joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7eeca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
test byte [edx + 7], 0x40
je 0x7eee66
mov ebp, dword [esp + 0x14]
mov esi, ecx
test byte [ebp + 6], 8
jne 0x7eecc6
mov eax, dword [esi]
cmp byte [eax + 0x20], 0
js 0x7eee66
mov edi, fcn.007a5c70
xor eax, eax
movzx edx, byte [0xbb02f7]
imul edi, edi
and edi, 3
cmp edi, 3
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x7eee55
mov al, byte [0xbb02f7]
xor ecx, ecx
cmp edi, 3
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb02f7], ah
jne 0x7eecf7
mov ecx, fcn.007a5c70
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7eed67
xor eax, eax
cmp ecx, 3
movzx edi, byte [0xbb02f7]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 2]
bt edi, eax
jae 0x7eed45
jmp 0x7eee55
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbb02f7]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x7eee2c
mov ecx, fcn.007a5c70
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0x505
lea ecx, [eax + ecx*2 - 0x4e80dd56]
mov eax, dword [0xbb02e0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb02e0], eax
not eax
imul edx, eax
mov eax, dword [0xbb02e4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb02e4], eax
or edi, edx
not eax
mov edx, dword [str._gX]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [str._gX], edx
or edi, eax
not edx
mov eax, dword [0xbb02ec]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb02ec], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbb02f0], eax
or byte [0xbb02f7], dl
mov eax, fcn.007a5c70
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb02f7], al
push dword [ebp + 0x20]
push 0xbb02e0
push esi
call fcn.00782570
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7ef1f0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x24], 0
jne 0x7ef45e
push ebp
push ebx
push edi
push esi
mov ebx, 0x835860
mov ebp, 0x835860
mov esi, ecx
movzx ecx, byte [0xbb0333]
mov edi, dword [esp + 0x14]
or ebx, 2
xor ebp, 2
mov eax, ebx
add eax, ebp
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7ef44a
mov al, byte [0xbb0333]
mov ecx, ebx
mov ah, 1
add ecx, ebp
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb0333], ah
jne 0x7ef237
mov ecx, 0x835860
mov ebx, 0x835860
or ecx, 2
xor ebx, 2
mov ebp, ecx
add ebp, ebx
sete ah
not ah
and ah, 3
xor ah, 7
movzx ebp, ah
movzx eax, al
bt eax, ebp
jae 0x7ef29f
mov eax, ecx
movzx ebp, byte [0xbb0333]
add eax, ebx
sete al
not al
and al, 3
movzx eax, al
bt ebp, eax
jae 0x7ef280
jmp 0x7ef44a
add ecx, ebx
movzx ecx, byte [0xbb0333]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7ef423
mov eax, 0x835860
mov ebx, 0x835860
xor ecx, ecx
xor ebx, 2
or eax, 2
add eax, ebx
mov eax, dword [0xbb0300]
sete cl
xor ecx, 0x7b31c663
add ecx, 0x1318
mov ebx, ecx
xor eax, ecx
shr ebx, 0x1f
mov dword [0xbb0300], eax
not eax
or ebx, ecx
and cl, 7
imul ebx, eax
mov eax, dword [0xbb0304]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbb0304], eax
or ebp, ebx
not eax
mov ebx, dword [0xbb0308]
imul eax, ebp
lea ebp, [eax*4]
xor ebx, eax
shr eax, 0x1d
mov dword [0xbb0308], ebx
or ebp, eax
not ebx
mov eax, dword [0xbb030c]
imul ebx, ebp
lea ebp, [ebx*8]
xor eax, ebx
shr ebx, 0x1c
mov dword [0xbb030c], eax
or ebp, ebx
not eax
mov ebx, dword [0xbb0310]
imul eax, ebp
mov ebp, eax
shl ebp, 4
xor ebx, eax
shr eax, 0x1b
mov dword [0xbb0310], ebx
or eax, ebp
not ebx
imul ebx, eax
mov eax, dword [0xbb0314]
mov ebp, ebx
shl ebp, 5
xor eax, ebx
shr ebx, 0x1a
mov dword [0xbb0314], eax
or ebx, ebp
not eax
imul eax, ebx
mov ebx, dword [0xbb0318]
mov ebp, eax
shl ebp, 6
xor ebx, eax
shr eax, 0x19
mov dword [0xbb0318], ebx
or eax, ebp
not ebx
imul ebx, eax
mov eax, dword [0xbb031c]
mov ebp, ebx
shl ebp, 7
xor eax, ebx
shr ebx, 0x18
mov dword [0xbb031c], eax
or ebx, ebp
not eax
imul eax, ebx
mov ebx, dword [0xbb0320]
mov ebp, eax
shl ebp, 8
xor ebx, eax
shr eax, 0x17
mov dword [0xbb0320], ebx
or eax, ebp
not ebx
imul ebx, eax
mov eax, dword [0xbb0324]
mov ebp, ebx
shl ebp, 9
xor eax, ebx
shr ebx, 0x16
mov dword [0xbb0324], eax
or ebx, ebp
not eax
imul eax, ebx
mov ebx, dword [0xbb0328]
mov ebp, eax
shl ebp, 0xa
xor ebx, eax
shr eax, 0x15
mov dword [0xbb0328], ebx
or eax, ebp
not ebx
imul ebx, eax
mov ah, 1
xor dword [0xbb032c], ebx
shl ah, cl
or byte [0xbb0333], ah
mov eax, 0x835860
mov ecx, 0x835860
xor ecx, 2
or eax, 2
add eax, ecx
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb0333], al
push edi
push edx
push 0xbb0300
push esi
call fcn.00782570
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7f07c0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
mov ebp, ecx
mov ecx, edx
mov esi, edx
call fcn.007efd90
cmp eax, 1
jne 0x7f07e8
mov ecx, ebp
mov edx, esi
push edi
call fcn.007ee980
add esp, 8
jmp 0x7f082f
mov dword [edi], 0
cmp byte [esi], 0x88
je 0x7f0834
mov edx, dword [ebp + 0x2c]
mov ebx, eax
lea ecx, [edx + 1]
add edx, ebx
test ebx, ebx
mov dword [esp], ecx
mov dword [ebp + 0x2c], edx
jle 0x7f0829
xor edi, edi
mov ecx, dword [esi + 0x14]
mov eax, dword [esp]
lea edx, [edi + edi*4]
mov edx, dword [ecx + edx*4 + 4]
lea eax, [edi + eax]
mov ecx, ebp
push eax
call fcn.007f46c0
add esp, 4
inc edi
cmp edi, ebx
jne 0x7f0809
mov eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, ebp
mov edx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007ef460
Function at 0x7f0f60
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0xbcbae0]
mov ebx, dword [esp + 0x1c]
mov edi, edx
mov esi, ecx
xor eax, esp
mov dword [esp + 4], eax
cmp dword [edx + 0xc], 0
jne 0x7f0fc7
mov ecx, esi
mov dword [esp], 0
call fcn.006cb3a0
mov ecx, dword [edi + 4]
lea edx, [ebx + ebx*4]
movzx ebp, byte [eax + 0x4e]
movzx ebx, byte [ecx + edx*4 + 0xd]
mov edx, dword [ecx + edx*4 + 4]
mov ecx, eax
mov eax, esp
push eax
push ebx
mov ebx, dword [esp + 0x24]
push ebp
call fcn.007f1000
add esp, 0xc
mov edx, dword [esp]
test edx, edx
je 0x7f0fc7
mov ecx, esi
push 0xfffffffffffffff5
call fcn.007ec2f0
add esp, 4
mov eax, dword [edi + 4]
lea ecx, [ebx + ebx*4]
cmp byte [eax + ecx*4 + 0xd], 0x45
jne 0x7f0fe7
mov ecx, esi
mov edx, 0x53
push dword [esp + 0x20]
call fcn.007edd80
add esp, 4
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00980459
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7f1640
Capabilities:
Encode data using xor
Terminate process

Disassembly:
cmp byte [edx], 0x88
je 0x7f1648
xor eax, eax
ret
jmp fcn.007ef460
Function at 0x7f2f90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
test byte [edx + 5], 8
mov esi, ecx
je 0x7f2fb4
mov eax, dword [edx + 0x14]
mov ecx, esi
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
push 1
call fcn.007ef1f0
add esp, 4
jmp 0x7f3178
mov edx, fcn.007b0c50
mov edi, fcn.007b0c50
xor eax, eax
movzx ebx, byte [0xbb03d7]
or edx, 2
xor edi, 2
mov ecx, edx
add ecx, edi
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x7f316a
mov al, byte [0xbb03d7]
mov ebx, edx
xor ecx, ecx
mov ah, 1
add ebx, edi
sete cl
mov ebx, ecx
not ebx
lea ecx, [ecx + ebx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb03d7], ah
jne 0x7f2fef
mov ecx, fcn.007b0c50
mov edx, fcn.007b0c50
xor ebx, ebx
movzx eax, al
or ecx, 2
xor edx, 2
mov edi, ecx
add edi, edx
sete bl
mov edi, ebx
not ebx
lea ebx, [edi + ebx*2 + 4]
and bl, 7
xor bl, 7
movzx edi, bl
bt eax, edi
jae 0x7f306f
mov edi, ecx
xor eax, eax
add edi, edx
movzx edi, byte [0xbb03d7]
sete al
mov ebx, eax
not ebx
lea eax, [eax + ebx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jae 0x7f3048
jmp 0x7f316a
xor eax, eax
add ecx, edx
movzx edx, byte [0xbb03d7]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7f313b
mov ecx, fcn.007b0c50
mov edx, fcn.007b0c50
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x123
lea ecx, [eax + ecx*2 - 0x1415b134]
mov eax, dword [0xbb03c0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb03c0], eax
not eax
imul edx, eax
mov eax, dword [0xbb03c4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb03c4], eax
or edi, edx
not eax
mov edx, dword [0xbb03c8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb03c8], edx
or edi, eax
not edx
mov eax, dword [0xbb03cc]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb03cc], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbb03d0], eax
or byte [0xbb03d7], dl
mov eax, fcn.007b0c50
mov ecx, fcn.007b0c50
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
not eax
lea ecx, [edx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb03d7], al
push 0xbb03c0
push esi
call fcn.00782570
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x7f31f0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [ecx + 0x74]
mov edi, 1
test eax, eax
cmove eax, ecx
mov ecx, edx
mov esi, dword [eax + 0x54]
shl edi, cl
bt esi, edx
jb 0x7f3215
or esi, edi
cmp edx, 1
mov dword [eax + 0x54], esi
je 0x7f3218
pop esi
pop edi
ret
mov ecx, eax
pop esi
pop edi
jmp fcn.00795740
Function at 0x7f3230
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
mov edi, edx
mov esi, ecx
mov edx, 0x45
push ebp
push 0
call fcn.007c57e0
add esp, 8
mov ecx, esi
mov edx, 0x25
push edi
call fcn.007edd80
add esp, 4
mov ebx, eax
mov ecx, esi
mov edx, 0x59
push ebp
push 0
push edi
call fcn.007c5800
add esp, 0xc
mov ecx, esi
mov edx, pe_nt_image_headers32
call fcn.00782720
mov ecx, esi
mov edx, ebx
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007ebd40
Function at 0x7f4a50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [ecx]
xor eax, eax
cmp byte [ecx + 0xa5], 0
jne 0x7f4c7a
cmp byte [esi + 0xc8], 0
jne 0x7f4c7a
mov edi, dword [ecx + 0x150]
test edi, edi
je 0x7f4c7a
push dword [esi + 0xf0]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edx
push dword [ecx + 0x154]
call edi
add esp, 0x18
cmp eax, 1
jne 0x7f4c64
mov eax, 0x78fa70
mov edx, 3
movzx edi, byte [0xbb04d3]
sub edx, eax
xor eax, eax
mov ecx, edx
xor ecx, 0x78fa70
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jb 0x7f4c4d
mov al, byte [0xbb04d3]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, 0x78fa70
sete cl
mov ebx, ecx
not ebx
lea ecx, [ecx + ebx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb04d3], ah
jne 0x7f4ae3
mov edx, 0x78fa70
mov ecx, 3
movzx eax, al
sub ecx, edx
xor edx, edx
mov edi, ecx
xor edi, 0x78fa70
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7f4b6b
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb04d3]
xor edx, 0x78fa70
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jae 0x7f4b40
jmp 0x7f4c4d
xor eax, eax
xor ecx, 0x78fa70
movzx edx, byte [0xbb04d3]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7f4c1e
mov eax, 0x78fa70
mov ecx, 3
sub ecx, eax
xor eax, eax
xor ecx, 0x78fa70
sete al
mov ecx, eax
not ecx
and ecx, 0x833
lea ecx, [eax + ecx*2 + 0x6aabb1c4]
mov eax, dword [0xbb04c0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb04c0], eax
not eax
imul edx, eax
mov eax, dword [0xbb04c4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb04c4], eax
or edi, edx
not eax
mov edx, dword [0xbb04c8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb04c8], edx
or edi, eax
not edx
mov al, 1
imul edx, edi
shl al, cl
xor dword [0xbb04cc], edx
or byte [0xbb04d3], al
mov eax, 0x78fa70
mov ecx, 3
sub ecx, eax
xor eax, eax
xor ecx, 0x78fa70
sete al
mov ecx, eax
not ecx
lea ecx, [eax + ecx*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb04d3], al
push 0xbb04c0
push esi
call fcn.00782570
add esp, 8
mov dword [esi + 0xc], 0x17
jmp 0x7f4c75
mov ecx, eax
or ecx, 2
cmp ecx, 2
je 0x7f4c7a
mov ecx, esi
call fcn.007f4c80
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x7f4c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edx, fcn.0079d270
mov esi, ecx
xor eax, eax
movzx edi, byte [0xbb04fb]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.0079d270
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jb 0x7f4e5d
mov al, byte [0xbb04fb]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, fcn.0079d270
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb04fb], ah
jne 0x7f4cbe
mov ecx, fcn.0079d270
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov edi, ecx
xor edi, fcn.0079d270
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7f4d46
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb04fb]
xor edx, fcn.0079d270
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jae 0x7f4d1a
jmp 0x7f4e5d
xor eax, eax
xor ecx, fcn.0079d270
movzx edx, byte [0xbb04fb]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7f4e31
mov ecx, fcn.0079d270
xor eax, eax
and ecx, 1
inc ecx
xor ecx, fcn.0079d270
sete al
mov ecx, eax
not ecx
and ecx, 0x401
lea ecx, [eax + ecx*2 - 0x6ae766a2]
mov eax, dword [0xbb04e0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb04e0], eax
not eax
imul edx, eax
mov eax, dword [0xbb04e4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb04e4], eax
or edi, edx
not eax
mov edx, dword [0xbb04e8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb04e8], edx
or edi, eax
not edx
mov eax, dword [0xbb04ec]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb04ec], eax
or edi, edx
not eax
mov edx, dword [0xbb04f0]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb04f0], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb04f4], edx
mov dl, 1
shl dl, cl
or byte [0xbb04fb], dl
mov eax, fcn.0079d270
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0079d270
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb04fb], al
push 0xbb04e0
push esi
call fcn.00782570
add esp, 8
mov dword [esi + 0xc], 1
pop esi
pop edi
pop ebx
ret
Function at 0x7f5710
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov eax, fcn.00789ac0
mov edx, 3
mov esi, ecx
movzx ecx, byte [0xbb0723]
sub edx, eax
mov eax, edx
xor eax, fcn.00789ac0
sete al
or al, 4
add al, 0x44
and al, 7
movzx eax, al
bt ecx, eax
jb 0x7f5894
mov al, byte [0xbb0723]
mov ecx, edx
mov ah, 1
