joyce8/EMBER2024-capa huggingface dataset:
Function at 0x779750
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push 0
push 0
push esi
call fcn.007796c0
call fcn.00772c80
mov ebp, dword [esi + 0x10]
push 7
push str.http:__
push ebp
call fcn.0078cfb0
add esp, 0x18
test eax, eax
jne 0x779781
add ebp, 7
push 0x8161f0
push ebp
call fcn.00790910
mov bl, byte [eax + ebp]
lea edi, [eax + ebp]
push ebp
mov byte [edi], 0
call fcn.00772cb0
add esp, 0xc
mov dword [esi + 0x14], eax
test eax, eax
je 0x77981d
mov byte [edi], bl
mov al, byte [edi]
cmp al, 0x3a
jne 0x7797d4
inc edi
push edi
call fcn.0078cee7
add esp, 4
push eax
call sub.WSOCK32.dll_htons
test ax, ax
mov word [esi + 0x1c], ax
je 0x77981d
mov al, byte [edi + 1]
inc edi
test al, al
je 0x7797df
cmp al, 0x2f
jne 0x7797c6
jmp 0x7797df
push 0x50
call sub.WSOCK32.dll_htons
mov word [esi + 0x1c], ax
cmp byte [edi], 0
jne 0x7797e9
mov edi, 0x8161ec
push edi
call fcn.00772cb0
push 0x20
push eax
mov dword [esi + 0x20], eax
call fcn.0078c230
add esp, 0xc
test eax, eax
je 0x779816
mov byte [eax], 0x2b
mov eax, dword [esi + 0x20]
push 0x20
push eax
call fcn.0078c230
add esp, 8
test eax, eax
jne 0x779801
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x779833
mov dword [esi + 0xbc], 1
mov dword [esi + 0x30], 3
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x14]
push ecx
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
jne 0x779871
mov edx, dword [esi + 0x14]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x779867
mov dword [esi + 0xbc], 1
mov dword [esi + 0x30], 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esi + 0x18], edx
push 0
push 0
push esi
mov dword [esi + 0xc], 1
call fcn.007796c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x779890
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, 1
cmp dword [esi + 0x40], 0xffffffff
jne 0x779982
push 6
push edi
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
jne 0x7798d5
mov dword [esi + 0xbc], edi
mov dword [esi + 0x30], 5
call sub.WSOCK32.dll_WSAGetLastError
mov dword [esi + 0x44], eax
pop edi
pop esi
add esp, 0x14
ret
push 0
push eax
call fcn.00772d00
add esp, 8
test eax, eax
jne 0x7798ff
mov dword [esi + 0xbc], edi
mov dword [esi + 0x30], 5
call sub.WSOCK32.dll_WSAGetLastError
mov dword [esi + 0x44], eax
pop edi
pop esi
add esp, 0x14
ret
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x77991b
mov eax, dword [0x815fe0]
mov ecx, dword [esi + 0x40]
push eax
push ecx
call fcn.00772d60
add esp, 8
mov ax, word [esi + 0x1c]
xor edx, edx
mov dword [esp + 0xc], edx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x10], edx
mov word [esp + 0xe], ax
mov eax, dword [esi + 0x40]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x779982
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x779982
cmp eax, 0x2734
je 0x779982
mov dword [esi + 0xbc], edi
mov dword [esi + 0x30], 6
mov dword [esi + 0x44], eax
pop edi
pop esi
add esp, 0x14
ret
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x20]
lea edx, [esp + 8]
push ecx
push edx
push 0
push eax
call fcn.00777e90
add esp, 0x10
test eax, eax
je 0x7799c8
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x7799c8
mov eax, dword [esp + 8]
test eax, eax
je 0x7799e1
push 0
push 0
push esi
mov dword [esi + 0xc], 2
call fcn.007796c0
add esp, 0xc
pop edi
pop esi
add esp, 0x14
ret
test eax, eax
mov dword [esi + 0xbc], edi
mov dword [esi + 0x30], 6
jne 0x7799e1
call sub.WSOCK32.dll_WSAGetLastError
mov dword [esi + 0x44], eax
pop edi
pop esi
add esp, 0x14
ret

Function at 0x77acc0
Capabilities:
Write file on windows

Disassembly:
mov al, byte [0x87d804]
sub esp, 0x104
test al, al
push esi
je 0x77ad35
mov esi, dword [esp + 0x10c]
cmp dword [esi], 0xffffffff
je 0x77ad35
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.0078dbe6
mov al, byte [0x87d804]
add esp, 0xc
test al, al
mov byte [esp + 0x107], 0
je 0x77ad35
mov edx, dword [esi]
cmp edx, 0xffffffff
je 0x77ad35
push edi
lea eax, [esp + 8]
push 0
push eax
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x104
ret
Function at 0x78ff68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78ff88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00790231
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x78ffab
test byte [esp + 8], 2
je 0x78ffab
call fcn.007902a4
mov dword [eax], 0xd
call fcn.007902ad
mov dword [eax], 5
jmp 0x78ff84
xor eax, eax
ret

Function at 0x799c96
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x8198d8
cmp edx, dword [eax]
je 0x799cb8
add eax, 8
inc ecx
cmp eax, 0x819968
jl 0x799ca9
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x8198d8]
jne 0x799de6
mov eax, dword [0x89ee98]
cmp eax, 1
je 0x799dc0
test eax, eax
jne 0x799ce9
cmp dword [0x816b7c], 1
je 0x799dc0
cmp edx, 0xfc
je 0x799de6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x799d20
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00793870
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00791bb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x799d63
lea eax, [ebp - 0x1a4]
push eax
call fcn.00791bb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7e9fc0
push edi
call fcn.0078cff0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00793870
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00793880
lea eax, [ebp - 0xa0]
push 0x8162b0
push eax
call fcn.00793880
push dword [esi + 0x8198dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00793880
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.007a0503
add esp, 0x2c
pop edi
jmp 0x799de6
lea eax, [ebp + 8]
lea esi, [esi + 0x8198dc]
push 0
push eax
push dword [esi]
call fcn.00791bb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7a9dde
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x7a9dff
mov eax, 0x8876086c
jmp 0x7a9eea
cmp dword [ebp + 0x7c], esi
je 0x7a9e79
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x7a9e59
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.0078c8d0
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x7a9e79
push esi
push 0x10000000
push 3
push esi
push 1
push bind
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x7a9e92
push esi
push 0x10000000
push 3
push esi
push 1
push bind
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x7a9ed2
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x7a9ed2
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x7a9ed2
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x7a9ee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x7a9eea
and eax, 0xffff
or eax, 0x80070000
jmp 0x7a9eea
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
Function at 0x7ad2bd
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x7ad412
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x7ad3ed
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x7ad320
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x7ad2fd
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x7ad537
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x7ad67e
push ebx
mov edx, 0xf81f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x7ad659
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x7ad5a0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x7ad577
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x7ad7ab
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x7ad8f1
push ebx
mov eax, 0x83e0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x7ad8cc
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x7ad814
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x7ad7eb
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x7ad8fa
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x7ada44
push ebx
mov edx, 0xf0f0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x7ada1f
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x7ad963
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x7ad93a
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x7ada4d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x7adb83
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x7adb5e
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x7adaac
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x7ada88
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x7adc27
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x7add6b
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x7add45
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x7adc90
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x7adc67
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x7adea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x7adfe4
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x7adfbe
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x7adf09
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x7adee0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret