joyce8/EMBER2024-capa huggingface dataset:
Function at 0x782870
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
mov ebp, dword [esp + 0x48]
mov eax, ebp
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push esi
mov esi, dword [esp + 0x58]
push edi
jne 0x7828b5
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ebx, dword [esp + 0x58]
cmp ebx, 0x1f0
jle 0x7828db
mov eax, 0xa4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ecx, ebx
and ecx, 0x8000000f
jns 0x7828ea
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x7828c1
test ebx, ebx
jl 0x7828c1
lea edx, [esp + 0x10]
push 0x19
push edx
call fcn.00781e50
mov al, byte [esp + 0x5c]
mov edx, dword [esi]
mov ecx, ebx
sar ecx, 8
xor al, 0x2c
xor cl, 0x2c
mov byte [esp + 0x1b], al
mov eax, dword [esi + 4]
mov byte [esp + 0x1c], cl
mov ecx, dword [esi + 8]
xor bl, 0x2c
mov dword [esp + 0x1e], edx
mov edx, dword [esi + 0xc]
add esp, 8
mov dword [esp + 0x1a], eax
mov byte [esp + 0x11], 0x10
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x15], bl
mov dword [esp + 0x1e], ecx
mov dword [esp + 0x22], edx
xor eax, eax
xor byte [esp + eax + 0x16], 0x2c
add eax, 1
cmp eax, 0x10
jl 0x782943
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
call fcn.00782010
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
Function at 0x7829a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
mov ebp, dword [esp + 0x48]
mov eax, ebp
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push esi
mov esi, dword [esp + 0x58]
push edi
jne 0x7829e5
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ebx, dword [esp + 0x58]
cmp ebx, 0x5dc
jle 0x782a0b
mov eax, 0xa4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ecx, ebx
and ecx, 0x8000000f
jns 0x782a1a
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x7829f1
test ebx, ebx
jl 0x7829f1
lea edx, [esp + 0x10]
push 0x19
push edx
call fcn.00781e50
mov al, byte [esp + 0x5c]
mov edx, dword [esi]
or al, 4
mov ecx, ebx
sar ecx, 8
xor al, 0x2c
xor cl, 0x2c
mov byte [esp + 0x1b], al
mov eax, dword [esi + 4]
mov byte [esp + 0x1c], cl
mov ecx, dword [esi + 8]
xor bl, 0x2c
mov dword [esp + 0x1e], edx
mov edx, dword [esi + 0xc]
add esp, 8
mov dword [esp + 0x1a], eax
mov byte [esp + 0x11], 0x10
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x15], bl
mov dword [esp + 0x1e], ecx
mov dword [esp + 0x22], edx
xor eax, eax
xor byte [esp + eax + 0x16], 0x2c
add eax, 1
cmp eax, 0x10
jl 0x782a75
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
call fcn.00782010
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
Function at 0x782ad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x54]
push esi
push edi
jne 0x782b13
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ebx, dword [esp + 0x58]
cmp ebx, 0x1f0
jle 0x782b39
mov eax, 0xa4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ecx, ebx
and ecx, 0x8000000f
jns 0x782b48
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x782b1f
test ebx, ebx
jl 0x782b1f
lea edx, [esp + 0x10]
push 0x19
push edx
call fcn.00781e50
mov al, byte [esp + 0x5c]
mov ecx, ebx
sar ecx, 8
xor al, 0x2c
xor cl, 0x2c
mov byte [esp + 0x1b], al
mov eax, 0x2c2c2c2c
mov byte [esp + 0x1c], cl
sub esp, 0x14
xor bl, 0x2c
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
mov byte [esp + 0x2d], 0xf
mov byte [esp + 0x2e], 0x2c
mov byte [esp + 0x31], bl
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x48]
mov byte [esp + 0x44], al
push edx
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00782010
lea edx, [esp + 0x5a]
add esp, 0x28
mov edi, eax
mov ecx, ebp
sub edx, ebp
mov esi, 0x10
jmp 0x782be0
mov al, byte [edx + ecx]
xor al, 0x2c
mov byte [ecx], al
add ecx, 1
sub esi, 1
jne 0x782be0
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
Function at 0x782c10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x54]
push esi
push edi
jne 0x782c53
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ebx, dword [esp + 0x58]
cmp ebx, 0x5dc
jle 0x782c79
mov eax, 0xa4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10
mov ecx, ebx
and ecx, 0x8000000f
jns 0x782c88
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x782c5f
test ebx, ebx
jl 0x782c5f
lea edx, [esp + 0x10]
push 0x19
push edx
call fcn.00781e50
mov al, byte [esp + 0x5c]
or al, 4
mov ecx, ebx
sar ecx, 8
xor al, 0x2c
xor cl, 0x2c
mov byte [esp + 0x1b], al
mov eax, 0x2c2c2c2c
mov byte [esp + 0x1c], cl
sub esp, 0x14
xor bl, 0x2c
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
mov byte [esp + 0x2d], 0xf
mov byte [esp + 0x2e], 0x2c
mov byte [esp + 0x31], bl
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x48]
mov byte [esp + 0x44], al
push edx
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00782010
lea edx, [esp + 0x5a]
add esp, 0x28
mov edi, eax
mov ecx, ebp
sub edx, ebp
mov esi, 0x10
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, 0x2c
mov byte [ecx], al
add ecx, 1
sub esi, 1
jne 0x782d20
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0x10

Function at 0x7838d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x783913
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
mov bl, 0x2c
sub esp, 0x14
mov byte [esp + 0x2d], 0xd
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x48]
mov byte [esp + 0x44], al
push edx
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00782010
lea edx, [esp + 0x5a]
add esp, 0x28
mov edi, eax
mov ecx, ebp
sub edx, ebp
mov esi, 0x10
mov al, byte [edx + ecx]
xor al, bl
mov byte [ecx], al
add ecx, 1
sub esi, 1
jne 0x783976
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x7839a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x44
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
push ebx
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [esp + 0x64]
push esi
mov esi, dword [esp + 0x6c]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
jne 0x7839f7
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00786f61
add esp, 0x44
ret 0x20
lea ecx, [esp + 0x18]
push 0x19
push ecx
call fcn.00781e50
mov dl, byte [esp + 0x64]
mov al, byte [esp + 0x68]
mov cl, byte [esp + 0x6c]
xor dl, 0x2c
xor al, 0x2c
mov byte [esp + 0x23], dl
movzx edx, byte [ebx + 1]
mov byte [esp + 0x24], al
movzx eax, byte [ebx]
xor cl, 0x2c
mov byte [esp + 0x25], cl
movzx ecx, byte [ebp + 1]
xor dl, 0x2c
xor al, 0x2c
mov byte [esp + 0x26], dl
movzx edx, byte [ebp]
mov byte [esp + 0x27], al
movzx eax, byte [esi + 1]
xor cl, 0x2c
mov byte [esp + 0x28], cl
movzx ecx, byte [esi]
xor dl, 0x2c
xor al, 0x2c
mov byte [esp + 0x29], dl
movzx edx, byte [edi + 1]
mov byte [esp + 0x2a], al
movzx eax, byte [edi]
xor cl, 0x2c
mov byte [esp + 0x2b], cl
sub esp, 0x14
xor dl, 0x2c
xor al, 0x2c
mov byte [esp + 0x40], dl
mov byte [esp + 0x41], al
mov byte [esp + 0x35], 9
mov byte [esp + 0x36], 0x2c
mov ecx, 6
lea esi, [esp + 0x34]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x38]
mov byte [esp + 0x50], al
mov eax, dword [esp + 0x78]
push edx
push eax
call fcn.00782010
movzx edx, byte [esp + 0x63]
movzx ecx, byte [esp + 0x62]
xor dl, 0x2c
mov byte [ebx], dl
movzx edx, byte [esp + 0x65]
xor cl, 0x2c
mov byte [ebx + 1], cl
movzx ecx, byte [esp + 0x64]
xor dl, 0x2c
mov byte [ebp], dl
movzx edx, byte [esp + 0x66]
xor cl, 0x2c
mov byte [ebp + 1], cl
mov ecx, dword [esp + 0x3c]
xor dl, 0x2c
mov byte [ecx + 1], dl
movzx edx, byte [esp + 0x67]
xor dl, 0x2c
mov byte [ecx], dl
movzx edx, byte [esp + 0x68]
mov ecx, dword [esp + 0x38]
xor dl, 0x2c
mov byte [ecx + 1], dl
movzx edx, byte [esp + 0x69]
add esp, 0x28
xor dl, 0x2c
mov byte [ecx], dl
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x44
ret 0x20
Function at 0x783c20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x783c63
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x15], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x19], eax
mov byte [esp + 0x11], 0x30
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], bl
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x21], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x783ca0
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x783d02
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x783c74
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x2b
call fcn.00786f61
add esp, 0x3c
ret 8

Function at 0x783d20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x783d63
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov dl, bl
or dl, 0x10
mov dword [esp + 0x15], eax
mov eax, dword [ebp + 0xc]
mov byte [esp + 0x13], dl
mov edx, dword [ebp + 8]
mov dword [esp + 0x21], eax
mov byte [esp + 0x11], 0x30
mov byte [esp + 0x12], 0x2c
mov dword [esp + 0x19], ecx
mov dword [esp + 0x1d], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x783da5
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
mov byte [esp + 0x48], al
mov eax, dword [esp + 0x70]
push edx
push eax
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x783e07
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x783d74
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x2b
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x783e30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x783e73
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov dl, bl
or dl, 0x10
mov dword [esp + 0x15], eax
mov eax, dword [ebp + 0xc]
mov byte [esp + 0x13], dl
mov edx, dword [ebp + 8]
mov dword [esp + 0x21], eax
mov byte [esp + 0x11], 0x31
mov byte [esp + 0x12], 0x2c
mov dword [esp + 0x19], ecx
mov dword [esp + 0x1d], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x783eb5
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
mov byte [esp + 0x48], al
mov eax, dword [esp + 0x70]
push edx
push eax
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x783f17
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x783e84
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x2c
call fcn.00786f61
add esp, 0x3c
ret 8

Function at 0x783f40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x783f83
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x15], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x19], eax
mov byte [esp + 0x11], 0x31
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], bl
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x21], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x783fc0
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x784022
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x783f94
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x2c
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x7842b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x7842f3
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x15], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x19], eax
mov byte [esp + 0x11], 0x37
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], bl
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x21], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x784330
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x78437d
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x784304
sub esp, 0x1c
mov byte [esp + 0x2d], 0x37
mov byte [esp + 0x2e], 0x2c
mov byte [esp + 0x2f], 0x24
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x784640
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x784683
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x15], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x19], eax
mov byte [esp + 0x11], 0x35
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], bl
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x21], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x7846c0
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x78470d
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x784694
sub esp, 0x1c
mov byte [esp + 0x2d], 0x35
mov byte [esp + 0x2e], 0x2c
mov byte [esp + 0x2f], 0x24
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8

Function at 0x7848e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x44]
push ebx
mov ebx, dword [esp + 0x44]
mov eax, ebx
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push esi
push edi
jne 0x784923
mov eax, 0xa2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
mov dl, byte [ecx]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], al
mov al, byte [ecx + 1]
mov cl, byte [ecx + 2]
xor al, 0x2c
xor dl, 0x2c
xor cl, 0x2c
mov byte [esp + 0x10], al
mov byte [esp + 0xd], 0x91
mov byte [esp + 0xe], 0x2c
mov byte [esp + 0xf], dl
mov byte [esp + 0x11], cl
xor eax, eax
lea esp, [esp]
xor byte [esp + eax + 0x12], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x784970
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x28]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
lea edx, [esp + 0x44]
mov byte [esp + 0x40], al
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00782010
mov ecx, dword [esp + 0x6c]
add esp, 0x28
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x7849c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
mov ebp, dword [esp + 0x48]
mov eax, ebp
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push esi
push edi
jne 0x784a01
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0xc
cmp word [esp + 0x54], 0
lea ecx, [esp + 0x10]
setne bl
push 0x19
push ecx
lea ebx, [ebx*8 + 8]
call fcn.00781e50
movzx esi, bl
mov dl, bl
xor dl, 0x2c
add esp, 8
xor eax, eax
test esi, esi
mov byte [esp + 0x11], 0x41
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], dl
jle 0x784a59
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x16]
sub edi, ecx
lea ecx, [esp + eax + 0x16]
mov dl, byte [edi + ecx]
xor dl, 0x2c
add eax, 1
cmp eax, esi
mov byte [ecx], dl
jl 0x784a46
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
call fcn.00782010
add esp, 0x28
test eax, eax
jbe 0x784a8f
mov eax, 0x28
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 0xc