xor ecx, fcn.00789ac0
sete cl
or cl, 4
add cl, 0x44
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb0723], ah
jne 0x7f574b
mov edx, fcn.00789ac0
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.00789ac0
sete dl
or dl, 4
add dl, 0x44
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7f57c4
mov eax, ecx
movzx edx, byte [0xbb0723]
xor eax, fcn.00789ac0
sete al
or al, 4
add al, 0x44
and al, 7
movzx eax, al
bt edx, eax
jae 0x7f57a0
jmp 0x7f5894
xor ecx, fcn.00789ac0
movzx ecx, byte [0xbb0723]
sete al
or al, 4
add al, 0x44
and al, 7
movzx eax, al
bt ecx, eax
jb 0x7f5869
mov eax, fcn.00789ac0
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb0710]
xor edx, fcn.00789ac0
sete cl
or ecx, 0x591fed14
add ecx, 0x44
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb0710], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb0714]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb0714], eax
or ebx, edx
not eax
mov edx, dword [0xbb0718]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb0718], edx
or ebx, eax
not edx
mov al, 1
imul edx, ebx
shl al, cl
xor dword [0xbb071c], edx
or byte [0xbb0723], al
mov eax, fcn.00789ac0
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.00789ac0
sete cl
or cl, 4
add cl, 0x44
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb0723], al
mov ecx, esi
call fcn.007ebd10
mov ebx, eax
mov ecx, esi
mov edx, edi
push 0xbb0710
push 1
push 1
call fcn.007ec020
add esp, 0xc
mov ecx, ebx
mov edx, 0x61
push 5
push edi
push 1
push 0
call fcn.007826e0
add esp, 0x10
cmp dword [esi + 0x28], 0
jne 0x7f58d5
mov dword [esi + 0x28], 1
pop esi
pop edi
pop ebx
ret
Function at 0x7f6140
Capabilities:
Terminate process

Disassembly:
push esi
mov eax, edx
mov esi, ecx
mov edx, 0x42
push eax
call fcn.007edd80
add esp, 4
mov eax, dword [esi + 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [esi + 0xc]
mov dword [eax + 0x1c], 0
pop esi
ret
Function at 0x7f9730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
mov edi, dword [eax + 0x78]
xor eax, eax
cmp edi, edx
jge 0x7f9990
mov edx, fcn.007f0520
mov esi, ecx
movzx ecx, byte [0xbb1527]
imul edx, edx
and edx, 3
cmp edx, 2
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x7f997c
mov al, byte [0xbb1527]
cmp edx, 2
mov ah, 1
sete cl
or cl, 6
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb1527], ah
jne 0x7f976f
mov ecx, fcn.007f0520
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
or dl, 6
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7f97c9
cmp ecx, 2
movzx edx, byte [0xbb1527]
sete al
or al, 6
movzx eax, al
bt edx, eax
jae 0x7f97ad
jmp 0x7f997c
cmp ecx, 2
movzx edx, byte [0xbb1527]
sete al
or al, 6
movzx eax, al
bt edx, eax
jb 0x7f995b
mov eax, fcn.007f0520
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
mov eax, dword [0xbb14f0]
sete cl
or ecx, 0xf92a51ae
xor eax, ecx
and cl, 7
mov dword [0xbb14f0], eax
not eax
mov edx, dword [0xbb14f4]
imul eax, eax, 0xf92a51af
lea ebx, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbb14f4], edx
or ebx, eax
not edx
mov eax, dword [0xbb14f8]
imul edx, ebx
lea ebx, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbb14f8], eax
or ebx, edx
not eax
mov edx, dword [0xbb14fc]
imul eax, ebx
lea ebx, [eax*8]
xor edx, eax
shr eax, 0x1c
mov dword [0xbb14fc], edx
or ebx, eax
not edx
mov eax, dword [0xbb1500]
imul edx, ebx
mov ebx, edx
shl ebx, 4
xor eax, edx
shr edx, 0x1b
mov dword [0xbb1500], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb1504]
mov ebx, eax
shl ebx, 5
xor edx, eax
shr eax, 0x1a
mov dword [0xbb1504], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb1508]
mov ebx, edx
shl ebx, 6
xor eax, edx
shr edx, 0x19
mov dword [0xbb1508], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb150c]
mov ebx, eax
shl ebx, 7
xor edx, eax
shr eax, 0x18
mov dword [0xbb150c], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb1510]
mov ebx, edx
shl ebx, 8
xor eax, edx
shr edx, 0x17
mov dword [0xbb1510], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb1514]
mov ebx, eax
shl ebx, 9
xor edx, eax
shr eax, 0x16
mov dword [0xbb1514], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb1518]
mov ebx, edx
shl ebx, 0xa
xor eax, edx
shr edx, 0x15
mov dword [0xbb1518], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb151c]
mov ebx, eax
shl ebx, 0xb
xor edx, eax
shr eax, 0x14
mov dword [0xbb151c], edx
or eax, ebx
not edx
imul edx, eax
xor dword [str.xj_a_], edx
mov dl, 1
shl dl, cl
or byte [0xbb1527], dl
mov eax, fcn.007f0520
imul eax, eax
and eax, 3
cmp eax, 2
mov al, 0xfe
sete cl
or cl, 6
xor cl, 7
rol al, cl
and byte [0xbb1527], al
push edi
push 0xbb14f0
push esi
call fcn.00782570
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x7fc840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov ecx, dword [ecx]
cmp dword [ecx + 0x150], 0
je 0x7fca35
mov esi, edx
mov edx, dword [esp + 0x20]
call fcn.007825f0
test eax, eax
mov dword [esp + 8], eax
js 0x7fca35
cmp byte [esi], 0x4d
je 0x7fc8a1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
jle 0x7fca35
mov edx, dword [esi + 0x1c]
xor ebp, ebp
lea ebx, [ebp + ebp*8]
cmp edx, dword [eax + ebx*8 + 0x34]
jne 0x7fc897
lea eax, [eax + ebx*8 + 0x18]
jmp 0x7fc8a4
inc ebp
cmp ebp, ecx
jl 0x7fc887
jmp 0x7fca35
lea eax, [edi + 0x78]
mov ebx, dword [eax]
test ebx, ebx
je 0x7fca35
movzx eax, word [esi + 0x20]
test ax, ax
jns 0x7fc8ca
movzx eax, word [ebx + 0x28]
test ax, ax
jns 0x7fc8ca
mov dword [esp + 4], 0xbb0d40
jmp 0x7fc8d8
mov ecx, dword [ebx + 4]
cwde
lea eax, [eax + eax*4]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
mov ebp, fcn.007755a0
xor eax, eax
movzx edx, byte [0xbb0d4b]
imul ebp, ebp
and ebp, 3
cmp ebp, 3
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x7fca19
mov al, byte [0xbb0d4b]
mov dword [esp], ebx
xor ecx, ecx
cmp ebp, 3
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb0d4b], ah
jne 0x7fc90c
mov ecx, fcn.007755a0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7fc97f
mov ebx, dword [esp]
xor eax, eax
cmp ecx, 3
movzx ebp, byte [0xbb0d4b]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 2]
bt ebp, eax
jae 0x7fc95d
jmp 0x7fca19
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbb0d4b]
mov ebx, dword [esp]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x7fc9f0
mov ecx, fcn.007755a0
xor eax, eax
mov ebp, dword [0xbb0d40]
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0x8cd
lea ecx, [eax + ecx*2 + 0x65277722]
mov edx, ecx
xor ebp, ecx
shr edx, 0x1f
mov dword [0xbb0d40], ebp
not ebp
or edx, ecx
and cl, 7
imul edx, ebp
xor dword [0xbb0d44], edx
mov dl, 1
shl dl, cl
or byte [0xbb0d4b], dl
mov eax, fcn.007755a0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb0d4b], al
mov edx, dword [ebx]
mov ecx, edi
push dword [esp + 8]
push dword [esp + 8]
call fcn.007fcb10
add esp, 8
cmp eax, 2
jne 0x7fca35
mov byte [esi], 0x77
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret