joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c399e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, 0x856cf4
lea edi, [ebp - 0x20]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp + 8], 0
jne 0x6c39c3
xor eax, eax
jmp 0x6c3a5c
mov edx, dword [ebp + 8]
shr edx, 3
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
and ecx, 7
mov dword [ebp - 8], ecx
push dword [ebp - 4]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x6c3a03
push dword [ebp - 4]
lea edx, [ebp - 0x20]
push edx
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x6c3a5c
mov byte [ebp - 0xd], 0x80
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jae 0x6c3a33
mov ecx, 8
sub ecx, dword [ebp - 0xc]
mov bl, 1
shl bl, cl
and bl, byte [ebp - 0xd]
xor byte [ebp - 0xd], bl
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jb 0x6c3a16
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov al, byte [edx + ecx]
and al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
mov byte [ebp + edx - 0x20], al
mov ecx, dword [ebp - 4]
inc ecx
push ecx
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6c3a63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + edx]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x6c3a6c
xor eax, eax
pop ecx
pop ebp
ret

Function at 0x6c4836
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0xf0
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
lea eax, [ecx + ebx*4]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + edx]
and ecx, dword [ebp - 0x10]
sar ecx, 4
shl ecx, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
lea edx, [ebx + eax*4]
mov eax, dword [ebp - 8]
movzx edx, byte [edx + eax]
and edx, dword [ebp - 0xc]
lea ebx, [edx + str.cw]
mov al, byte [ebx + ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea edx, [edx + ecx*4]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4855
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x6c4850
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c48b1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0xf0
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
lea eax, [ecx + ebx*4]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + edx]
and ecx, dword [ebp - 0x10]
sar ecx, 4
shl ecx, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
lea edx, [ebx + eax*4]
mov eax, dword [ebp - 8]
movzx edx, byte [edx + eax]
and edx, dword [ebp - 0xc]
lea ebx, [edx + 0x856ea4]
mov al, byte [ebx + ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea edx, [edx + ecx*4]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c48d0
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x6c48cb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c4a38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov dl, byte [eax + 0x856fa4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 4]
xor dl, byte [ecx + 0x8570a4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx + eax + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx + eax + 0xc]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x18], dl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx + 4]
mov dl, byte [eax + 0x856fa4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor dl, byte [eax + ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 8]
xor dl, byte [ecx + 0x8570a4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx + eax + 0xc]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x14], dl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + edx + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 8]
xor al, byte [edx + 0x856fa4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + ecx + 0xc]
xor al, byte [ecx + 0x8570a4]
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x10], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax]
mov dl, byte [eax + 0x8570a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor dl, byte [eax + ecx + 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor dl, byte [eax + ecx + 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 0xc]
xor dl, byte [ecx + 0x856fa4]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xc], dl
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4a43
xor edx, edx
mov dword [ebp - 4], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
lea edx, [ebp + eax*4 - 0x18]
mov ecx, dword [ebp - 8]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ecx + edx*4]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4b4c
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x6c4b47
mov esp, ebp
pop ebp
ret
Function at 0x6c4b7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov dl, byte [eax + 0x8574a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 4]
xor dl, byte [ecx + 0x8572a4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax + 8]
xor dl, byte [eax + 0x8573a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 0xc]
xor dl, byte [ecx + 0x8571a4]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x18], dl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov dl, byte [eax + 0x8571a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 4]
xor dl, byte [ecx + 0x8574a4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax + 8]
xor dl, byte [eax + 0x8572a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 0xc]
xor dl, byte [ecx + 0x8573a4]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x14], dl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov dl, byte [eax + 0x8573a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 4]
xor dl, byte [ecx + 0x8571a4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax + 8]
xor dl, byte [eax + 0x8574a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 0xc]
xor dl, byte [ecx + 0x8572a4]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x10], dl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov dl, byte [eax + 0x8572a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 4]
xor dl, byte [ecx + 0x8573a4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax + 8]
xor dl, byte [eax + 0x8571a4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + ecx + 0xc]
xor dl, byte [ecx + 0x8574a4]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xc], dl
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4b89
xor edx, edx
mov dword [ebp - 4], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
lea edx, [ebp + eax*4 - 0x18]
mov ecx, dword [ebp - 8]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ecx + edx*4]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4ccc
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x6c4cc7
mov esp, ebp
pop ebp
ret
Function at 0x6c4cfe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea eax, [ecx + ebx*4]
mov edx, dword [ebp - 4]
mov cl, byte [eax + edx]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
lea edx, [ebx + eax*4]
mov eax, dword [ebp - 8]
xor byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x6c4d0f
inc dword [ebp + 0x10]
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4d0a
xor eax, eax
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6c4d49
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov eax, dword [ebp + 0x10]
add eax, 6
mov dword [ebp - 0x10], eax
mov edx, dword [0x8575c4]
mov dword [ebp - 0x14], edx
mov ecx, dword [0x8575c8]
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 4], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x6c4dac
push 4
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
shl ecx, 2
add ecx, dword [ebp + 0xc]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jb 0x6c4d82
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
jmp 0x6c4e8b
push 4
mov ecx, dword [ebp - 4]
dec ecx
shl ecx, 2
add ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0x10]
test edx, edx
jne 0x6c4e35
push 4
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x18]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call fcn.006c4efc
pop ecx
lea ecx, [ebp - 0x14]
push ecx
call fcn.006c4ea3
pop ecx
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0x10]
push eax
call fcn.006c4f95
add esp, 8
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x18]
mov ecx, dword [ebp - 8]
xor byte [ebp + ecx - 0x14], dl
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4e1c
jmp 0x6c4e52
cmp dword [ebp + 0x10], 6
jbe 0x6c4e52
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0x10]
cmp edx, 4
jne 0x6c4e52
lea ecx, [ebp - 0x14]
push ecx
call fcn.006c4ea3
pop ecx
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea eax, [ecx + edx*4]
mov edx, dword [ebp - 8]
mov cl, byte [eax + edx]
mov ebx, dword [ebp - 8]
xor cl, byte [ebp + ebx - 0x14]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
lea ebx, [eax + edx*4]
mov eax, dword [ebp - 8]
mov byte [ebx + eax], cl
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jb 0x6c4e57
inc dword [ebp - 4]
mov edx, dword [ebp - 0x10]
inc edx
shl edx, 2
cmp edx, dword [ebp - 4]
ja 0x6c4db7
mov eax, dword [ebp - 0x1c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c4ea3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0xf0
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
and eax, dword [ebp - 0xc]
sar eax, 4
shl eax, 4
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
and edx, dword [ebp - 8]
lea ecx, [edx + str.cw]
mov al, byte [ecx + eax]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [ecx + edx], al
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x6c4ebc
mov esp, ebp
pop ebp
ret
Function at 0x6e9d47
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, 0x40
sub edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x440], 0
jne 0x6e9d6f
jmp 0x6e9e12
mov eax, 0x20
sub eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x20
jae 0x6e9dd7
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x440]
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jl 0x6e9e12
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ebx, dword [edx + eax*4]
shl ebx, cl
mov ecx, dword [ebp - 0x20]
shr ebx, cl
mov dword [ebp - 8], ebx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
shr dword [edx + eax*4], cl
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
shl eax, cl
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
xor dword [ecx + edx*4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jge 0x6e9d93
jmp 0x6e9e12
mov edx, dword [ebp + 0xc]
shr edx, 5
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov edx, eax
shl edx, 0x1b
xor eax, eax
mov eax, edx
shr eax, 0x1b
xor edx, edx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.006c674e
add esp, 8
push dword [ebp - 0x1c]
push dword [ebp + 8]
call fcn.006e9d47
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6e9e17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x440], 0
jne 0x6e9e4b
mov eax, dword [ebp + 0xc]
shr eax, 5
push eax
push dword [ebp + 8]
call fcn.006dca7d
add esp, 8
jmp 0x6e9f43
cmp dword [ebp + 0xc], 0x20
jae 0x6e9f08
mov edx, 0x20
sub edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jae 0x6e9e8b
mov edx, dword [ebp - 0x10]
inc edx
mov ecx, dword [ebp + 0xc]
sub ecx, edx
mov ebx, 1
shl ebx, cl
xor dword [ebp - 0x20], ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jb 0x6e9e6d
mov ecx, dword [ebp - 0x1c]
shl dword [ebp - 0x20], cl
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x440]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + eax*4 - 4]
and ecx, dword [ebp - 0x20]
je 0x6e9ebc
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x440]
inc edx
push edx
push dword [ebp + 8]
call fcn.006dca7d
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
jmp 0x6e9ef8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + eax*4]
and ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
shl dword [edx + eax*4], cl
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
shr eax, cl
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
xor dword [ecx + edx*4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp edx, dword [eax + 0x440]
jb 0x6e9ec3
jmp 0x6e9f43
mov edx, dword [ebp + 0xc]
shr edx, 5
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov edx, eax
shl edx, 0x1b
xor eax, eax
mov eax, edx
shr eax, 0x1b
xor edx, edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.006c60c3
add esp, 8
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.006e9e17
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x75c12e
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0x86c594
push 0x86c58c
lea edx, [ebp - 8]
push edx
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x75c15e
mov eax, 0xfffffff4
jmp 0x75c19a
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.bcrypt.dll_BCryptGenRandom
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x75c17e
mov eax, 0xfffffff4
jmp 0x75c19a
push 0
push dword [ebp - 8]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x75c198
mov eax, 0xfffffff4
jmp 0x75c19a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x75c19e
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
push 0
push str.Microsoft_Primitive_Provider
push 0x86c5ce
lea edx, [ebp - 8]
push edx
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x75c1ce
mov eax, 0xfffffff4
jmp 0x75c20a
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.bcrypt.dll_BCryptGenRandom
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x75c1ee
mov eax, 0xfffffff4
jmp 0x75c20a
push 0
push dword [ebp - 8]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x75c208
mov eax, 0xfffffff4
jmp 0x75c20a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x785700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.0040b84c
mov edx, eax
mov eax, ebp
xor ecx, ecx
call fcn.0040bdf0
mov eax, dword [esp]
call fcn.0040b84c
mov edi, eax
test edi, edi
jle 0x785767
mov ebx, 1
mov eax, ebp
call fcn.0040b910
mov edx, dword [esp]
movzx edx, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x785732
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7857e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.0040b84c
mov edx, eax
mov eax, dword [esp]
xor ecx, ecx
call fcn.0040bdf0
mov eax, edi
call fcn.0040b84c
mov ebp, eax
test ebp, ebp
jle 0x785841
mov ebx, 1
mov eax, dword [esp]
call fcn.0040b910
movzx edx, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
movzx eax, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x785811
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x79976c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x799832
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x79506c]
call fcn.004093d4
mov ebx, eax
lea edx, [ebp - 8]
mov eax, edi
call fcn.00786660
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.0040b790
lea eax, [ebx + 0xc]
mov edx, edi
call fcn.0040b790
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x1c], eax
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x20], al
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x24], eax
test byte [ebp - 1], 2
setne al
and eax, 0x7f
mov edx, 0x7fffffff
sub edx, dword [ebp + 0x10]
imul edx
mov edx, 0x7fffffff
sub edx, eax
mov dword [ebx + 0x28], edx
movzx eax, word [ebp + 0xc]
mov dword [ebx + 0x2c], eax
test byte [ebp - 1], 4
setne al
xor al, 1
and eax, 0x7f
mov edx, eax
neg eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
mov edx, ebx
mov eax, esi
call fcn.007995f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x799839
lea eax, [ebp - 8]
call fcn.0040b384
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40673a
pop dword [ebp - 0x40]
mov eax, 0xe47c33dc
add eax, 0x1bc4335e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x8e330a79
add dword [ebp - 0x50], 0xc01f3ad2
mov dword [ebp - 0x4c], 0xbb358f2d
add dword [ebp - 0x4c], 0x76fdbd18
mov dword [ebp - 0x48], 0xd7dcd1a1
sub dword [ebp - 0x48], 0x8b908d73
mov dword [ebp - 0x44], 0x2fc507a4
add dword [ebp - 0x44], 0xd03af85c
lea eax, [ebp - 0x50]
push eax
mov eax, 0x8cf74748
add eax, 0x734939bc
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x5df1bbc7
sub dword [ebp - 0x50], 0xe97f5271
mov dword [ebp - 0x4c], 0x5d5b4dd8
sub dword [ebp - 0x4c], 0x1beeec63
mov dword [ebp - 0x48], 0xba3f46c0
sub dword [ebp - 0x48], 0x56cfda54
mov dword [ebp - 0x44], 0xf006c526
add dword [ebp - 0x44], 0xff93ada
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3bdb5
push 0
call eax
mov ecx, 0x595d
xor edi, edi
add edi, eax
mov ebx, 0x29c61781
sub ebx, 0x297f3381
add ebx, dword [ebp - 0x40]
mov edx, 0xf667fe10
add edx, 0xa6ecb9cf
mov esi, dword [ebx]
sub dword [ebp - 4], 0x7208dee
sub esi, edx
sub dword [ebp - 0x24], edx
mov dword [edi], esi
xor dword [ebp - 0x28], 0x782e28d9
add edi, 4
add ebx, 0xa710fb6d
sub ebx, 0xa710fb69
loop 0x406853
add eax, 0x6be3840c
sub eax, 0x6be22bc5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x77ec2e3b
sub ecx, 0x77ac2e3b
add ecx, dword [ebp - 0x40]
call ebx
leave
ret