joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d70b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
nop
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6da440
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.006d9fd0
mov edx, dword [0xa16084]
mov ecx, dword [0xa1607c]
mov ebx, 0x1036
sub ebx, eax
mov dword [ebp - 0x20], ebx
sub ecx, ebx
add ecx, edx
call dword [0xa0535c]
call ecx
mov ebx, eax
mov dword [edi], 0x9a3888
mov dword [edi + 8], esi
lea eax, [edi + 0x10]
mov dword [ebp - 0x30], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov eax, ebx
xor eax, 0xb3ca0c56
push eax
call fcn.008ea17d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x10], eax
lea eax, [edi + 0x30]
mov dword [ebp - 0x2c], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 0x24], edi
mov byte [edi + 4], 0
mov dword [ebp - 0x34], ebx
xor ebx, 0xb3ca0832
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x38], ebx
push ebx
call fcn.008ea17d
add esp, 4
mov dword [ebp - 0x28], eax
nop
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
mov eax, dword [0xa16088]
mov ecx, dword [0xa16070]
sub ecx, dword [ebp - 0x20]
add ecx, eax
sub ebx, edi
mov dword [ebp - 0x10], 0xffffffff
call dword [0xa0535c]
push ebx
push edi
push dword [ebp - 0x28]
call ecx
add esp, 0xc
test edi, edi
je 0x6d721a
nop
mov eax, dword [esi + 0x38]
sub eax, edi
mov esi, dword [ebp - 0x34]
mov ecx, esi
xor ecx, 0xb3ca03cd
cmp eax, ecx
jbe 0x6d720b
nop
mov ecx, dword [edi - 4]
mov edx, esi
xor edx, 0x4c35f3ce
mov ebx, edx
xor ebx, edi
and edx, edi
lea edx, [ebx + edx*2]
sub edx, ecx
mov edi, esi
xor edi, 0xb3ca0c12
cmp edx, edi
jae 0x6d7240
xor esi, 0xb3ca0c11
add eax, esi
mov edi, ecx
nop
push eax
push edi
call fcn.008ea1ad
add esp, 8
nop
mov esi, dword [ebp - 0x24]
nop
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
add ecx, dword [ebp - 0x38]
mov dword [esi + 0x38], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
nop
mov dword [ebp - 0x10], 0
call fcn.008cd651
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.00901a00
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
nop
mov eax, dword [0xa16080]
mov esi, dword [0xa16078]
mov edi, dword [ebp - 0x20]
sub esi, edi
add esi, eax
mov ecx, esi
call dword [0xa0535c]
mov ecx, dword [ebp - 0x2c]
call esi
mov eax, dword [0xa1608c]
mov esi, dword [0xa16074]
sub esi, edi
add esi, eax
mov ecx, esi
call dword [0xa0535c]
mov ecx, dword [ebp - 0x30]
call esi
add esp, 0xc
pop ebp
ret
Function at 0x6d7780
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
nop
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6da470
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [esi], eax
mov dword [esi + 8], 0x922778
movzx eax, byte [edi + 4]
mov byte [esi + 0xc], al
movzx eax, byte [edi + 5]
mov byte [esi + 0xd], al
movzx eax, byte [edi + 6]
mov byte [esi + 0xe], al
movzx eax, byte [edi + 7]
mov byte [esi + 0xf], al
movzx eax, byte [edi + 8]
mov byte [esi + 0x10], al
movzx eax, byte [edi + 9]
mov byte [esi + 0x11], al
movzx eax, byte [edi + 0xa]
mov byte [esi + 0x12], al
movzx eax, byte [edi + 0xb]
mov byte [esi + 0x13], al
movzx eax, byte [edi + 0xc]
mov byte [esi + 0x14], al
mov dword [esi + 8], 0x922744
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x6d7821
lock inc dword [eax + 4]
lea eax, [esi + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x1c], eax
lea ecx, [esi + 0x20]
lea eax, [edi + 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], ecx
push eax
mov dword [ebp - 0x24], esi
call fcn.006d78f0
nop
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], 0x9226b4
mov dword [eax + 0x20], 0x9226d4
lea ecx, [eax + 0x58]
mov eax, dword [ebp + 0xc]
add eax, 0x50
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x1d]
push edx
push eax
call fcn.006d7d90
nop
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], 0x922464
