joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e101
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x4c
movzx edi, byte [eax + 4]
mov eax, edi
test al, al
je 0x55e135
movzx eax, byte [esi + 0x11]
cmp al, 5
je 0x55e120
cmp al, 3
ja 0x55e135
mov eax, esi
call fcn.0054ab91
mov edi, eax
test eax, eax
jne 0x55e220
movzx edi, byte [esi + 4]
mov ecx, dword [esi + 0xdc]
mov edx, dword [esi + 0xa4]
mov dword [esi + 0xd8], 0
mov eax, dword [esi + 0xa0]
mov ebp, dword [esi + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi]
mov dword [esp + 0x24], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ecx
lea eax, [edx + 0x78]
xor edx, edx
call fcn.00553df1
mov ebx, eax
test eax, eax
je 0x55e281
lea edx, [eax + 0x78]
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov eax, 0xffffffff
mov dword [ebx + 0x14], edx
mov edx, 0x101
mov word [ebx + 0x30], dx
mov edx, edi
test dl, dl
mov edx, 2
mov word [ebx + 0x28], ax
mov eax, dword [esp + 0x20]
cmovne edi, edx
mov dword [esp + 0x3c], 0x80006
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x28]
mov edx, edi
mov byte [ebx + 0x2b], dl
lea edx, [esp + 0x3c]
mov dword [ebx + 0x6c], eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], 0x80006
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [ecx + 0x18]
mov edi, eax
test eax, eax
jne 0x55e241
test byte [esp + 0x3c], 1
jne 0x55e271
mov eax, dword [ebp]
mov dword [esp], ebp
call dword [eax + 0x30]
test ah, 4
je 0x55e211
mov byte [ebx + 0x30], 0
test ah, 0x10
je 0x55e21a
mov byte [ebx + 0x31], 0
mov dword [esi + 0xd8], ebx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax]
test eax, eax
je 0x55e235
cmp dword [eax], 2
jle 0x55e235
mov eax, esi
call fcn.0055e071
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
xor edx, edx
call fcn.0054b051
mov ebp, dword [ebx + 8]
mov eax, dword [ebp]
test eax, eax
je 0x55e261
mov dword [esp], ebp
call dword [eax + 4]
mov dword [ebp], 0
mov dword [esp], ebx
call fcn.00547771
jmp 0x55e220
mov byte [ebx + 0x2e], 1
jmp 0x55e1ff
mov edi, 7
jmp 0x55e220
Function at 0x604331
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.00603bd1
Function at 0x630040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xd2d0]
test eax, eax
jne 0x63006c
cmp dword [ebp + 0xc], 0
je 0x630062
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, 0
jmp 0x630186
mov dword [esp], 0
call fcn.0062fff1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xd2d8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xd2d0]
add eax, edx
cmp dword [ebp - 0xc], eax
jl 0x63015d
mov dword [ebp - 0x30], 0x50
mov dword [ebp - 0x2c], 0x65656b15
mov dword [ebp - 0x28], 0x696c6170
mov dword [ebp - 0x24], 0x6c406576
mov dword [ebp - 0x20], 0x73736269
mov dword [ebp - 0x1c], 0x6f2e3268
mov dword [ebp - 0x18], 0x576772
mov dword [ebp - 0x10], 0x1b
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xd2d4]
mov eax, dword [ebp - 0x10]
sub eax, 1
mov byte [ebp + eax - 0x30], dl
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.006296d0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x63013b
cmp dword [ebp - 0x14], 0xffffffdb
je 0x63013b
mov dword [esp + 8], 0x9a1bdc
mov dword [esp + 4], 0xfffffff9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0061ac05
mov eax, dword [ebp - 0x14]
jmp 0x630186
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xd2d8], edx
cmp dword [ebp + 0xc], 0
je 0x630181
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xd2d0]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x630181
cmp dword [ebp + 0xc], 0
je 0x630181
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xd2d8]
sub eax, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xd2d0]
add edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x63021d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c8
call fcn.0085d581
sub esp, eax
mov dword [ebp - 0x1078], 0x6379784f
mov dword [ebp - 0x1074], 0x6d6f7268
mov dword [ebp - 0x1070], 0x63697461
mov dword [ebp - 0x106c], 0x776f6c42
mov dword [ebp - 0x1068], 0x68736966
mov dword [ebp - 0x1064], 0x74617753
mov dword [ebp - 0x1060], 0x616e7944
mov dword [ebp - 0x105c], 0x6574696d
mov dword [ebp - 0x10], 0x40
lea eax, [ebp - 0x1058]
mov dword [esp], eax
call fcn.00643015
mov eax, dword [ebp - 0x10]
movzx edx, ax
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1058]
mov dword [esp], eax
call fcn.0064320b
mov dword [ebp - 0xc], 0
jmp 0x63030c
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1058]
mov dword [esp], eax
call fcn.006430b2
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1058]
mov dword [esp], eax
call fcn.006430b2
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x3f
jle 0x6302ca
mov word [ebp - 0x109a], 0
mov dword [ebp - 0xc], 0
jmp 0x630352
lea eax, [ebp - 0x109a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x1078]
mov dword [esp], eax
call fcn.00643038
mov edx, dword [ebp - 0xc]
mov dword [ebp + edx*4 - 0x1098], eax
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 7
jle 0x630324
mov dword [ebp - 0xc], 0
jmp 0x630385
mov dword [esp + 8], 4
lea eax, [ebp - 0x1098]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1058]
mov dword [esp], eax
call fcn.0064343d
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x3f
jle 0x630361
mov dword [ebp - 0xc], 0
jmp 0x630417
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1098]
shr eax, 0x18
mov ecx, eax
mov eax, dword [ebp - 0xc]
shl eax, 2
lea edx, [eax + 3]
mov eax, dword [ebp + 0x10]
add eax, edx
mov edx, ecx
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1098]
shr eax, 0x10
mov ecx, eax
mov eax, dword [ebp - 0xc]
shl eax, 2
lea edx, [eax + 2]
mov eax, dword [ebp + 0x10]
add eax, edx
mov edx, ecx
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1098]
shr eax, 8
mov ecx, eax
mov eax, dword [ebp - 0xc]
shl eax, 2
lea edx, [eax + 1]
mov eax, dword [ebp + 0x10]
add eax, edx
mov edx, ecx
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x1098]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, eax
mov eax, dword [ebp + 0x10]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 7
jle 0x630397
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x1078]
mov dword [esp], eax
call fcn.0061b505
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x1098]
mov dword [esp], eax
call fcn.0061b505
mov dword [esp + 4], 0x1048
lea eax, [ebp - 0x1058]
mov dword [esp], eax
call fcn.0061b505
nop
leave
ret
Function at 0x6430b2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov word [ebp - 0x28], ax
mov word [ebp - 0xe], 0
mov word [ebp - 6], 0
jmp 0x64311b
movzx eax, word [ebp - 0x28]
lea edx, [ebp - 0xe]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00643038
mov dword [ebp - 0xc], eax
movzx edx, word [ebp - 6]
mov eax, dword [ebp + 8]
add edx, 0x400
mov eax, dword [eax + edx*4]
movzx ecx, word [ebp - 6]
xor eax, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
add ecx, 0x400
mov dword [eax + ecx*4], edx
movzx eax, word [ebp - 6]
add eax, 1
mov word [ebp - 6], ax
cmp word [ebp - 6], 0x11
jbe 0x6430ce
mov word [ebp - 0xe], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov word [ebp - 6], 0
jmp 0x643185
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0064207d
movzx ecx, word [ebp - 6]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add ecx, 0x400
mov dword [eax + ecx*4], edx
movzx eax, word [ebp - 6]
lea ecx, [eax + 1]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add ecx, 0x400
mov dword [eax + ecx*4], edx
add word [ebp - 6], 2
cmp word [ebp - 6], 0x11
jbe 0x64313e
mov word [ebp - 6], 0
jmp 0x6431fc
mov word [ebp - 8], 0
jmp 0x6431e9
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0064207d
movzx ebx, word [ebp - 6]
movzx ecx, word [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
shl ebx, 8
add ecx, ebx
mov dword [eax + ecx*4], edx
movzx ecx, word [ebp - 6]
movzx eax, word [ebp - 8]
lea ebx, [eax + 1]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
shl ecx, 8
add ecx, ebx
mov dword [eax + ecx*4], edx
add word [ebp - 8], 2
cmp word [ebp - 8], 0xff
jbe 0x64319c
movzx eax, word [ebp - 6]
add eax, 1
mov word [ebp - 6], ax
cmp word [ebp - 6], 3
jbe 0x643194
nop
nop
add esp, 0x30
pop ebx
pop ebp
ret
Function at 0x6b71d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x28
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + 4]
lea edi, [eax - 1]
mov dword [esp + 4], edi
test byte [edx + 0x10], 4
jne 0x6b7211
test eax, eax
je 0x6b7202
mov eax, dword [edx]
mov eax, dword [eax + edi*4]
shl edi, 5
mov dword [esp], eax
call fcn.006b7141
add eax, edi
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
not eax
mov ecx, dword [edx + 8]
and eax, edi
sar eax, 0x1f
mov dword [esp + 0x1c], ecx
not eax
mov dword [esp + 0x24], eax
test ecx, ecx
jle 0x6b7321
mov eax, dword [edx]
mov dword [esp + 8], 0
xor edi, edi
mov dword [esp + 0xc], 0
mov ebp, edi
mov dword [esp + 0x20], eax
lea esi, [esi]
lea esi, [esi]
mov eax, dword [esp + 4]
mov edi, dword [esp + 0x20]
xor eax, ebp
mov ecx, dword [edi + ebp*4]
mov edx, eax
sub eax, 1
not edx
mov dword [esp + 0x14], ecx
and eax, edx
cdq
mov eax, ecx
or dword [esp + 0xc], edx
shr eax, 0x10
mov dword [esp + 0x10], edx
mov edi, eax
xor eax, ecx
neg edi
sar edi, 0x1f
and eax, edi
and edi, 0x10
xor eax, ecx
mov esi, eax
shr esi, 8
mov ebx, esi
neg esi
mov ecx, esi
xor ebx, eax
sar ecx, 0x1f
and ebx, ecx
xor eax, ebx
mov ebx, eax
shr ebx, 4
mov esi, ebx
xor ebx, eax
neg esi
mov edx, esi
sar edx, 0x1f
and ebx, edx
xor eax, ebx
mov ebx, eax
shr ebx, 2
mov esi, ebx
xor ebx, eax
neg esi
sar esi, 0x1f
and ebx, esi
mov dword [esp + 0x18], ebx
xor ebx, ebx
cmp dword [esp + 0x14], 0
setne bl
and ecx, 8
and edx, 4
and esi, 2
add edi, ebx
add ebp, 1
add edi, ecx
add edi, edx
add edi, esi
mov esi, dword [esp + 0x18]
xor esi, eax
mov eax, dword [esp + 0xc]
shr esi, 1
neg esi
not eax
shr esi, 0x1f
and eax, 0x20
add eax, dword [esp + 8]
add esi, edi
and esi, dword [esp + 0x10]
add eax, esi
mov dword [esp + 8], eax
cmp ebp, dword [esp + 0x1c]
jne 0x6b7251
and eax, dword [esp + 0x24]
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x6b7202
Function at 0x6b8e21
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov ebx, dword [esp + 0xdc]
mov edi, dword [esp + 0xd8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0xd0]
mov dword [esp], eax
call fcn.006b8b21
test eax, eax
je 0x6b8fec
lea eax, [esp + 0x30]
cmp dword [esp + 0x18], 0x20
mov dword [esp + 0x1c], eax
ja 0x6b8fc1
mov eax, dword [esp + 0xd4]
mov esi, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
cmove eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi]
test eax, eax
cmove eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xd0]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6b9001
xor ebx, ebx
xor ebp, ebp
xor esi, esi
xor ecx, ecx
lea esi, [esi]
mov edx, dword [esp + 0xd4]
mov eax, ecx
sub eax, dword [edx + 4]
mov edx, dword [esp + 0x20]
sar eax, 0x1f
and eax, dword [edx + esi*4]
mov edx, ecx
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
setb bl
sub edx, dword [edi + 4]
movzx ebx, bl
sar edx, 0x1f
and edx, dword [eax + ebp*4]
mov eax, dword [esp + 0x14]
add eax, edx
mov edx, dword [esp + 0x1c]
adc ebx, 0
mov dword [edx + ecx*4], eax
mov edx, dword [esp + 0xd4]
add ecx, 1
mov eax, ecx
sub eax, dword [edx + 8]
shr eax, 0x1f
add esi, eax
mov eax, ecx
sub eax, dword [edi + 8]
shr eax, 0x1f
add ebp, eax
cmp dword [esp + 0x18], ecx
jne 0x6b8eb9
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], ebp
lea ebp, [edi + ebp*4]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00785761
mov ecx, edi
sub ebx, eax
lea esi, [esi]
nop
mov edx, dword [esi]
mov eax, dword [ecx]
add ecx, 4
add esi, 4
xor eax, edx
and eax, ebx
xor eax, edx
mov dword [esi - 4], eax
mov dword [ecx - 4], 0
cmp ebp, ecx
jne 0x6b8f51
mov eax, dword [esp + 0xd0]
mov edi, dword [esp + 0x18]
lea ebx, [esp + 0x30]
mov dword [eax + 4], edi
mov edi, dword [esp + 0x1c]
mov dword [eax + 0xc], 0
mov eax, 1
cmp edi, ebx
je 0x6b8fb5
mov dword [esp + 8], 0x5a
mov dword [esp + 4], 0x9b5d9c
mov dword [esp], edi
mov dword [esp + 0x14], eax
call fcn.0070ba91
mov eax, dword [esp + 0x14]
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0x9b5d9c
shl eax, 2
mov dword [esp], eax
call fcn.0070bac1
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x6b8e6e
add esp, 0xbc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00785761
jmp 0x6b8f6f
Function at 0x6b9711
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x3c
mov ecx, dword [ecx + 0x1c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ecx
test ecx, ecx
jne 0x6b9741
mov dword [eax + 4], 0
mov eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x28]
lea ebp, [ecx + ecx]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.006b8b21
test eax, eax
je 0x6b9891
mov esi, dword [esp + 0x28]
mov eax, dword [edi + 0x24]
xor dword [esi + 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x20], eax
mov eax, esi
mov esi, dword [esi]
mov edx, dword [eax + 4]
test ebp, ebp
jle 0x6b9798
mov eax, edx
mov ecx, ebp
sub ecx, edx
neg eax
lea edx, [esi + edx*4]
lea esi, [esi]
mov ebx, eax
sar ebx, 0x1f
and dword [edx + eax*4], ebx
add eax, 1
cmp ecx, eax
jne 0x6b9789
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [eax + 4], ebp
mov eax, dword [edi + 0x40]
xor edi, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
lea ebp, [eax*4]
test eax, eax
jle 0x6b98a1
lea esi, [esi]
mov eax, dword [esp + 0x24]
imul eax, dword [esi]
mov dword [esp], esi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00785021
mov ecx, dword [esi + ebp]
xor edx, edx
add eax, ebx
add eax, ecx
cmp ecx, eax
mov dword [esi + ebp], eax
setne dl
or ebx, edx
xor edx, edx
cmp ecx, eax
setae dl
add edi, 1
add esi, 4
and ebx, edx
cmp dword [esp + 0x1c], edi
jne 0x6b97c1
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.006b8b21
test eax, eax
je 0x6b9891
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xc]
mov esi, dword [edi]
mov dword [edi + 4], edx
mov dword [edi + 0xc], eax
mov edi, dword [ecx]
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], edx
add edi, ebp
mov dword [esp], esi
mov dword [esp + 8], eax
add ebp, edi
mov dword [esp + 4], edi
call fcn.00785761
sub ebx, eax
lea esi, [esi]
mov edx, dword [esi]
mov eax, dword [edi]
add edi, 4
add esi, 4
xor eax, edx
and eax, ebx
xor eax, edx
mov dword [esi - 4], eax
mov dword [edi - 4], 0
cmp edi, ebp
jne 0x6b9861
add esp, 0x3c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp], edi
call fcn.006b8b21
test eax, eax
je 0x6b9891
mov edx, dword [esp + 0x28]
mov dword [edi + 4], esi
mov eax, dword [edx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
add ebp, dword [edx]
mov dword [esp + 4], ebp
mov eax, dword [edi]
mov dword [esp], eax
call fcn.00785761
mov eax, 1
jmp 0x6b9739
Function at 0x7713c1
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x7713ec
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x7713d8
neg eax
shr eax, 0x1f
pop edi
pop esi
ret
Function at 0x81c751
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov eax, dword [ebx + 4]
mov edx, dword [esi + 4]
cmp eax, edx
jge 0x81c772
mov eax, edx
mov edx, ebx
mov ebx, esi
mov esi, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.006b8b21
test eax, eax
je 0x81c7f9
mov eax, dword [esi + 4]
test eax, eax
jle 0x81c809
mov eax, dword [esp + 0x30]
mov ebp, dword [ebx]
mov edi, dword [esi]
mov ecx, dword [eax]
xor eax, eax
lea esi, [esi]
nop
mov edx, dword [ebp + eax*4]
xor edx, dword [edi + eax*4]
mov dword [ecx + eax*4], edx
add eax, 1
cmp dword [esi + 4], eax
jg 0x81c7a1
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x81c7d9
mov edi, dword [esp + 0x30]
mov esi, dword [ebx]
mov ecx, dword [edi]
lea esi, [esi]
mov edx, dword [esi + eax*4]
mov dword [ecx + eax*4], edx
mov edx, dword [ebx + 4]
add eax, 1
cmp edx, eax
jg 0x81c7c9
mov eax, dword [esp + 0x30]
mov dword [eax + 4], edx
mov dword [esp], eax
call fcn.006b8cd1
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x81c7b3
Function at 0x835e31
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
test ebx, ebx
je 0x835ff1
mov edi, dword [ebx + 0x20]
test edi, edi
je 0x835ff1
mov esi, dword [ebx + 0x24]
test esi, esi
je 0x835ff1
mov esi, dword [ebx + 0x1c]
mov eax, 0xfffffffe
test esi, esi
je 0x835fe9
cmp ebx, dword [esi]
jne 0x835fe9
mov edx, dword [esi + 4]
mov edi, 1
cmp edx, 0x2a
lea ecx, [edx - 0x39]
setne al
and ecx, 0xffffffef
setne byte [esp + 0x1f]
cmp edx, 0x45
setne cl
mov ebp, ecx
lea ecx, [edx - 0x5b]
cmp ecx, 0x16
ja 0x835ea7
mov edi, 0x401001
shr edi, cl
not edi
and edi, 1
and eax, ebp
cmp edx, 0x29a
setne dl
and eax, edx
test byte [esp + 0x1f], al
je 0x835ec4
mov eax, edi
test al, al
jne 0x835ff1
mov eax, dword [esi + 8]
mov dword [ebx + 0x14], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x2c], 2
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], 0
test eax, eax
js 0x836001
cmp eax, 2
je 0x836021
test eax, eax
jne 0x83600d
mov eax, 0x71
mov dword [esi + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00832d21
mov dword [ebx + 0x30], eax
mov dword [esi + 0x28], 0
mov dword [esp], esi
call fcn.0083d051
mov ebx, dword [ebx + 0x1c]
xor ecx, ecx
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x4c]
add eax, eax
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x44]
mov word [eax + edx*2 - 2], cx
lea edx, [edx + edx - 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0086e9e1
mov eax, dword [ebx + 0x84]
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
lea eax, [eax + eax*2]
mov dword [ebx + 0x74], 0
shl eax, 2
mov dword [ebx + 0x78], 2
movzx edx, word [eax + 0xa0afa2]
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x16b4], 0
mov dword [ebx + 0x80], edx
movzx edx, word [eax + 0xa0afa0]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x8c], edx
movzx edx, word [eax + 0xa0afa4]
mov dword [ebx + 0x48], 0
movzx eax, word [eax + 0xa0afa6]
mov dword [ebx + 0x90], edx
mov dword [ebx + 0x7c], eax
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
mov eax, 0xfffffffe
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, eax
neg edx
mov dword [esi + 0x18], edx
cmp eax, 0xfffffffe
je 0x836021
mov eax, 0x2a
jmp 0x835f0e
mov dword [esi + 4], 0x39
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00840fd1
jmp 0x835f2d