x10]
mov eax, dword [ecx]
push edi
push edi
push edx
call dword [eax + 0x28]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
adc ecx, dword [esp + 0x20]
cmp eax, dword [0x7c3c30]
jne 0x660e46
cmp ecx, dword [0x7c3c34]
jne 0x660e46
mov eax, dword [esi]
push edi
push 2
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004ba786
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov ecx, dword [eax + ecx + 0x38]
test ecx, ecx
je 0x660e61
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x661912
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x7b43d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x9727c0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x9727c0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x661a59
cmp byte [ebx + 0x45], 0
je 0x661a59
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x661972
xor al, al
jmp 0x661a5b
xor eax, eax
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
call fcn.0049ce51
and dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x6619df
dec eax
je 0x6619e3
dec eax
dec eax
je 0x661a41
xor bl, bl
jmp 0x661a43
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x661a22
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0073933c
add esp, 0x10
cmp esi, eax
jne 0x6619db
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebx + 0x45], 0
je 0x661a41
test esi, esi
jne 0x6619a5
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.0049b4c5
jmp 0x66199d
mov bl, 1
or dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x18]
push 0
push 1
call fcn.0048287e
mov al, bl
jmp 0x661a5b
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0073167f
mov esp, ebp
pop ebp
ret
Function at 0x670ad3
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call fcn.00670c97
cmp byte [esi + 0x48], 0
mov dword [esi + 8], eax
jne 0x670b9d
cmp eax, 0x2f
jne 0x670b9d
mov eax, dword [esi + 4]
cmp eax, 0x28
je 0x670b37
cmp eax, 0x2c
je 0x670b37
cmp eax, 0x3d
je 0x670b37
cmp eax, 0x3a
je 0x670b37
cmp eax, 0x5b
je 0x670b37
cmp eax, 0x21
je 0x670b37
cmp eax, 0x26
je 0x670b37
cmp eax, 0x7c
je 0x670b37
cmp eax, 0x3f
je 0x670b37
cmp eax, 0x7b
je 0x670b37
cmp eax, 0x7d
je 0x670b37
cmp eax, 0x3b
je 0x670b37
cmp eax, 0xa
jne 0x670b9d
movzx eax, al
lea edi, [esi + 0x18]
push eax
mov ecx, edi
call fcn.00670d9d
mov ecx, esi
call fcn.00670ba7
movzx eax, byte [esi + 8]
jmp 0x670b7a
cmp dword [esi + 4], 0x5c
jne 0x670b70
movzx eax, byte [esi + 4]
mov ecx, edi
push eax
call fcn.00670d9d
push 1
mov ecx, esi
call fcn.00670c3e
mov dword [esi + 4], eax
cmp dword [esi + 4], 0xffffffff
je 0x670ba1
movzx eax, byte [esi + 4]
push eax
mov ecx, edi
call fcn.00670d9d
push 1
mov ecx, esi
call fcn.00670c3e
mov dword [esi + 4], eax
cmp eax, 0x2f
jne 0x670b52
mov ecx, esi
call fcn.00670c97
mov dword [esi + 8], eax
pop edi
pop esi
pop ecx
ret
mov byte [esi + 0x48], 1
jmp 0x670b9d
Function at 0x670dc2
Capabilities:
Encode data using base64

Disassembly:
push 0x18
mov eax, 0x7b7d84
call fcn.00736ce0
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
test eax, eax
je 0x670f54
push 3
pop esi
jmp 0x670e06
mov edx, dword [ebp - 0x24]
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
mov byte [ebp + edi - 0x14], al
inc edi
mov ch, byte [ebp - 0x12]
inc edx
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov dl, byte [ebp - 0x13]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x670e9b
mov esi, dword [ebp - 0x1c]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x9756dc], 0x10
mov ecx, 0x9756c8
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x9756c8]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
push 1
call fcn.0049b4c5
inc edi
cmp edi, 4
jl 0x670e61
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x670e03
mov dword [ebp + 8], edi
test edi, edi
je 0x670f54
mov eax, edi
cmp edi, esi
jge 0x670ed1
cmp eax, esi
jae 0x670f5d
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x670eb9
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x670f3f
mov esi, dword [ebp - 0x1c]
mov edi, eax
cmp dword [0x9756dc], 0x10
mov ecx, 0x9756c8
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x9756c8]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
push 1
call fcn.0049b4c5
inc ebx
cmp ebx, edi
jl 0x670f0e
mov edi, dword [ebp + 8]
push 3
pop esi
cmp edi, esi
jge 0x670f54
sub esi, edi
mov ecx, dword [ebp - 0x1c]
push 0x3d
push 1
call fcn.0049b4c5
dec esi
jne 0x670f45
mov eax, dword [ebp - 0x1c]
call fcn.00736cae
ret
call fcn.00732d82
int3
Function at 0x67e340
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x67e34b
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x67e403
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
dec edi
jne 0x67e366
pop edi
test esi, esi
je 0x67e41c
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8bf360]
inc edx
dec esi
jne 0x67e407
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x67e424
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x8bf360]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x8bf360]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x681630
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x68164c
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x681670
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.007389c0
movzx eax, word [ebx*8 + 0x8c11ba]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x8c11b8]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x8c11bc]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x8c11be]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x6816d3
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x6816de
cmp ebx, 8
jl 0x6816de
mov eax, dword [ebp + 8]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x681745
cmp eax, 0xffffffff
je 0x681745
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x681720
mov ecx, esi
call fcn.00681900
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x681728
jmp 0x681755
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x681a43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, edi
mov ebx, edi
mov dword [ebp - 4], ecx
mov dword [esi + 0x6af80], 2
jmp 0x681c41
cmp dword [esi + 0x6af90], 3
jb 0x681ac0
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x681afd
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x681afd
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x681ae7
mov dword [esi + 0x6afa0], eax
mov edx, ecx
mov ecx, esi
call fcn.0068175a
mov ecx, dword [esi + 0x6af90]
mov ebx, eax
cmp ebx, ecx
cmova ebx, ecx
mov ecx, esi
cmp ebx, 3
jb 0x681bcf
mov edx, dword [esi + 0x6af84]
lea eax, [ebx - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.0068108b
sub dword [esi + 0x6af90], ebx
pop ecx
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x681b96
cmp dword [esi + 0x6af90], 3
jb 0x681b96
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec ebx
jne 0x681b39
mov eax, dword [ebp - 8]
jmp 0x681bec
add dword [esi + 0x6af84], ebx
mov ebx, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 8]
jmp 0x681bf2
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.0068108b
dec dword [esi + 0x6af90]
pop ecx
inc dword [esi + 0x6af84]
test eax, eax
je 0x681c2b
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x681c0a
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x681c0c
mov edx, edi
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push edi
push eax
call fcn.00680e93
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x681c3e
mov ecx, esi
call fcn.00681900
mov ecx, dword [ebp - 4]
cmp dword [esi + 0x6af90], edi
jne 0x681a65
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x681c5f
lea edi, [esi + 0x1af70]
add edi, ecx
mov eax, dword [esi + 0x6af84]
mov edx, edi
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00680e93
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x68287b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x682886
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x68293e
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
dec edi
jne 0x6828a1
pop edi
test esi, esi
je 0x682957
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x8c1240]
inc edx
dec esi
jne 0x682942
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x68295f
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x8c1240]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x8c1240]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x68aa60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x68aa8d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x8c1b50]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x68aa70
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x68ab10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, 0x80
mov dword [ebp - 0xc], edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [edi]
jne 0x68ab41
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x98b694]
test eax, eax
je 0x68ab4c
call eax
lea eax, [esi*8]
push eax
call fcn.006872b0
mov ecx, dword [0x98b698]
add esp, 4
mov ebx, eax
mov dword [ebp - 8], ebx
test ecx, ecx
je 0x68ab6d
call ecx
test ebx, ebx
je 0x68ab38
push dword [edi + 0xc]
call fcn.006875b0
add esp, 4
mov dword [edi + 0xc], ebx
push ebx
call dword [0x97554c]
shr eax, 3
add esp, 4
mov dword [ebp - 4], eax
mov dword [edi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.007389c0
mov ebx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ebx, ebx
je 0x68abfe
mov ecx, dword [ebx + 0x10]
xor edi, edi
mov esi, dword [ebx + 0xc]
test ecx, ecx
jle 0x68abdd
mov edi, edi
movzx eax, byte [esi]
lea esi, [esi + 1]
dec ecx
movzx edx, byte [eax + 0x8c1b50]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test ecx, ecx
jg 0x68abc0
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov esi, dword [ebx]
div dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
lea edx, [eax + edx*8]
call fcn.0068aaa0
add esp, 4
mov ebx, esi
test esi, esi
jne 0x68abb2
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x692940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x9727c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0x14], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x69298a
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x692a67
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x6929c3
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.00738910
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
test edi, edi
je 0x692a65
mov ebx, dword [edi + 0x14]
cmp ebx, dword [esi + 0x18]
ja 0x692a57
test byte [edi + 0x18], 0x20
jne 0x692a57
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.00738910
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp ebx, 1
jne 0x692a03
mov ecx, edi
call fcn.00691c30
push dword [ebp - 0x14]
mov eax, dword [esi + 0x3c]
push dword [ebp - 0x18]
mov edx, dword [edi + 4]
push dword [esi + 0x80]
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0xc], edx
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 0x14], eax
cmp ebx, 1
jne 0x692a39
mov eax, dword [ebp - 0xc]
movdqu xmm0, xmmword [eax + 0x18]
movdqu xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x692a41
mov dword [esi + 0x20], ebx
inc dword [esi + 0xa8]
mov edx, ebx
push dword [edi + 4]
mov ecx, dword [esi + 0x58]
call fcn.006a1650
add esp, 4
mov ebx, dword [ebp - 0x14]
mov edi, dword [edi + 0xc]
test ebx, ebx
je 0x6929c3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0073167f
mov esp, ebp
pop ebp
ret
Function at 0x6bbcc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
mov ebx, edx
push edi
test edx, edx
je 0x6bbced
cmp byte [edx], cl
je 0x6bbce5
inc ebx
cmp byte [ebx], cl
jne 0x6bbce0
sub ebx, edx
and ebx, 0x3fffffff
mov edi, dword [esi + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], edi
test edi, edi
jle 0x6bbdd7
mov edi, eax
cmp eax, 2
jge 0x6bbd0a
xor edi, 1
mov eax, dword [ebp + 8]
test eax, eax
je 0x6bbd6f
mov edx, eax
mov ecx, edi
mov eax, dword [esi + 0x10]
add ecx, ecx
mov esi, dword [eax + ecx*8]
mov eax, edx
mov al, byte [eax]
test al, al
je 0x6bbd4d
jmp 0x6bbd30
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x8c1b50]
cmp al, byte [ecx + 0x8c1b50]
jne 0x6bbd4d
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x6bbd30
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x8c1b50]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x8c1b50]
sub eax, ecx
jne 0x6bbde5
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 4], ecx
cmp dword [ecx + 0xc], 0
je 0x6bbdb8
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x6bbdb0
mov edi, edi
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x8c1b50]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x6bbd90
mov ecx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x6bbdba
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ebx
call fcn.0068ac10
add esp, 8
test eax, eax
je 0x6bbdde
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x6bbde8
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x6bbde8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x14]
jge 0x6bbdd5
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
jmp 0x6bbd00
Function at 0x6bbf10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x6bbf3d
cmp byte [edx], al
je 0x6bbf35
jmp 0x6bbf30
inc ebx
cmp byte [ebx], al
jne 0x6bbf30
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], esi
test esi, esi
jle 0x6bc019
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], esi
mov eax, edi
cmp edi, 2
jge 0x6bbf60
xor eax, 1
shl eax, 4
cmp dword [ebp + 8], 0
mov ecx, dword [eax + esi + 0xc]
mov dword [ebp - 0x10], ecx
je 0x6bbfbb
mov ecx, dword [ebp + 8]
mov edx, ecx
mov esi, dword [eax + esi]
mov al, byte [ecx]
test al, al
je 0x6bbf9d
mov edi, edi
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x8c1b50]
cmp al, byte [ecx + 0x8c1b50]
jne 0x6bbf9d
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x6bbf80
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x8c1b50]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x8c1b50]
sub eax, ecx
jne 0x6bc027
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add ecx, 0x18
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0xc], 0
je 0x6bbffc
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x6bbff1
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x8c1b50]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x6bbfd1
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x6bbffe
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ebx
call fcn.0068ac10
add esp, 8
test eax, eax
je 0x6bc020
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x6bc02a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x6bc02a
mov eax, dword [ebp - 4]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp - 0x14]
jge 0x6bc019
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
jmp 0x6bbf56