mov dword [eax + 0x20], 0x922484
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x60], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x6e32f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6e36d0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
cmp dword [ecx + 4], 0x35e50d7
je 0x6e33b8
nop
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
push 0x4c
call fcn.008ea17d
add esp, 4
nop
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], 0x9a3ab0
movsd xmm0, qword [edx + 4]
movsd qword [eax + 0xc], xmm0
lea ecx, [eax + 0x14]
add edx, 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
push edx
call fcn.0078a500
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
mov eax, dword [ebp + 0xc]
add eax, 0x28
mov dword [ebp - 0x10], 1
push eax
call fcn.0078a500
nop
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
inc dword [ecx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebp - 0x20]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [edx + 4], eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.006e3410
push 0xa16690
call fcn.008ebdaa
nop word [eax + eax]
push ebp
sub esp, 8
add ebp, 0xc
nop
mov ecx, dword [ebp - 0x28]
call fcn.0066b350
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
add esp, 8
pop ebp
ret

Function at 0x6e3410
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [0xa1669e]
cmp al, 0x35
je 0x6e3430
mov cl, 0xc8
nop dword [eax]
mov al, 0xdf
lock cmpxchg byte [0xa1669e], cl
je 0x6e3436
cmp al, 0x35
jne 0x6e3420
mov eax, 0xa16690
ret
push edi
push esi
mov esi, 0xfffffff2
mov ecx, 0xb4b4c0ab
mov edi, 0xaaaaaaab
nop word [eax + eax]
mov eax, ecx
inc ecx
mul edi
shr edx, 1
and edx, 0xfffffffc
lea eax, [edx + edx*2]
neg eax
movzx eax, byte [esi + eax - 0x4ab102b7]
xor al, 0xda
add byte [esi + 0xa1669e], al
inc esi
jne 0x6e3450
mov al, 0x35
xchg byte [0xa1669e], al
pop esi
pop edi
mov eax, 0xa16690
ret
Function at 0x6eab00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6eb9a0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x6eab61
nop
mov dword [ecx], 0x9a4050
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x50], 0x921da0
mov esi, ecx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov dword [ecx + eax], 0x9a405c
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x50]
mov dword [esi + eax - 4], ecx
lea eax, [esi + 4]
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov dword [esi + ecx], 0x9a1cdc
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
lea edx, [ecx - 8]
mov dword [esi + ecx - 4], edx
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x20], esi
add ecx, esi
mov dword [ebp - 0x10], 1
push 0
push eax
call fcn.00674d70
nop
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], 0x9a405c
mov eax, dword [edx]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x50]
mov dword [edx + eax - 4], ecx
mov dword [edx + 4], 0x921f84
push 8
call fcn.008ea17d
add esp, 4
mov dword [ebp - 0x24], eax
nop
mov dword [ebp - 0x10], 0
push 1
call fcn.008ec014
add esp, 4
nop
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x38], ecx
lea ecx, [eax + 8]
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
lea ecx, [eax + 0x28]
mov dword [eax + 0x30], ecx
lea ecx, [eax + 0x2c]
mov dword [eax + 0x34], ecx
mov dword [eax + 0xc], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 8], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x28], 0
mov dword [eax + 4], 0x9a1c14
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x6eb150
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [0xa17bd6]
cmp al, 0xa5
je 0x6eb170
mov cl, 0xf1
nop dword [eax]
mov al, 8
lock cmpxchg byte [0xa17bd6], cl
je 0x6eb171
cmp al, 0xa5
jne 0x6eb160
ret
push ebx
push edi
push esi
mov esi, 0xffffffea
lea edi, [0x7b6785b3]
mov ecx, 0x8532ba12
mov ebx, 0xba2e8ba3
nop dword [eax]
mov eax, ecx
inc ecx
mul ebx
shr edx, 4
lea eax, [edx + edx*4]
lea eax, [edx + eax*4]
add eax, edx
movzx eax, byte [edi + eax]
dec edi
xor al, 0x4f
add byte [esi + 0xa17bd6], al
inc esi
jne 0x6eb190
mov al, 0xa5
xchg byte [0xa17bd6], al
pop esi
pop edi
pop ebx
ret
Function at 0x6eb1d0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [0xa17bb5]
cmp al, 0xca
je 0x6eb1f0
mov cl, 0x6c
nop dword [eax]
mov al, 0xab
lock cmpxchg byte [0xa17bb5], cl
je 0x6eb1f1
cmp al, 0xca
jne 0x6eb1e0
ret
push ebx
push edi
push esi
mov esi, 0xffffffeb
lea edi, [0xb4edf0cb]
mov ecx, 0x4bac4ed9
mov ebx, 0x86186187
nop dword [eax]
mov eax, ecx
mul ebx
mov eax, ecx
inc ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
lea edx, [eax + eax*4]
lea eax, [eax + edx*4]
mov dh, byte [esi + 0xa17bb5]
xor dh, byte [edi + eax]
dec edi
xor dh, 0x3a
mov byte [esi + 0xa17bb5], dh
inc esi
jne 0x6eb210
mov al, 0xca
xchg byte [0xa17bb5], al
pop esi
pop edi
pop ebx
ret

Function at 0x6eb250
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
movzx eax, byte [0xa17bf5]
cmp al, 0xcc
je 0x6eb270
mov cl, 0x65
nop dword [eax]
mov al, 0x2b
lock cmpxchg byte [0xa17bf5], cl
je 0x6eb271
cmp al, 0xcc
jne 0x6eb260
ret
push ebx
push edi
push esi
mov esi, 0xffffffeb
lea edi, [0x817d1f01]
mov ecx, 0x7f1d20e3
mov ebx, 0x86186187
nop dword [eax]
mov eax, ecx
mul ebx
mov eax, ecx
inc ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
lea edx, [eax + eax*4]
lea eax, [eax + edx*4]
movzx eax, byte [edi + eax]
dec edi
xor al, 0x82
add byte [esi + 0xa17bf5], al
inc esi
jne 0x6eb290
mov al, 0xcc
xchg byte [0xa17bf5], al
pop esi
pop edi
pop ebx
ret
Function at 0x6ec8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6f0540
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.006efcb0
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x15c], 0
lea esi, [ebp - 0x158]
push 0x128
push 0
push esi
call fcn.00901a10
add esp, 0xc
push 0
push esi
call fcn.00795760
add esp, 8
movzx eax, byte [0xa18b40]
cmp al, 0x28
je 0x6ec9c5
mov cl, 0x5b
nop word cs:[eax + eax]
mov al, 0xea
lock cmpxchg byte [0xa18b40], cl
je 0x6ec935
cmp al, 0x28
jne 0x6ec920
jmp 0x6ec9c5
xor esi, esi
mov ecx, 0xc1c13d18
mov edi, 0xc1c13d17
nop word cs:[eax + eax]
mov eax, ecx
mov edx, 0xf0f0f0f1
mul edx
mov ebx, edx
mov eax, edx
shr eax, 4
and ebx, 0xfffffff0
add ebx, eax
mov eax, edi
mov edx, 0xf0f0f0f1
mul edx
mov eax, edx
shr eax, 4
and edx, 0xfffffff0
add edx, eax
movzx eax, byte [esi + 0xa18b30]
neg edx
xor al, byte [esi + edx - 0x3da480a9]
xor al, 0x2e
mov byte [esi + 0xa18b30], al
movzx eax, byte [esi + 0xa18b31]
neg ebx
xor al, byte [esi + ebx - 0x3da480a8]
xor al, 0x2e
mov byte [esi + 0xa18b31], al
add esi, 2
add ecx, 2
add edi, 2
cmp esi, 0x10
jne 0x6ec950
mov al, 0x28
xchg byte [0xa18b40], al
mov dword [ebp - 0x10], 0xffffffff
nop
mov ecx, dword [ebp - 0x20]
add ecx, dword [0xa18e10]
mov eax, dword [0xa18e00]
add ecx, eax
add ecx, 0xffff244f
mov dword [ebp - 0x10], 0xffffffff
call dword [0xa0535c]
lea esi, [ebp - 0x30]
push 0x10
push 0xa18b30
push esi
call ecx
add esp, 0xc
lea ecx, [ebp - 0x130]
movzx eax, byte [ebp - 0x15c]
mov dword [ebp - 0x10], 1
push ecx
push eax
push 0x10
push esi
lea eax, [ebp - 0x158]
push eax
call fcn.00795900
add esp, 0x14
xorps xmm0, xmm0
lea eax, [ebp - 0x130]
movups xmmword [eax], xmm0
lea eax, [ebp - 0x15c]
push 0xa4a787
push eax
call fcn.006966f0
add esp, 8
nop
mov eax, dword [0xa4a787]
test al, 2
jne 0x6eca5e
nop
xor dword [0xa56918], 0xd6a5e374
or eax, 2
mov dword [0xa4a787], eax
nop
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x158]
push eax
call fcn.00795bd0
add esp, 4
nop
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x150
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6eef90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov edi, ecx
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6f05e0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.006efdb0
movzx esi, byte [0xa56fe4]
mov edx, dword [0xa19070]
mov ecx, dword [0xa1906c]
mov dword [ebp - 0x24], esi
xor ecx, esi
mov esi, 0xffffc36c
mov dword [ebp - 0x30], eax
sub esi, eax
mov dword [ebp - 0x40], esi
sub ecx, esi
add ecx, edx
call dword [0xa0535c]
call ecx
mov esi, eax
mov dword [edi], 0x9a4160
lea ecx, [edi + 4]
mov word [edi + 0x1c], 0
mov dword [ebp - 0x44], ecx
call fcn.006a3060
mov dword [edi + 0x20], 0
mov dword [ebp - 0x20], edi
mov dword [edi + 0x24], 0
mov dword [ebp - 0x2c], esi
xor esi, 0x68947182
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], esi
push esi
call fcn.008ea17d
add esp, 4
nop
mov edx, dword [ebp - 0x20]
lea ecx, [edx + 0x20]
mov dword [ebp - 0x3c], ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edx + 0x20], eax
mov dword [edx + 0x28], 0
mov dword [edx + 0x2c], 0
mov dword [ebp - 0x10], 1
push dword [ebp - 0x28]
call fcn.008ea17d
add esp, 4
nop
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + 0x28]
mov dword [ebp - 0x28], edx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x34]
mov dword [ebp - 0x38], eax
xorps xmm0, xmm0
movups xmmword [ecx + 0x34], xmm0
mov dword [ecx + 0x44], 0
mov eax, dword [ebp - 0x2c]
xor eax, 0x689473ca
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x2c], eax
push eax
call fcn.008ea17d
add esp, 4
nop
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + 0x40]
mov dword [ebp - 0x34], edx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ebp - 0x10], 3
push dword [ebp - 0x2c]
call fcn.008ea17d
add esp, 4
nop
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x30], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x719070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x24], ecx
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x719a90
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0x9a2e80
xorps xmm0, xmm0
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x3b], xmm0
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x44]
push 4
push dword [ebp + 8]
call fcn.006b3d80
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x71914e
nop
cmp byte [0xa56fa8], 0
nop
mov ecx, dword [ebp - 0x24]
jne 0x71918d
nop
cmp dword [ecx + 0x2c], 0xaaaaaaa
je 0x71918d
nop
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x30], eax
push 0x18
call fcn.008ea17d
add esp, 4
nop
mov dword [eax + 8], 0x9a4ac0
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov ecx, dword [ebp - 0x24]
inc dword [ecx + 0x2c]
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi + 4]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov dword [edx], eax
jmp 0x719157
nop
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov dword [ebp - 0x44], 0x9a2e80
cmp byte [ebp - 0x34], 0
je 0x719175
nop
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x44]
call fcn.006b4000
nop
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [ebp - 0x1d]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret 8
nop
movzx eax, byte [0xa1dc6e]
cmp al, 0x5d
je 0x719228
mov cl, 0x20
mov al, 0xb
lock cmpxchg byte [0xa1dc6e], cl
je 0x7191b1
cmp al, 0x5d
jne 0x71919f
jmp 0x719228
xor ebx, ebx
mov ecx, 0x6ac356ab
mov esi, 0x6ac356aa
mov eax, ecx
mov edx, 0x4ec4ec4f
mul edx
mov edi, edx
mov eax, esi
mov edx, 0x4ec4ec4f
mul edx
shr edx, 2
imul eax, edx, 0xfffffff3
movzx edx, byte [ebx + 0xa1dc60]
xor dl, byte [eax + ebx + 0x6b5da22a]
shr edi, 2
imul eax, edi, 0xfffffff3
xor dl, 0x76
mov byte [ebx + 0xa1dc60], dl
movzx edx, byte [ebx + 0xa1dc61]
xor dl, byte [eax + ebx + 0x6b5da22b]
xor dl, 0x76
mov byte [ebx + 0xa1dc61], dl
add ebx, 2
add ecx, 2
add esi, 2
cmp ebx, 0xe
jne 0x7191bd
mov al, 0x5d
xchg byte [0xa1dc6e], al
mov dword [ebp - 0x10], 1
nop
mov dword [ebp - 0x10], 1
push 0xa1dc60
call fcn.008ebdaa
add esp, 4
nop dword [eax]
push ebp
sub esp, 8
add ebp, 0xc
lea ecx, [ebp - 0x44]
call fcn.006bba20
add esp, 8
pop ebp
ret
Function at 0x741d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
movzx eax, byte [0xa1fd90]
cmp al, 0x83
je 0x741d50
mov cl, 0x60
nop word cs:[eax + eax]
mov al, 0xd8
lock cmpxchg byte [0xa1fd90], cl
je 0x741d5a
cmp al, 0x83
jne 0x741d40
push 0xa1fd80
call fcn.008ebdaa
mov ebx, 0xfffffff0
lea edx, [0x25c57b84]
mov ecx, 0xdad4d5bc
lea ebp, [0x25c57b85]
mov esi, 0xdad4d5bb
nop word cs:[eax + eax]
mov dword [esp], edx
mov eax, ecx
mov edx, 0xf0f0f0f1
mul edx
mov edi, edx
mov eax, esi
mov edx, 0xf0f0f0f1
mul edx
mov eax, edx
shr eax, 4
and edx, 0xfffffff0
add edx, eax
movzx eax, byte [ebp + edx]
mov edx, dword [esp]
xor al, 0xe9
add byte [ebx + 0xa1fd90], al
mov eax, edi
shr eax, 4
and edi, 0xfffffff0
add edi, eax
movzx eax, byte [edx + edi]
xor al, 0xe9
add byte [ebx + 0xa1fd91], al
add edx, 0xfffffffe
add ecx, 2
add ebp, 0xfffffffe
add esi, 2
add ebx, 2
jne 0x741d80
mov al, 0x83
xchg byte [0xa1fd90], al
push 0xa1fd80
call fcn.008ebdaa
int3
Function at 0x744040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x7447c0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.00744770
mov ecx, dword [0xa20868]
mov esi, dword [0xa20854]
mov edx, 0xb8ba
sub edx, eax
mov dword [ebp - 0x20], edx
sub esi, edx
add esi, ecx
mov ecx, esi
call dword [0xa0535c]
lea ecx, [ebp - 0x34]
call esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
jmp 0x7440e1
nop
push edx
push ecx
call fcn.008ea1ad
add esp, 8
nop
mov eax, dword [ebp - 0x24]
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [0xa0535c]
mov dword [ebp - 0x10], 1
push edi
call esi
mov ecx, dword [ebp - 0x24]
add ecx, 8
cmp ecx, dword [ebp - 0x28]
je 0x744220
nop
cmp dword [ecx + 4], 0
je 0x7440de
nop
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0xf
movzx eax, byte [0xa207e0]
cmp al, 0xc8
je 0x7441a5
nop word cs:[eax + eax]
mov al, 0x27
mov cl, 0xe7
lock cmpxchg byte [0xa207e0], cl
je 0x744134
cmp al, 0xc8
jne 0x744120
jmp 0x7441a5
mov esi, 0xfffffff0
mov ecx, 0xa9cc1da8
mov edi, 0xaaaaaaab
nop word cs:[eax + eax]
mov eax, ecx
mul edi
shr edx, 1
and edx, 0xfffffffc
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx ebx, byte [esi + 0xa207e0]
neg eax
xor bl, byte [esi + eax - 0x55998fd8]
xor bl, 0x7a
mov byte [esi + 0xa207e0], bl
movzx eax, byte [esi + 0xa207e1]
xor al, byte [edx - 0x55998fd7]
xor al, 0x7a
mov byte [esi + 0xa207e1], al
add ecx, 2
add esi, 2
jne 0x744150
mov al, 0xc8
xchg byte [0xa207e0], al
mov dword [ebp - 0x10], 0xffffffff
nop
mov eax, dword [0xa20864]
mov ecx, dword [0xa2085c]
sub ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x10], 0xffffffff
call dword [0xa0535c]
push 0xf
push 0xa207d0
lea esi, [ebp - 0x4c]
push esi
call ecx
add esp, 0xc
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x10], 2
mov ecx, esi
call fcn.007445a0
mov esi, eax
mov eax, dword [ebp - 0x38]
cmp eax, 0x10
jb 0x7440bb
nop
mov ecx, dword [ebp - 0x4c]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x7440b0
nop
mov edi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edi
cmp ecx, 0x20
jae 0x744256
add eax, 0x24
mov edx, eax
mov ecx, edi
jmp 0x7440b0
nop
mov eax, dword [0xa2086c]
mov esi, dword [0xa20858]
sub esi, dword [ebp - 0x20]
add esi, eax
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [0xa0535c]
lea ecx, [ebp - 0x34]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
nop
mov dword [ebp - 0x10], 0
call fcn.008cd651
nop word cs:[eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.00901a00
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
nop
mov eax, dword [0xa2086c]
mov esi, dword [0xa20858]
sub esi, dword [ebp - 0x20]
add esi, eax
mov ecx, esi
call dword [0xa0535c]
lea ecx, [ebp - 0x34]
call esi
add esp, 0xc
pop ebp
ret