joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov cl, byte [eax]
mov dl, byte [eax + 1]
inc eax
inc eax
inc eax
mov byte [esp + 0xe], cl
mov cl, byte [eax - 1]
inc eax
inc eax
mov byte [esp + 0x16], cl
mov cl, byte [eax - 1]
mov byte [esp + 0xc], dl
mov dl, byte [eax - 2]
inc eax
inc eax
mov byte [esp + 0x12], cl
mov cl, byte [eax - 1]
mov byte [esp + 0x10], dl
mov dl, byte [eax - 2]
inc eax
mov byte [esp + 0x14], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0x11], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xa], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xf], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0x15], cl
mov cl, byte [eax - 1]
mov bl, byte [eax]
inc eax
test cl, cl
mov byte [esp + 0xb], bl
mov bl, byte [eax]
mov al, byte [eax + 1]
mov byte [esp + 9], dl
mov byte [esp + 8], cl
mov byte [esp + 0x13], bl
mov byte [esp + 0xd], al
jne 0x57c7ff
test dl, dl
jne 0x57c7ff
mov cl, byte [esp + 0xa]
test cl, cl
jne 0x57c7ff
mov cl, byte [esp + 0xb]
test cl, cl
jne 0x57c7ff
mov cl, byte [esp + 0xc]
test cl, cl
jne 0x57c7ff
test al, al
jne 0x57c7ff
mov al, byte [esp + 0xe]
test al, al
jne 0x57c7ff
mov al, byte [esp + 0xf]
test al, al
jne 0x57c7ff
mov al, byte [esp + 0x10]
test al, al
jne 0x57c7ff
mov al, byte [esp + 0x11]
test al, al
jne 0x57c7ff
mov al, byte [esp + 0x12]
test al, al
jne 0x57c7ff
test bl, bl
jne 0x57c7ff
mov al, byte [esp + 0x14]
test al, al
jne 0x57c7ff
mov al, byte [esp + 0x15]
test al, al
jne 0x57c7ff
mov al, byte [esp + 0x16]
test al, al
jne 0x57c7ff
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x10
ret
push esi
push edi
mov ecx, 0xf
lea edi, [esp + 0x10]
call fcn.0057bf60
mov edx, edi
mov ecx, 1
mov esi, 0xf
jmp 0x57c820
mov bl, byte [edx]
xor bl, cl
mov edi, ecx
movzx cx, ch
and edi, 0x1ff
or cx, word [edi*2 + 0xa7b460]
mov byte [edx], bl
inc edx
dec esi
jne 0x57c820
test eax, eax
pop edi
pop esi
jne 0x57c86a
mov dl, byte [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 0x10]
mov byte [eax], dl
mov dl, byte [esp + 0x11]
movzx eax, byte [esp + 0xd]
mov byte [ebp], cl
mov byte [ebp + 1], dl
pop ebp
shl eax, 3
pop ebx
add esp, 0x10
ret
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x10
ret
Function at 0x57c880
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx]
sub esp, 0x4c
cmp ecx, 6
jge 0x57c899
cmp ecx, 0x100
jle 0x57c899
or eax, 0xffffffff
add esp, 0x4c
ret
mov dl, byte [eax]
mov cl, byte [eax + 1]
inc eax
inc eax
mov byte [esp + 2], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 4], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 1], dl
mov dl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [esp + 0xd], cl
mov ecx, 6
lea edi, [esp + 8]
mov byte [esp + 8], dl
mov byte [esp + 0xb], al
call fcn.0057bf60
mov edx, edi
mov ecx, 0xa1
mov esi, 6
nop
xor byte [edx], cl
mov edi, ecx
movzx cx, ch
and edi, 0x1ff
or cx, word [edi*2 + 0xa7b460]
inc edx
dec esi
jne 0x57c8e0
test eax, eax
pop edi
pop esi
jne 0x57c920
mov cl, byte [esp]
mov al, byte [esp + 2]
mov dl, byte [esp + 1]
mov byte [ebx], cl
mov cl, byte [esp + 3]
mov byte [ebx + 2], al
mov byte [ebx + 1], dl
mov byte [ebx + 3], cl
xor eax, eax
add esp, 0x4c
ret
mov eax, 0xfffffffe
add esp, 0x4c
ret

Function at 0x57c930
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx]
sub esp, 0x4c
cmp ecx, 0x10
jge 0x57c949
cmp ecx, 0x100
jle 0x57c949
or eax, 0xffffffff
add esp, 0x4c
ret
mov dl, byte [eax]
mov cl, byte [eax + 1]
inc eax
inc eax
inc eax
mov byte [esp + 9], dl
mov dl, byte [eax - 1]
inc eax
mov byte [esp + 5], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xd], dl
mov dl, byte [eax - 1]
inc eax
mov byte [esp], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xf], dl
mov dl, byte [eax - 1]
inc eax
mov byte [esp + 8], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 3], dl
mov dl, byte [eax - 1]
mov byte [esp + 0xb], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 0xa], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 2], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 0xe], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 4], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 7], dl
mov dl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [esp + 9], cl
mov ecx, 0x10
lea edi, [esp + 8]
mov byte [esp + 0x14], dl
mov byte [esp + 0xe], al
call fcn.0057bf60
mov edx, edi
mov ecx, 0x80
mov esi, 0x10
jmp 0x57c9e0
xor byte [edx], cl
mov edi, ecx
movzx cx, ch
and edi, 0x1ff
or cx, word [edi*2 + 0xa7b460]
inc edx
dec esi
jne 0x57c9e0
test eax, eax
pop edi
pop esi
jne 0x57ca48
mov edx, dword [esp + 0x50]
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov dword [edx], ecx
mov ecx, dword [esp + 0x54]
mov dl, byte [esp + 0xa]
mov dword [ecx], eax
mov eax, dword [esp + 0x58]
mov cl, byte [esp + 0xb]
mov byte [eax], dl
mov edx, dword [esp + 0x5c]
mov al, byte [esp + 0xc]
mov byte [edx], cl
mov cl, byte [esp + 0xd]
mov dl, byte [esp + 0xe]
mov byte [ebx], al
mov al, byte [esp + 0xf]
mov byte [ebx + 3], al
mov byte [ebx + 1], cl
mov byte [ebx + 2], dl
xor eax, eax
add esp, 0x4c
ret
mov eax, 0xfffffffe
add esp, 0x4c
ret
Function at 0x57ca60
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [eax]
sub esp, 0x50
cmp al, 2
push esi
mov esi, ecx
je 0x57ca7a
cmp al, 3
je 0x57ca7a
mov eax, 0xffffffff
pop esi
add esp, 0x50
ret
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
test al, 0xf
jne 0x57cbd5
cmp eax, 0xc0
jg 0x57cbd5
mov ecx, dword [edx]
sar eax, 4
lea edx, [eax + eax*8]
shl edx, 1
cmp ecx, edx
jge 0x57caad
cmp ecx, 0x100
jg 0x57cbd5
test eax, eax
push ebx
push ebp
push edi
mov dword [esp + 0x10], 0
jle 0x57cbbe
mov ebx, dword [esp + 0x68]
mov al, byte [esi]
mov cl, byte [esi + 1]
inc esi
mov dl, byte [esi + 1]
inc esi
inc esi
inc esi
inc esi
mov byte [esp + 0x1e], al
mov al, byte [esi - 2]
inc esi
mov byte [esp + 0x24], cl
mov cl, byte [esi - 2]
inc esi
mov byte [esp + 0x1a], dl
mov dl, byte [esi - 2]
inc esi
mov byte [esp + 0x16], al
mov al, byte [esi - 2]
mov byte [esp + 0x1f], cl
mov cl, byte [esi - 1]
inc esi
mov byte [esp + 0x18], dl
mov dl, byte [esi - 1]
inc esi
mov byte [esp + 0x25], al
mov al, byte [esi - 1]
inc esi
mov byte [esp + 0x21], cl
mov cl, byte [esi - 1]
inc esi
mov byte [esp + 0x23], dl
mov dl, byte [esi - 1]
inc esi
mov byte [esp + 0x1c], al
mov al, byte [esi - 1]
mov byte [esp + 0x22], cl
mov cl, byte [esi]
inc esi
mov byte [esp + 0x15], dl
mov dl, byte [esi]
inc esi
mov byte [esp + 0x1d], al
mov al, byte [esi]
inc esi
mov byte [esp + 0x14], cl
mov cl, byte [esi]
inc esi
mov byte [esp + 0x19], dl
mov dl, byte [esi]
mov byte [esp + 0x20], cl
mov ecx, 0x12
lea edi, [esp + 0x14]
mov byte [esp + 0x17], al
mov byte [esp + 0x1b], dl
inc esi
call fcn.0057bf60
mov edx, edi
mov ecx, 0xc1
mov edi, 0x12
xor byte [edx], cl
mov ebp, ecx
movzx cx, ch
and ebp, 0x1ff
or cx, word [ebp*2 + 0xa7b460]
inc edx
dec edi
jne 0x57cb68
test eax, eax
jne 0x57cbc8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1e]
mov dword [ebx], eax
mov eax, dword [esp + 0x22]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x64]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 8], edx
mov edx, dword [ecx]
inc eax
sar edx, 4
add ebx, 0x10
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x57cac4
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x50
ret
pop edi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop esi
add esp, 0x50
ret
or eax, 0xffffffff
pop esi
add esp, 0x50
ret
Function at 0x5b30b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x93e10a
call fcn.006f788c
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0xc]
mov dword [esi], 0xb6af90
lea edi, [esi + 4]
mov ecx, ebx
mov dword [ebp - 0x10], esi
mov dword [edi], 0xb61e58
call fcn.004c40f3
and dword [ebp - 4], 0
mov dword [esi + 0x1c], int.00b61e74
mov ecx, esi
mov dword [esi + 8], edi
mov dword [esi + 0x28], ebx
mov byte [esi + 0x30], 0
call fcn.005b2910
push dword [ebp + 8]
mov ecx, esi
push esi
call fcn.005b2990
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x5b30bc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x93e10a
call fcn.006f788c
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0xc]
mov dword [esi], 0xb6af90
lea edi, [esi + 4]
mov ecx, ebx
mov dword [ebp - 0x10], esi
mov dword [edi], 0xb61e58
call fcn.004c40f3
and dword [ebp - 4], 0
mov dword [esi + 0x1c], int.00b61e74
mov ecx, esi
mov dword [esi + 8], edi
mov dword [esi + 0x28], ebx
mov byte [esi + 0x30], 0
call fcn.005b2910
push dword [ebp + 8]
mov ecx, esi
push esi
call fcn.005b2990
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x5b32f0
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x93e261
call fcn.006f788c
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
lea ecx, [esi + 0x30]
mov dword [ebp - 0x10], esi
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x64]
mov dword [ebp - 4], edi
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 1
call fcn.005b2ef0
push edi
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 2
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 3
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x134]
mov byte [ebp - 4], 4
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 5
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x19c]
mov byte [ebp - 4], 6
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 7
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x204]
mov byte [ebp - 4], 8
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x238]
mov byte [ebp - 4], 9
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x26c]
mov byte [ebp - 4], 0xa
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x2a0]
mov byte [ebp - 4], 0xb
call fcn.005b2ef0
push edi
lea ecx, [esi + 0x2d4]
mov byte [ebp - 4], 0xc
call fcn.004c4370
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x5c5731
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.004c26dc
cmp word [eax], 0x5a4d
je 0x5c5752
push 0xb6ebf0
call fcn.00705cf1
pop ecx
xor eax, eax
leave
ret
push esi
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
je 0x5c576f
push 0xb6eb58
call fcn.00705cf1
pop ecx
xor eax, eax
jmp 0x5c57e0
lea eax, [ebp - 4]
push eax
push 4
push dword [esi + 0x54]
push 0
call fcn.004c26dc
push eax
call fcn.004c2618
test eax, eax
jne 0x5c5790
push 0xb6eac0
jmp 0x5c5765
test edi, edi
mov eax, 0x400
je 0x5c57ab
mov cx, word [esi + 0x5e]
and cx, ax
sub cx, ax
neg cx
sbb ecx, ecx
inc ecx
mov dword [edi], ecx
cmp dword [ebp + 8], 0
je 0x5c57b7
or word [esi + 0x5e], ax
jmp 0x5c57bb
and byte [esi + 0x5f], 0xfb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 0x54]
push 0
call fcn.004c26dc
push eax
call fcn.004c2618
test eax, eax
jne 0x5c57dd
push 0xb6ea28
jmp 0x5c5765
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x5c6570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
push ebx
push ecx
push edx
push esi
push edi
push 0x5c65ed
pop dword [0xad0b70]
push 0x5c6613
push dword fs:[0]
mov dword fs:[0], esp
push 0
call fcn.004c0ee4
mov esi, eax
mov eax, dword [esi + 0x3c]
add eax, esi
add esi, dword [eax + 0x50]
cmp word [esi], 0x5a4d
jne 0x5c65ed
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x5c65ed
movzx ebx, word [eax + 0x16]
xor ecx, ecx
test ebx, 0x2000
je 0x5c65ea
cmp dword [eax + 0x78], 0
je 0x5c65ea
mov ebx, dword [eax + 0x78]
add ebx, esi
mov ecx, dword [ebx + 0xc]
jcxz 0x5c65dd
add ecx, esi
pushal
push esi
push dword [eax + 0x50]
push ecx
call dword [ebp + 8]
add esp, 0xc
popal
add esi, dword [eax + 0x50]
and esi, 0xffff0000
add esi, 0x10000
cmp esi, 0xc0000000
jb 0x5c65a8
pop dword fs:[0]
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 4

Function at 0x6df2b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push esi
mov esi, dword [ebp + 8]
push 8
lea eax, [ebp - 8]
push esi
push eax
call fcn.006f6980
add esp, 0xc
xor eax, eax
mov cl, byte [esi + eax + 8]
xor byte [ebp + eax - 8], cl
inc eax
cmp eax, 8
jb 0x6df2d2
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 8]
push eax
call fcn.005344ed
push 8
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.006f6cc0
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0x14]
push 8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.007df620
add esp, 0x30
pop esi
leave
ret
Function at 0x7008a3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x7008d1
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x7008d8
cmp ebx, dword [eax + 4]
jae 0x7008d8
xor eax, eax
jmp 0x700ac8
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x7008e9
xor eax, eax
inc eax
jmp 0x700ac7
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x7008ff
cmp ecx, edx
jae 0x700a44
cmp dword [eax + 4], 0
je 0x700908
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x7008f0
cmp dword [ebp + 8], 0
je 0x70092a
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x700a44
cmp eax, esi
jae 0x700a44
mov eax, dword [0x9b22b0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x70094f
cmp dword [esi*4 + 0x9b22b8], edi
je 0x700a48
inc esi
cmp esi, eax
jl 0x70093d
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0xbba6ff]
test eax, eax
je 0x700ac4
cmp dword [ebp - 8], 0x1000000
jne 0x700ac4
test byte [ebp - 0xc], 0xcc
je 0x7009cd
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x700ac4
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x700ac4
cmp word [eax + 0x18], 0x10b
jne 0x700ac4
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x700ac4
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x7009cd
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x7009cd
test byte [ecx + 0x27], 0x80
jne 0x700a44
push 1
push 0x9b22f8
call dword [0xbba67f]
test eax, eax
jne 0x7008e1
mov ecx, dword [0x9b22b0]
test ecx, ecx
mov edx, ecx
jle 0x700a01
lea eax, [ecx*4 + 0x9b22b4]
cmp dword [eax], edi
je 0x700a01
dec edx
sub eax, 4
test edx, edx
jg 0x7009f5
test edx, edx
jne 0x700a32
push 0xf
pop ebx
cmp ecx, ebx
jg 0x700a0e
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x700a26
lea eax, [edx*4 + 0x9b22b8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x700a14
cmp ecx, 0x10
jge 0x700a32
inc ecx
mov dword [0x9b22b0], ecx
push 0
push 0x9b22f8
call dword [0xbba67f]
jmp 0x7008e1
xor eax, eax
jmp 0x700ac7
test esi, esi
jle 0x7008e1
mov ebx, dword [0xbba67f]
push 1
push 0x9b22f8
call ebx
test eax, eax
jne 0x7008e1
cmp dword [esi*4 + 0x9b22b8], edi
je 0x700a9e
mov eax, dword [0x9b22b0]
lea esi, [eax - 1]
test esi, esi
jl 0x700a8c
cmp dword [esi*4 + 0x9b22b8], edi
je 0x700a88
dec esi
jns 0x700a7c
test esi, esi
jge 0x700a9c
cmp eax, 0x10
jge 0x700a97
inc eax
mov dword [0x9b22b0], eax
lea esi, [eax - 1]
jmp 0x700a9e
je 0x700ab6
xor ecx, ecx
test esi, esi
jl 0x700ab6
lea eax, [ecx*4 + 0x9b22b8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x700aa4
push 0
push 0x9b22f8
call ebx
jmp 0x7008e1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x705f57
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x708180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
lea eax, [ebp - 0x70]
push eax
call fcn.00705f57
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push dword [ebp + 8]
push eax
call fcn.0070682e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.007068ce
push edi
push 0
push dword [ebp + 0x10]
call fcn.006f6cc0
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
add esp, 0x24
push ebx
neg ecx
push esi
test edi, edi
jle 0x7081e3
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], edi
lea eax, [ecx + esi]
cdq
push 0x10
pop ebx
idiv ebx
mov al, byte [ebp + edx - 0x18]
xor byte [esi], al
inc esi
dec dword [ebp - 8]
jne 0x7081ce
add dword [ebp - 4], edi
add ecx, edi
cmp dword [ebp - 4], 0x10
jl 0x7081c4
pop esi
pop ebx
leave
ret
Function at 0x728b8c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp dword [eax], edx
jae 0x728b9c
push 3
pop eax
ret
test edx, edx
jbe 0x728bba
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
push esi
sub eax, ecx
mov esi, edx
mov dl, byte [eax + ecx]
xor dl, 0x41
mov byte [ecx], dl
inc ecx
dec esi
jne 0x728bad
pop esi
xor eax, eax
ret

Function at 0x72bcbb
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x94f5d9
call fcn.006f788c
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
push 0xc
pop ecx
mov esi, eax
mov edi, ebx
add eax, 0x30
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x30]
mov dword [ebp - 0x10], ebx
call fcn.005b3120
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push eax
lea ecx, [ebx + 0x64]
call fcn.005b3120
lea eax, [esi + 0x98]
push eax
lea ecx, [ebx + 0x98]
mov byte [ebp - 4], 1
call fcn.005b3120
lea eax, [esi + 0xcc]
push eax
lea ecx, [ebx + 0xcc]
mov byte [ebp - 4], 2
call fcn.005b3120
lea eax, [esi + 0x100]
push eax
lea ecx, [ebx + 0x100]
mov byte [ebp - 4], 3
call fcn.005b3120
lea eax, [esi + 0x134]
push eax
lea ecx, [ebx + 0x134]
mov byte [ebp - 4], 4
call fcn.005b3120
lea eax, [esi + 0x168]
push eax
lea ecx, [ebx + 0x168]
mov byte [ebp - 4], 5
call fcn.005b3120
lea eax, [esi + 0x19c]
push eax
lea ecx, [ebx + 0x19c]
mov byte [ebp - 4], 6
call fcn.005b3120
lea eax, [esi + 0x1d0]
push eax
lea ecx, [ebx + 0x1d0]
mov byte [ebp - 4], 7
call fcn.005b3120
lea eax, [esi + 0x204]
push eax
lea ecx, [ebx + 0x204]
mov byte [ebp - 4], 8
call fcn.005b3120
lea eax, [esi + 0x238]
push eax
lea ecx, [ebx + 0x238]
mov byte [ebp - 4], 9
call fcn.005b3120
lea eax, [esi + 0x26c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebx + 0x26c]
call fcn.005b3120
lea eax, [esi + 0x2a0]
push eax
lea ecx, [ebx + 0x2a0]
mov byte [ebp - 4], 0xb
call fcn.005b3120
add esi, 0x2d4
push esi
lea ecx, [ebx + 0x2d4]
mov byte [ebp - 4], 0xc
call fcn.004c446c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x746650
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9543d6
call fcn.006f788c
sub esp, 0x40
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call fcn.00741440
sub esp, 0x34
mov edi, eax
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
mov dword [ebp - 0x14], edi
call fcn.004c4608
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.007450f0
and dword [ebp - 4], 0
push eax
mov ecx, eax
call fcn.004c4244
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], eax
call fcn.0053476c
push dword [ebp + 8]
mov ecx, esi
call fcn.00740760
xor esi, esi
test eax, eax
mov dword [ebp - 0x18], eax
jbe 0x7466d7
xor edx, edx
mov eax, esi
div dword [ebp - 0x10]
mov eax, esi
push 4
pop ebx
mov ecx, edx
cdq
idiv ebx
mov eax, dword [ebp + 8]
add cl, byte [edx + ebp - 0x14]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x7466b6
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x747170
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x954629
call fcn.006f788c
sub esp, 0x34
push esi
push edi
mov esi, dword [ebp + 8]
push 0x30
add ecx, 0x1338
push ecx
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.006f6980
add esp, 0xc
lea ecx, [esi + 0x30]
push 0xca39f342
push ecx
call fcn.005b2990
lea ecx, [esi + 0x64]
push 0xdd19dae9
push ecx
call fcn.005b2990
lea ecx, [esi + 0x98]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x100]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0xcc]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x134]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x1d0]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x204]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x238]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x26c]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x2a0]
push edi
push ecx
call fcn.005b2990
lea ecx, [esi + 0x2d4]
push edi
push ecx
call fcn.0075c1ce
lea ecx, [esi + 0x168]
push 0xddac5c5b
push ecx
call fcn.005b2990
sub esp, 0x34
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.005b3120
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0x19c]
call fcn.005b33f0
lea ecx, [ebp - 0x30]
call fcn.0053476c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1c]
call fcn.0053476c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
leave
ret 0x38

Function at 0x774dc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
je 0x774e22
mov al, byte [esi]
test al, al
je 0x774e22
mov dword [ebp + 8], 0x100
push ebx
movsx eax, al
or eax, dword [ebp + 8]
add dword [ebp + 8], 0x100
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
push 0x20
pop ecx
sub ecx, edx
mov ebx, edi
shr ebx, cl
mov ecx, edx
shl edi, cl
mov ecx, eax
imul ecx, eax
or ebx, edi
xor ebx, ecx
inc esi
mov al, byte [esi]
test al, al
mov edi, ebx
jne 0x774de2
mov eax, edi
shr eax, 0x10
xor eax, edi
pop ebx
jmp 0x774e24
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x78bac5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0x18
pop eax
call fcn.006f8060
mov eax, dword [ebp + 0x24]
and dword [ebp - 4], 0
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 0x20]
movzx ecx, byte [esi]
push edi
mov edi, dword [eax]
lea eax, [esi + 1]
mov dh, byte [eax]
mov dword [ebp - 8], eax
xor ebx, ebx
or ecx, edx
inc eax
movzx edx, byte [eax]
shl edx, 0x10
or ecx, edx
inc eax
movzx edx, byte [eax]
shl edx, 0x18
or ecx, edx
inc eax
movzx edx, byte [eax]
inc eax
mov bh, byte [eax]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x10], cl
or edx, ebx
inc eax
xor ebx, ebx
mov bh, byte [eax + 1]
mov bl, byte [eax]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xe], al
shl ebx, 0x10
or edx, ebx
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 0x14], edx
mov byte [ebp - 0xc], dl
je 0x78bc10
mov dword [ebp + 0x20], eax
test edi, edi
jne 0x78bbba
push dword [ebp + 0x1c]
lea eax, [ebp - 0x18]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call fcn.00934da4
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, eax
shr ebx, 8
mov byte [ebp - 0xf], bl
mov ebx, eax
mov ecx, eax
mov byte [ebp - 0x10], al
shr ebx, 0x10
shr eax, 0x18
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], al
mov eax, edx
mov ebx, eax
shr ebx, 8
mov byte [ebp - 0xb], bl
mov ebx, eax
mov byte [ebp - 0xc], al
shr ebx, 0x10
shr eax, 0x18
add esp, 0x10
inc dword [ebp - 4]
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], al
mov al, byte [ebp + edi - 0x10]
mov ebx, dword [ebp + 8]
xor al, byte [ebx]
mov ebx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
inc dword [ebp + 8]
inc edi
and edi, 7
dec dword [ebp + 0x20]
mov byte [ebx], al
jne 0x78bb62
cmp dword [ebp - 4], 0
je 0x78bc10
mov byte [esi], cl
mov esi, dword [ebp - 8]
mov eax, ecx
shr eax, 8
mov byte [esi], al
inc esi
mov eax, ecx
shr eax, 0x10
mov byte [esi], al
inc esi
shr ecx, 0x18
mov byte [esi], cl
inc esi
mov byte [esi], dl
mov eax, edx
shr eax, 8
inc esi
mov byte [esi], al
mov eax, edx
inc esi
shr eax, 0x10
shr edx, 0x18
mov byte [esi], al
mov byte [esi + 1], dl
mov eax, dword [ebp + 0x24]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret