joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4957cc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00487b01
xor ebx, ebx
cmp dword [0x713fe4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4958a2
push 0x4b0ae4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x495982
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b0ad8
push edi
call esi
cmp eax, ebx
je 0x495982
push eax
call fcn.00487a93
mov dword [esp], 0x4b0ac8
push edi
mov dword [0x713fe4], eax
call esi
push eax
call fcn.00487a93
mov dword [esp], 0x4b0ab4
push edi
mov dword [0x713fe8], eax
call esi
push eax
call fcn.00487a93
mov dword [0x713fec], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048a2c3
test eax, eax
pop ecx
pop ecx
je 0x495870
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00481ec8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4958a2
push 0x4b0a98
push edi
call esi
push eax
call fcn.00487a93
cmp eax, ebx
pop ecx
mov dword [0x713ff4], eax
je 0x4958a2
push 0x4b0a80
push edi
call esi
push eax
call fcn.00487a93
pop ecx
mov dword [0x713ff0], eax
mov eax, dword [0x713ff0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x495927
cmp dword [0x713ff4], ecx
je 0x495927
push eax
call fcn.00487b0a
push dword [0x713ff4]
mov esi, eax
call fcn.00487b0a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x495927
cmp edi, ebx
je 0x495927
call esi
cmp eax, ebx
je 0x4958f4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4958f4
test byte [ebp - 0x18], 1
jne 0x495927
lea eax, [ebp - 0x10]
push eax
call fcn.0048a2fa
test eax, eax
pop ecx
je 0x49590f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00481ec8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x49591e
or dword [ebp + 0x10], 0x200000
jmp 0x495962
or dword [ebp + 0x10], 0x40000
jmp 0x495962
mov eax, dword [0x713fe8]
cmp eax, dword [ebp - 8]
je 0x495962
push eax
call fcn.00487b0a
cmp eax, ebx
pop ecx
je 0x495962
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x495962
mov eax, dword [0x713fec]
cmp eax, dword [ebp - 8]
je 0x495962
push eax
call fcn.00487b0a
cmp eax, ebx
pop ecx
je 0x495962
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x713fe4]
call fcn.00487b0a
cmp eax, ebx
pop ecx
je 0x495982
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x495984
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x499c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
xor esi, esi
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [eax + 0x20]
add edi, ebx
cmp dword [eax + 0x18], esi
jbe 0x499c54
mov edx, dword [edi]
xor eax, eax
add edx, ebx
mov cl, byte [edx]
test cl, cl
je 0x499c43
ror eax, 7
lea edx, [edx + 1]
movsx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x499c32
cmp eax, dword [ebp - 8]
je 0x499c5d
mov eax, dword [ebp - 4]
inc esi
add edi, 4
cmp esi, dword [eax + 0x18]
jb 0x499c26
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
pop edi
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
pop esi
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499c80
Capabilities:
Accept command line arguments
Access peb ldr_data
Get kernel32 base address
Terminate process

Disassembly:
push 0x60
push 0x4b2198
call fcn.0048a538
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x483630
push 0x12
call fcn.00483580
pop ecx
jmp 0x4837ba
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x48364e
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4837ba
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x483680
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x7139ac], esi
mov dword [0x7139b4], eax
mov dword [0x7139b8], ecx
mov dword [0x7139bc], edx
mov dword [0x7139b0], edi
call fcn.004835a4
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.0048c8f7
pop ecx
test eax, eax
jne 0x4836c8
push 0x1c
call fcn.00483580
pop ecx
call fcn.00487e5f
test eax, eax
jne 0x4836d9
push 0x10
call fcn.00483580
pop ecx
call fcn.0048c854
mov dword [ebp - 4], ebx
call fcn.0048c600
test eax, eax
jge 0x4836f2
push 0x1b
call fcn.0048a21a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x715240], eax
call fcn.0048c4cb
mov dword [0x71360c], eax
call fcn.0048c412
test eax, eax
jge 0x483718
push 8
call fcn.0048a21a
pop ecx
call fcn.0048c19f
test eax, eax
jge 0x483729
push 9
call fcn.0048a21a
pop ecx
push ebx
call fcn.0048a336
pop ecx
test eax, eax
je 0x48373b
push eax
call fcn.0048a21a
pop ecx
call fcn.0048c142
test byte [ebp - 0x44], bl
je 0x48374b
movzx ecx, word [ebp - 0x40]
jmp 0x48374e
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call fcn.004578c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x48376b
push eax
call fcn.0048a4aa
call fcn.0048a4cc
jmp 0x4837a0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x4837bf
mov eax, 0xff
call fcn.0048a57d
ret
call fcn.0048c951
jmp 0x4835e5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, 0x3a577b9
call fcn.00499c00
call 0x499ca2
add dword [esp], 0x1e
call eax
cmp eax, 0xffffffff
jne 0x4837c5
ret
Function at 0x71ecfc
Capabilities:
Encode data using xor

Disassembly:
pop edx
mov ecx, dword [esp + 8]
jcxz 0x71ed25
mov eax, dword [esp + 0xc]
not eax
push esi
mov esi, dword [esp + 8]
push ebx
cmp ecx, 0xffffffff
je 0x71ed28
movzx ebx, byte [esi]
inc esi
xor bl, al
shr eax, 8
xor eax, dword [edx + ebx*4]
loop 0x71ed15
pop ebx
pop esi
not eax
ret
movzx ecx, byte [esi]
inc esi
jcxz 0x71ed23
xor cl, al
shr eax, 8
xor eax, dword [edx + ecx*4]
jmp 0x71ed28

Function at 0x71f504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x71f600
mov ebx, dword [ebp + 0x10]
lea esi, [eax + 0x78]
lea eax, [edi + ebx]
push esi
push eax
push edi
call fcn.0071f4b1
add esp, 0xc
test eax, eax
je 0x71f600
mov esi, dword [esi]
add esi, edi
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x71f600
cmp ecx, ebx
jae 0x71f600
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi + 0x24]
and dword [ebp - 4], 0
add eax, edi
add ebx, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 0xc], eax
lea eax, [ecx + edi]
jbe 0x71f600
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
push edi
call fcn.0071f4cc
add esp, 0xc
test al, al
je 0x71f5e9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
lea edx, [eax - 0x64]
cmp ecx, edx
jae 0x71f5e9
push dword [ebp - 8]
add eax, edi
push eax
push edi
call fcn.0071f4e8
add esp, 0xc
test al, al
je 0x71f5e9
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*4]
push eax
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
push edi
call fcn.0071f4cc
add esp, 0xc
test al, al
je 0x71f5e9
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 0
add eax, edi
push 0xffffffffffffffff
push eax
call fcn.0071e8f7
add esp, 0xc
cmp eax, dword [ebp + 0xc]
je 0x71f607
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 8], 2
add dword [ebp + 8], 4
cmp eax, dword [esi + 0x18]
jb 0x71f578
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp - 4]
movzx eax, word [ebx + eax*2]
je 0x71f61c
inc eax
push eax
push edi
call dword [ebp + 0x14]
jmp 0x71f602
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x71f602
Function at 0x71ff4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
test ecx, ecx
jne 0x71fff6
mov eax, dword [ebp + 8]
rol dword [eax + 8], 1
mov cl, byte [eax + 8]
mov edi, dword [eax]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 8], dl
movzx ecx, cl
inc edi
mov dword [eax], edi
mov dword [esi + 0x2004], ecx
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x2004]
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x2004], edx
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x2004]
movzx ecx, cl
shl edx, 8
add edx, ecx
mov dword [esi + 0x2004], edx
mov edi, dword [eax]
rol dword [eax + 8], 1
mov cl, byte [eax + 8]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov eax, dword [esi + 0x2004]
movzx ecx, cl
shl eax, 8
add eax, ecx
or dword [esi], 0xffffffff
mov dword [esi + 0x2004], eax
jmp 0x720085
mov eax, dword [esi + 4]
add ecx, eax
xor ecx, eax
mov eax, dword [ebp + 8]
mov ebx, 0xff000000
test ebx, ecx
jne 0x720043
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x2004]
shl dword [esi + 4], 8
shl dword [esi], 8
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x2004], edx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add edx, ecx
xor edx, ecx
test ebx, edx
je 0x720009
mov edx, 0x10000
jmp 0x720081
movzx ecx, word [esi + 4]
mov edi, edx
sub edi, ecx
shl edi, 8
mov dword [esi], edi
rol dword [eax + 8], 1
mov edi, dword [eax]
mov bl, byte [edi]
mov cl, byte [eax + 8]
add cl, bl
inc edi
mov dword [eax], edi
mov byte [eax + 8], bl
mov edi, dword [esi + 0x2004]
movzx ecx, cl
shl edi, 8
add edi, ecx
shl dword [esi + 4], 8
mov dword [esi + 0x2004], edi
cmp dword [esi], edx
jb 0x72004a
mov ecx, dword [esi + 8]
mov eax, dword [esi]
xor edx, edx
inc ecx
div ecx
mov ebx, dword [esi + 4]
xor edx, edx
mov ecx, esi
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x2004]
sub eax, ebx
div dword [ebp + 8]
push eax
call fcn.0071f32e
movzx edi, ax
mov eax, 0x400
cmp di, ax
jae 0x7200e0
push edi
mov ecx, esi
call fcn.0071f36e
imul eax, dword [ebp + 8]
add eax, ebx
mov dword [esi + 4], eax
movzx eax, di
mov eax, dword [esi + eax*4 + 0x1004]
imul eax, dword [ebp + 8]
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.0071fe2f
mov ax, di
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x7200f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
test ecx, ecx
jne 0x7201a3
mov eax, dword [ebp + 8]
rol dword [eax + 8], 1
mov cl, byte [eax + 8]
mov edi, dword [eax]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 8], dl
movzx ecx, cl
inc edi
mov dword [eax], edi
mov dword [esi + 0x84], ecx
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x84]
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x84], edx
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x84]
movzx ecx, cl
shl edx, 8
add edx, ecx
mov dword [esi + 0x84], edx
mov edi, dword [eax]
rol dword [eax + 8], 1
mov cl, byte [eax + 8]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov eax, dword [esi + 0x84]
movzx ecx, cl
shl eax, 8
add eax, ecx
or dword [esi], 0xffffffff
mov dword [esi + 0x84], eax
jmp 0x720232
mov eax, dword [esi + 4]
add ecx, eax
xor ecx, eax
mov eax, dword [ebp + 8]
mov ebx, 0xff000000
test ebx, ecx
jne 0x7201f0
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x84]
shl dword [esi + 4], 8
shl dword [esi], 8
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x84], edx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add edx, ecx
xor edx, ecx
test ebx, edx
je 0x7201b6
mov edx, 0x10000
jmp 0x72022e
movzx ecx, word [esi + 4]
mov edi, edx
sub edi, ecx
shl edi, 8
mov dword [esi], edi
rol dword [eax + 8], 1
mov edi, dword [eax]
mov bl, byte [edi]
mov cl, byte [eax + 8]
add cl, bl
inc edi
mov dword [eax], edi
mov byte [eax + 8], bl
mov edi, dword [esi + 0x84]
movzx ecx, cl
shl edi, 8
add edi, ecx
shl dword [esi + 4], 8
mov dword [esi + 0x84], edi
cmp dword [esi], edx
jb 0x7201f7
mov ecx, dword [esi + 8]
mov eax, dword [esi]
xor edx, edx
inc ecx
div ecx
mov ebx, dword [esi + 4]
xor edx, edx
mov ecx, esi
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x84]
sub eax, ebx
div dword [ebp + 8]
push eax
call fcn.0071f38e
movzx edi, ax
cmp di, 0x10
jae 0x720286
push edi
mov ecx, esi
call fcn.0071f3c5
imul eax, dword [ebp + 8]
add eax, ebx
mov dword [esi + 4], eax
movzx eax, di
mov eax, dword [esi + eax*4 + 0x44]
imul eax, dword [ebp + 8]
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.0071fe95
mov ax, di
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x72029f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
test ecx, ecx
jne 0x720349
mov eax, dword [ebp + 8]
rol dword [eax + 8], 1
mov cl, byte [eax + 8]
mov edi, dword [eax]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 8], dl
movzx ecx, cl
inc edi
mov dword [eax], edi
mov dword [esi + 0x80c], ecx
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x80c]
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x80c], edx
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x80c]
movzx ecx, cl
shl edx, 8
add edx, ecx
mov dword [esi + 0x80c], edx
mov edi, dword [eax]
rol dword [eax + 8], 1
mov cl, byte [eax + 8]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov eax, dword [esi + 0x80c]
movzx ecx, cl
shl eax, 8
add eax, ecx
or dword [esi], 0xffffffff
mov dword [esi + 0x80c], eax
jmp 0x7203d8
mov eax, dword [esi + 4]
add ecx, eax
xor ecx, eax
mov eax, dword [ebp + 8]
mov ebx, 0xff000000
test ebx, ecx
jne 0x720396
rol dword [eax + 8], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 8]
add cl, dl
mov byte [eax + 8], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x80c]
shl dword [esi + 4], 8
shl dword [esi], 8
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x80c], edx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add edx, ecx
xor edx, ecx
test ebx, edx
je 0x72035c
mov edx, 0x10000
jmp 0x7203d4
movzx ecx, word [esi + 4]
mov edi, edx
sub edi, ecx
shl edi, 8
mov dword [esi], edi
rol dword [eax + 8], 1
mov edi, dword [eax]
mov bl, byte [edi]
mov cl, byte [eax + 8]
add cl, bl
inc edi
mov dword [eax], edi
mov byte [eax + 8], bl
mov edi, dword [esi + 0x80c]
movzx ecx, cl
shl edi, 8
add edi, ecx
shl dword [esi + 4], 8
mov dword [esi + 0x80c], edi
cmp dword [esi], edx
jb 0x72039d
mov ecx, dword [esi + 8]
mov eax, dword [esi]
xor edx, edx
inc ecx
div ecx
mov ebx, dword [esi + 4]
xor edx, edx
mov ecx, esi
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x80c]
sub eax, ebx
div dword [ebp + 8]
push eax
call fcn.0071f3e2
movzx edi, ax
mov eax, 0x101
cmp di, ax
jae 0x720433
push edi
mov ecx, esi
call fcn.0071f427
imul eax, dword [ebp + 8]
add eax, ebx
mov dword [esi + 4], eax
movzx eax, di
mov eax, dword [esi + eax*4 + 0x408]
imul eax, dword [ebp + 8]
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.0071fef9
mov ax, di
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x721dd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x721ed2
mov ebx, dword [ebp + 0x10]
lea esi, [eax + 0x78]
lea eax, [edi + ebx]
push esi
push eax
push edi
call fcn.00721d83
add esp, 0xc
test eax, eax
je 0x721ed2
mov esi, dword [esi]
add esi, edi
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x721ed2
cmp ecx, ebx
jae 0x721ed2
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi + 0x24]
and dword [ebp - 4], 0
add eax, edi
add ebx, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 0xc], eax
lea eax, [ecx + edi]
jbe 0x721ed2
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
push edi
call fcn.00721d9e
add esp, 0xc
test al, al
je 0x721ebb
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
lea edx, [eax - 0x64]
cmp ecx, edx
jae 0x721ebb
push dword [ebp - 8]
add eax, edi
push eax
push edi
call fcn.00721dba
add esp, 0xc
test al, al
je 0x721ebb
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*4]
push eax
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
push edi
call fcn.00721d9e
add esp, 0xc
test al, al
je 0x721ebb
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 0
add eax, edi
push 0xffffffffffffffff
push eax
call fcn.00721b6f
add esp, 0xc
cmp eax, dword [ebp + 0xc]
je 0x721ed9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 8], 2
add dword [ebp + 8], 4
cmp eax, dword [esi + 0x18]
jb 0x721e4a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp - 4]
movzx eax, word [ebx + eax*2]
je 0x721eee
inc eax
push eax
push edi
call dword [ebp + 0x14]
jmp 0x721ed4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x721ed4
Function at 0x7220bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
test ecx, ecx
jne 0x722167
mov eax, dword [ebp + 8]
ror dword [eax + 4], 1
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 4], dl
movzx ecx, cl
inc edi
mov dword [eax], edi
mov dword [esi + 0x20004], ecx
ror dword [eax + 4], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 4]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x20004]
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x20004], edx
ror dword [eax + 4], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 4]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x20004]
movzx ecx, cl
shl edx, 8
add edx, ecx
mov dword [esi + 0x20004], edx
mov edi, dword [eax]
ror dword [eax + 4], 1
mov cl, byte [eax + 4]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov eax, dword [esi + 0x20004]
movzx ecx, cl
shl eax, 8
add eax, ecx
or dword [esi], 0xffffffff
mov dword [esi + 0x20004], eax
jmp 0x7221f6
mov eax, dword [esi + 4]
add ecx, eax
xor ecx, eax
mov eax, dword [ebp + 8]
mov ebx, 0xff000000
test ebx, ecx
jne 0x7221b4
ror dword [eax + 4], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 4]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x20004]
shl dword [esi + 4], 8
shl dword [esi], 8
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x20004], edx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add edx, ecx
xor edx, ecx
test ebx, edx
je 0x72217a
mov edx, 0x10000
jmp 0x7221f2
movzx ecx, word [esi + 4]
mov edi, edx
sub edi, ecx
shl edi, 8
mov dword [esi], edi
ror dword [eax + 4], 1
mov edi, dword [eax]
mov bl, byte [edi]
mov cl, byte [eax + 4]
add cl, bl
inc edi
mov dword [eax], edi
mov byte [eax + 4], bl
mov edi, dword [esi + 0x20004]
movzx ecx, cl
shl edi, 8
add edi, ecx
shl dword [esi + 4], 8
mov dword [esi + 0x20004], edi
cmp dword [esi], edx
jb 0x7221bb
mov ecx, dword [esi + 8]
mov eax, dword [esi]
xor edx, edx
inc ecx
div ecx
mov ebx, dword [esi + 4]
xor edx, edx
mov ecx, esi
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x20004]
sub eax, ebx
div dword [ebp + 8]
push eax
call fcn.00721c1b
movzx edi, ax
mov eax, 0x4000
cmp di, ax
jae 0x722251
push edi
mov ecx, esi
call fcn.00721c4d
imul eax, dword [ebp + 8]
add eax, ebx
mov dword [esi + 4], eax
movzx eax, di
mov eax, dword [esi + eax*4 + 0x10004]
imul eax, dword [ebp + 8]
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.00721f94
mov ax, di
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x72226a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
test ecx, ecx
jne 0x722314
mov eax, dword [ebp + 8]
ror dword [eax + 4], 1
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 4], dl
movzx ecx, cl
inc edi
mov dword [eax], edi
mov dword [esi + 0x804], ecx
ror dword [eax + 4], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 4]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x804]
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x804], edx
ror dword [eax + 4], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 4]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x804]
movzx ecx, cl
shl edx, 8
add edx, ecx
mov dword [esi + 0x804], edx
mov edi, dword [eax]
ror dword [eax + 4], 1
mov cl, byte [eax + 4]
mov dl, byte [edi]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov eax, dword [esi + 0x804]
movzx ecx, cl
shl eax, 8
add eax, ecx
or dword [esi], 0xffffffff
mov dword [esi + 0x804], eax
jmp 0x7223a3
mov eax, dword [esi + 4]
add ecx, eax
xor ecx, eax
mov eax, dword [ebp + 8]
mov ebx, 0xff000000
test ebx, ecx
jne 0x722361
ror dword [eax + 4], 1
mov edi, dword [eax]
mov dl, byte [edi]
mov cl, byte [eax + 4]
add cl, dl
mov byte [eax + 4], dl
inc edi
mov dword [eax], edi
mov edx, dword [esi + 0x804]
shl dword [esi + 4], 8
shl dword [esi], 8
shl edx, 8
movzx ecx, cl
add edx, ecx
mov dword [esi + 0x804], edx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add edx, ecx
xor edx, ecx
test ebx, edx
je 0x722327
mov edx, 0x10000
jmp 0x72239f
movzx ecx, word [esi + 4]
mov edi, edx
sub edi, ecx
shl edi, 8
mov dword [esi], edi
ror dword [eax + 4], 1
mov edi, dword [eax]
mov bl, byte [edi]
mov cl, byte [eax + 4]
add cl, bl
inc edi
mov dword [eax], edi
mov byte [eax + 4], bl
mov edi, dword [esi + 0x804]
movzx ecx, cl
shl edi, 8
add edi, ecx
shl dword [esi + 4], 8
mov dword [esi + 0x804], edi
cmp dword [esi], edx
jb 0x722368
mov ecx, dword [esi + 8]
mov eax, dword [esi]
xor edx, edx
inc ecx
div ecx
mov ebx, dword [esi + 4]
xor edx, edx
mov ecx, esi
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x804]
sub eax, ebx
div dword [ebp + 8]
push eax
call fcn.00721c6d
movzx edi, ax
mov eax, 0x100
cmp di, ax
jae 0x7223fe
push edi
mov ecx, esi
call fcn.00721c9f
imul eax, dword [ebp + 8]
add eax, ebx
mov dword [esi + 4], eax
movzx eax, di
mov eax, dword [esi + eax*4 + 0x404]
imul eax, dword [ebp + 8]
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.00721fff
mov ax, di
pop edi
pop esi
pop ebx
pop ebp
ret 4