joyce8/EMBER2024-capa huggingface dataset:
Function at 0x835dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov ecx, dword [0xbcbae0]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea edi, [esp + 8]
xor ecx, ebp
mov dword [esp + 0x9c], ecx
mov ecx, esi
push edi
push eax
call fcn.00837170
add esp, 8
test eax, eax
jne 0x83604a
mov eax, fcn.007a0590
mov edx, 3
movzx ecx, byte [0xbb6013]
sub edx, eax
mov eax, edx
xor eax, fcn.007a0590
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x835fe2
mov al, byte [0xbb6013]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007a0590
sete cl
or cl, 6
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb6013], ah
jne 0x835e3e
mov edx, fcn.007a0590
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.007a0590
sete dl
or dl, 6
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x835ea7
mov eax, ecx
movzx edx, byte [0xbb6013]
xor eax, fcn.007a0590
sete al
or al, 6
movzx eax, al
bt edx, eax
jae 0x835e87
jmp 0x835fe2
xor ecx, fcn.007a0590
movzx ecx, byte [0xbb6013]
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x835fbd
mov eax, fcn.007a0590
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb5ff0]
xor edx, fcn.007a0590
sete cl
or ecx, 0x7ade1516
add ecx, 0x400
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb5ff0], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb5ff4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb5ff4], eax
or edi, edx
not eax
mov edx, dword [0xbb5ff8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb5ff8], edx
or edi, eax
not edx
mov eax, dword [0xbb5ffc]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb5ffc], eax
or edi, edx
not eax
mov edx, dword [0xbb6000]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb6000], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbb6004]
mov edi, edx
shl edi, 5
xor eax, edx
shr edx, 0x1a
mov dword [0xbb6004], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb6008]
mov edi, eax
shl edi, 6
xor edx, eax
shr eax, 0x19
mov dword [0xbb6008], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb600c], edx
mov dl, 1
shl dl, cl
or byte [0xbb6013], dl
mov eax, fcn.007a0590
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.007a0590
sete cl
or cl, 6
xor cl, 7
rol al, cl
and byte [0xbb6013], al
lea ecx, [esp + 8]
call fcn.00839ec0
fld qword [esp + 0x28]
fnstcw word [esp + 2]
lea edi, [esp + 0x38]
movzx eax, word [esp + 2]
mov word [esp + 2], 0xc7f
fldcw word [esp + 2]
mov word [esp + 2], ax
fistp dword [esp + 4]
fldcw word [esp + 2]
push dword [esp + 4]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0xbb5ff0
push edi
push 0x64
call fcn.00777b20
add esp, 0x24
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push esi
call fcn.0077e170
add esp, 0x10
mov ecx, dword [esp + 0x9c]
xor ecx, ebp
call fcn.00980459
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x838b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 4], edx
mov edi, fcn.00789400
mov esi, ecx
mov eax, dword [0xbcbae0]
imul edi, edi
and edi, 3
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
cmp edi, 2
sete al
movzx edx, byte [0xbb5e23]
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x838cd3
mov al, byte [0xbb5e23]
xor ecx, ecx
cmp edi, 2
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb5e23], ah
jne 0x838b99
mov ecx, fcn.00789400
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x838c09
xor eax, eax
cmp ecx, 2
movzx edi, byte [0xbb5e23]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 2]
bt edi, eax
jae 0x838be7
jmp 0x838cd3
xor eax, eax
cmp ecx, 2
movzx edx, byte [0xbb5e23]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x838caa
mov ecx, fcn.00789400
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete al
mov ecx, eax
not ecx
and ecx, 0x6d1
lea ecx, [eax + ecx*2 + 0x3c0d612a]
mov eax, dword [0xbb5e10]
xor eax, ecx
mov dword [0xbb5e10], eax
not eax
mov edx, dword [0xbb5e14]
imul eax, ecx
and cl, 7
lea edi, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbb5e14], edx
or edi, eax
not edx
mov eax, dword [0xbb5e18]
imul edx, edi
lea edi, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbb5e18], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbb5e1c], eax
or byte [0xbb5e23], dl
mov eax, fcn.00789400
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb5e23], al
mov bl, byte [esi]
lea ebp, [esi + 1]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
cmp bl, 0x2d
cmovne ebp, esi
push eax
push ecx
push edx
push 0xbb5e10
push ebp
call fcn.008397f0
add esp, 0x14
mov edi, 1
cmp eax, 3
jne 0x838d77
add ebp, 0xa
mov byte [esp + 3], bl
movzx ecx, byte [ebp]
mov ebx, ebp
inc ebp
movzx eax, byte [ecx + 0xb436b8]
and al, 1
cmp ecx, 0x54
je 0x838d0c
test al, al
jne 0x838d0c
mov esi, dword [esp + 4]
mov ecx, ebx
mov edx, esi
call fcn.00838d90
test eax, eax
je 0x838d3f
cmp byte [ebx], 0
jne 0x838d77
mov byte [esi + 0x2b], 0
mov byte [esi + 0x28], 0
mov byte [esi + 0x2a], 1
mov eax, dword [esp + 0x10]
mov ecx, eax
neg ecx
cmp byte [esp + 3], 0x2d
cmovne ecx, eax
xor edi, edi
mov dword [esi + 8], ecx
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x10], eax
cmp byte [esi + 0x2c], 0
je 0x838d77
mov ecx, esi
call fcn.008372b0
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00980459
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x8398b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0xbcbae0]
mov esi, edx
mov edx, ecx
xor eax, esp
mov dword [esp + 0xc], eax
movzx eax, byte [edx]
mov edi, edx
inc edx
test byte [eax + 0xb436b8], 1
jne 0x8398c6
mov dword [esi + 0x1c], 0
mov al, byte [edi]
cmp al, 0x2d
jne 0x8398eb
mov dword [esp], 0xffffffff
jmp 0x8398fa
cmp al, 0x2b
jne 0x8399a7
mov dword [esp], 1
mov ebp, fcn.007bd3b0
xor eax, eax
movzx ebx, byte [0xbb5e4f]
imul ebp, ebp
and ebp, 3
cmp ebp, 2
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x839a70
mov al, byte [0xbb5e4f]
xor ebx, ebx
cmp ebp, 2
mov ah, 1
sete bl
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb5e4f], ah
jne 0x83992f
mov ecx, fcn.007bd3b0
xor ebx, ebx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete bl
mov ebp, ebx
not ebx
lea ebx, [ebp + ebx*2 + 4]
and bl, 7
xor bl, 7
movzx ebx, bl
bt eax, ebx
jae 0x8399bc
xor eax, eax
cmp ecx, 2
movzx ebp, byte [0xbb5e4f]
sete al
mov ebx, eax
not ebx
lea eax, [eax + ebx*2 + 4]
and al, 7
movzx eax, al
bt ebp, eax
jae 0x839981
jmp 0x839a70
mov ecx, eax
or cl, 0x20
cmp cl, 0x7a
je 0x839aa4
test al, al
jmp 0x839aba
xor eax, eax
cmp ecx, 2
movzx ebx, byte [0xbb5e4f]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x839a45
mov ecx, fcn.007bd3b0
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete al
mov ecx, eax
not ecx
and ecx, 0x8b
lea ecx, [eax + ecx*2 - 0x285d30cc]
mov eax, dword [0xbb5e40]
mov ebx, ecx
shr ebx, 0x1f
or ebx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb5e40], eax
not eax
imul ebx, eax
mov eax, dword [0xbb5e44]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbb5e44], eax
or ebp, ebx
not eax
imul eax, ebp
xor dword [0xbb5e48], eax
mov ah, 1
shl ah, cl
or byte [0xbb5e4f], ah
mov eax, fcn.007bd3b0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
sete cl
mov eax, ecx
not eax
lea ecx, [ecx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb5e4f], al
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push 0xbb5e40
push edx
call fcn.008397f0
add esp, 0x10
mov cl, 1
cmp eax, 2
jne 0x839abd
imul eax, dword [esp + 8], 0x3c
add edi, 6
mov edx, edi
add eax, dword [esp + 4]
imul eax, dword [esp]
mov dword [esi + 0x1c], eax
movzx ecx, byte [edx]
mov eax, edx
inc edx
test byte [ecx + 0xb436b8], 1
jne 0x839aa4
mov byte [esi + 0x2d], 1
cmp byte [eax], 0
setne cl
movzx esi, cl
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x83b2a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edx, 0x98b2de
mov esi, ecx
xor eax, eax
movzx edi, byte [0xbb6627]
not edx
and edx, 1
mov ecx, edx
add ecx, 0x98b2de
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edi, eax
jb 0x83b3fd
mov al, byte [0xbb6627]
mov edi, edx
xor ecx, ecx
mov ah, 1
add edi, 0x98b2de
sete cl
mov ebx, ecx
not ebx
lea ecx, [ebx + ecx*2]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb6627], ah
jne 0x83b2dd
mov ecx, 0x98b2de
xor edx, edx
movzx eax, al
not ecx
and ecx, 1
mov edi, ecx
add edi, 0x98b2de
sete dl
mov ebx, edx
not ebx
lea edx, [ebx + edx*2]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x83b360
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb6627]
add edx, 0x98b2de
sete al
mov edx, eax
not edx
lea eax, [edx + eax*2]
and al, 7
movzx eax, al
bt edi, eax
jae 0x83b336
jmp 0x83b3fd
xor eax, eax
add ecx, 0x98b2de
movzx edx, byte [0xbb6627]
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edx, eax
jb 0x83b3d2
mov eax, 0x98b2de
xor ecx, ecx
mov edi, dword [0xbb661c]
not eax
and eax, 1
add eax, 0x98b2de
sete cl
mov eax, ecx
xor eax, 0xc3e4ea87
lea ecx, [eax + ecx*2 + 0x8a0]
mov edx, ecx
xor edi, ecx
shr edx, 0x1f
mov dword [0xbb661c], edi
not edi
or edx, ecx
and cl, 7
imul edx, edi
xor dword [0xbb6620], edx
mov dl, 1
shl dl, cl
or byte [0xbb6627], dl
mov eax, 0x98b2de
xor ecx, ecx
not eax
and eax, 1
add eax, 0x98b2de
sete cl
mov eax, ecx
not eax
lea ecx, [eax + ecx*2]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb6627], al
push 2
push 0xbb661c
push esi
call fcn.00789400
add esp, 0xc
cmp eax, 7
je 0x83b416
pop esi
pop edi
pop ebx
ret
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.0077e7a0

Function at 0x871dc0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
call fcn.0087c750
add esp, 4
test eax, eax
mov dword [esi], eax
jne 0x871de3
push 1
call fcn.00871cd0
add esp, 4
xor eax, eax
pop esi
ret
push 0x872070
push eax
call fcn.0087d340
add esp, 8
push 0x8721b0
push 0x8720c0
push dword [esi]
call fcn.0087d2c0
add esp, 0xc
push 0x872260
push dword [esi]
call fcn.0087d2f0
add esp, 8
push esi
push dword [esi]
call fcn.0087d1f0
add esp, 8
mov eax, 1
pop esi
ret
Function at 0x882350
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x88243e
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x14], edx
mov ebp, dword [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x10]
mov ecx, dword [esp]
add ecx, esi
mov dword [esp], ecx
mov ecx, ebp
adc edi, ebp
shld ecx, esi, 0xd
shld esi, ebp, 0xd
mov ebp, edx
xor ecx, edi
xor esi, dword [esp]
add ebx, eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
adc ecx, edx
shld ebp, eax, 0x10
shld eax, edx, 0x10
xor ebp, ecx
mov dword [esp + 0x18], ecx
mov ecx, edi
mov edi, dword [esp]
xor eax, ebx
add ecx, eax
mov edx, ebp
mov dword [esp], ecx
adc edi, ebp
shld edx, eax, 0x15
shld eax, ebp, 0x15
mov ebp, dword [esp + 8]
xor eax, ecx
xor edx, edi
add ebx, esi
mov ecx, dword [esp + 8]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x18]
adc ebx, dword [esp + 8]
shld ebp, esi, 0x11
shld esi, ecx, 0x11
mov ecx, dword [esp + 0xc]
xor esi, dword [esp + 4]
inc ecx
xor ebp, ebx
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
jne 0x88238d
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], esi
mov esi, dword [esp]
mov dword [ecx + 0xc], ebp
mov dword [ecx + 4], edi
mov dword [ecx], esi
mov dword [ecx + 0x1c], edx
mov edx, dword [esp + 4]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x88e9d0
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov ebp, ecx
mov eax, 0xffffffff
mov ecx, esi
sub ecx, edx
cmp ecx, 2
jl 0x88eb0f
mov al, byte [edx]
mov edi, dword [esp + 0x20]
mov ebx, edx
test al, al
jne 0x88ea06
movzx eax, byte [ebx + 1]
movzx eax, byte [ebp + eax + 0x48]
jmp 0x88ea12
movsx edx, byte [ebx + 1]
movsx ecx, al
call fcn.0088b750
add eax, 0xffffffec
cmp eax, 7
ja case.0x88ea1a.21
jmp dword [eax*4 + 0xb577a8]
add ebx, 2
mov ecx, ebp
mov edx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0088f0a0
add ebx, 2
mov eax, 0x21
mov dword [edi], ebx
jmp 0x88eb0f
mov dword [esp + 4], ebp
lea eax, [ebx + 2]
mov ebp, esi
sub ebp, eax
cmp ebp, 2
jge 0x88ea64
mov eax, 0xffffffff
jmp 0x88eb0f
mov dword [edi], ebx
jmp 0x88eb0d
mov dword [esp], edi
movzx ecx, byte [ebx + 2]
mov edi, eax
movzx eax, byte [ebx + 3]
test cl, cl
jne 0x88ea80
mov ecx, dword [esp + 4]
movzx eax, byte [ecx + eax + 0x48]
jmp 0x88ea8b
movsx ecx, cl
movsx edx, al
call fcn.0088b750
cmp eax, 0x1e
ja 0x88eb08
mov ecx, 0x1400000
bt ecx, eax
jb 0x88eaef
mov ecx, 0x200600
bt ecx, eax
jb 0x88eae3
cmp eax, 0x1e
jne 0x88eb08
cmp ebp, 4
mov eax, 0xffffffff
jl 0x88eb0f
mov cl, byte [ebx + 4]
movzx eax, byte [ebx + 5]
test cl, cl
jne 0x88eac9
mov ecx, dword [esp + 4]
movzx eax, byte [ecx + eax + 0x48]
jmp 0x88ead4
movsx ecx, cl
movsx edx, al
call fcn.0088b750
cmp eax, 0x1e
ja 0x88eae3
mov ecx, 0x40200600
bt ecx, eax
jb 0x88eb08
mov eax, dword [esp]
mov dword [eax], edi
mov eax, 0x10
jmp 0x88eb0f
lea eax, [edi + 2]
mov ebp, esi
mov ebx, edi
sub ebp, eax
cmp ebp, 1
jg 0x88ea67
mov eax, 0xffffffff
jmp 0x88eb0f
mov eax, dword [esp]
mov dword [eax], edi
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x93f380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov eax, dword [0xbcbae0]
mov ebp, dword [esp + 0xac]
xor eax, esp
mov dword [esp + 0x90], eax
push ebp
call fcn.00948e30
add esp, 4
mov esi, eax
test eax, eax
jne 0x93f4bd
mov ebx, dword [esp + 0xb4]
mov edi, dword [esp + 0xa8]
test ebx, ebx
mov dword [edi + 0x110], ebp
jne 0x93f3d4
mov esi, 0x20001
jmp 0x93f4bd
imul edx, ebp, 0x64
mov esi, 0x16
mov eax, dword [edx + 0xc20394]
cmp eax, 0x80
ja 0x93f4bd
mov ecx, dword [edx + 0xc20398]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
lea esi, [edx + 0xc20398]
mov dword [esp + 8], edx
cmp ecx, ebx
jae 0x93f44c
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp], esi
lea ecx, [edi + 0x228]
push edx
push ecx
push ebx
push eax
push ebp
call fcn.009447d0
add esp, 0x14
mov edx, dword [esp + 4]
mov esi, eax
test eax, eax
jne 0x93f4bd
mov esi, dword [esp]
mov eax, dword [esi]
mov ecx, eax
sub ecx, edx
jbe 0x93f478
lea eax, [edi + edx + 0x228]
jmp 0x93f46c
lea ecx, [edi + 0x228]
push ebx
push eax
push ecx
call fcn.0097cbc0
add esp, 0xc
mov eax, dword [esi]
mov ecx, eax
sub ecx, ebx
jbe 0x93f478
lea eax, [edi + ebx + 0x228]
push ecx
push eax
call fcn.0097f670
add esp, 8
mov eax, dword [esi]
mov ebx, esi
test eax, eax
je 0x93f494
xor ecx, ecx
movzx edx, byte [edi + ecx + 0x228]
xor dl, 0x36
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, eax
jb 0x93f480
push edi
mov esi, dword [esp + 0xc]
call dword [esi + 0xc203e0]
mov ecx, esi
add esp, 4
mov esi, eax
test eax, eax
jne 0x93f4bd
lea eax, [esp + 0x10]
push dword [ebx]
push eax
push edi
call dword [ecx + 0xc203e4]
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x94
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x93f510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0xbcbae0]
mov ebx, dword [esp + 0x11c]
xor eax, esp
mov dword [esp + 0x104], eax
mov edi, dword [ebx + 0x110]
push edi
call fcn.00948e30
add esp, 4
mov esi, eax
test eax, eax
jne 0x93f628
imul ebp, edi, 0x64
lea edi, [esp + 4]
mov eax, dword [ebp + 0xc20394]
mov dword [esp], eax
push edi
push ebx
call dword [ebp + 0xc203e8]
add esp, 8
mov esi, eax
test eax, eax
jne 0x93f628
mov eax, dword [ebp + 0xc20398]
test eax, eax
je 0x93f590
xor ecx, ecx
movzx edx, byte [ebx + ecx + 0x228]
xor dl, 0x5c
mov byte [esp + ecx + 0x84], dl
inc ecx
cmp ecx, eax
jb 0x93f579
push ebx
call dword [ebp + 0xc203e0]
add esp, 4
mov esi, eax
test eax, eax
jne 0x93f628
lea eax, [ebp + 0xc20398]
lea ecx, [esp + 0x84]
push dword [eax]
push ecx
push ebx
call dword [ebp + 0xc203e4]
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x93f628
lea eax, [ebp + 0xc203e4]
push dword [esp]
push edi
push ebx
call dword [eax]
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x93f628
lea ecx, [esp + 0x84]
lea eax, [ebp + 0xc203e8]
push ecx
push ebx
call dword [eax]
add esp, 8
mov esi, eax
test eax, eax
jne 0x93f628
mov edi, dword [esp]
mov eax, dword [esp + 0x124]
xor esi, esi
mov ecx, 0
test edi, edi
je 0x93f626
mov edx, dword [esp + 0x120]
xor ecx, ecx
cmp ecx, dword [eax]
jae 0x93f626
movzx ebx, byte [esp + ecx + 0x84]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, edi
jb 0x93f612
mov dword [eax], ecx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x944880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0xbcbae0]
mov ebx, dword [esp + 0x3c]
xor eax, esp
mov dword [esp + 0x18], eax
push dword [ebx]
call fcn.00948e00
add esp, 4
mov edi, eax
test eax, eax
jne 0x944936
mov ecx, dword [ebx + 4]
mov edi, 0x16
lea eax, [ecx - 1]
cmp eax, 0x7f
ja 0x944936
mov eax, dword [esp + 0x38]
xor edx, edx
mov dword [esp + 4], eax
div ecx
and ecx, 3
or ecx, edx
jne 0x944936
imul edx, dword [ebx], 0x58
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ecx, dword [edx + 0xc21044]
test ecx, ecx
jne 0x94494b
cmp dword [esp + 0x38], 0
je 0x944934
lea eax, [ebx + 0x88]
lea ecx, [esp + 8]
mov dword [esp], eax
push eax
push ecx
push ebp
call dword [edx + 0xc2102c]
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x944936
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x94492e
mov ecx, dword [esp + eax + 8]
mov edx, dword [ebp + eax]
xor ecx, dword [ebx + eax + 8]
mov dword [ebx + eax + 8], edx
mov dword [esi + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x944911
sub dword [esp + 4], ecx
jne 0x94496f
xor edi, edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00980459
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebx + 0x88]
add ebx, 8
push edx
push ebx
push eax
push esi
push ebp
call ecx
add esp, 0x14
mov ecx, dword [esp + 0x18]
mov esi, eax
xor ecx, esp
call fcn.00980459
mov eax, esi
jmp 0x944943
imul eax, dword [ebx], 0x58
add esi, ecx
add ebp, ecx
push dword [esp]
lea ecx, [esp + 0xc]
push ecx
push ebp
call dword [eax + 0xc2102c]
jmp 0x9448ff

Function at 0x944c00
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, edx
mov ebp, ecx
push 0xbc50f4
call fcn.00979900
add esp, 4
xor edi, edi
test eax, eax
je 0x944c4d
mov ebx, eax
push str.SystemFunction036
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x944c35
push ebx
call sub.KERNEL32.dll_FreeLibrary
jmp 0x944c4d
push esi
push ebp
call eax
mov byte [esp + 3], al
push ebx
call sub.KERNEL32.dll_FreeLibrary
xor edi, edi
cmp byte [esp + 3], 1
cmove edi, esi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x944d0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0xbcbae0]
xor eax, ebp
test edx, edx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
je 0x944d25
mov esi, dword [esp + 8]
xor ebx, ebx
xor eax, eax
xor edi, edi
mov dword [esp + 0x10], ecx
mov ecx, 7
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp + 0x14], ecx
call fcn.00944d40
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push ebx
push 8
lea eax, [esp + 0x20]
push eax
call fcn.0097e5e0
add esp, 0xc
mov ebx, eax
and eax, 1
xor edi, eax
call fcn.00944d40
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push ebx
push 8
lea eax, [esp + 0x20]
push eax
call fcn.0097e5e0
add esp, 0xc
mov ebx, eax
and eax, 1
xor eax, esi
mov esi, edi
cmp edi, eax
je 0x944ca8
mov ecx, dword [esp + 4]
add ecx, ecx
or ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
lea ecx, [ecx - 1]
jne 0x944ca2
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov byte [ecx], dl
dec esi
lea ecx, [ecx + 1]
jne 0x944c8d
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.00980459
mov eax, dword [esp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x945d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x30]
push dword [ebx]
call fcn.00948e00
add esp, 4
test eax, eax
jne 0x945e83
mov ecx, dword [ebx + 4]
mov eax, 0x16
lea edx, [ecx - 1]
cmp edx, 0x7f
ja 0x945e83
test cl, 3
jne 0x945e83
mov edx, dword [ebx + 8]
cmp edx, 0x80
ja 0x945e83
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
cmp edx, ecx
jne 0x945dd4
cmp ecx, esi
ja 0x945dd4
imul eax, dword [ebx], 0x58
mov eax, dword [eax + 0xc21048]
test eax, eax
je 0x945dd4
lea edx, [ebx + 0x110]
mov dword [esp + 8], eax
mov eax, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0xc]
mov dword [esp], edx
lea edx, [ebx + 0x10]
mov dword [esp + 4], edx
xor edx, edx
div ecx
push dword [esp + 0xc]
push dword [esp + 4]
push dword [esp + 0xc]
push eax
push ebp
push edi
call dword [esp + 0x20]
add esp, 0x18
test eax, eax
jne 0x945e83
mov ecx, dword [ebx + 4]
mov eax, esi
xor edx, edx
div ecx
mov esi, edx
xor eax, eax
test esi, esi
je 0x945e83
lea eax, [ebx + 0x110]
lea edx, [ebx + 0x10]
mov dword [esp + 8], eax
lea eax, [ebx + 0x90]
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
cmp eax, ecx
jne 0x945e30
push ebx
call fcn.0094b4c0
add esp, 4
imul eax, dword [ebx], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0xc21028]
add esp, 0xc
test eax, eax
jne 0x945e83
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 4]
jmp 0x945e34
test eax, eax
jne 0x945e6c
xor eax, eax
cmp esi, ecx
jb 0x945e6c
xor eax, eax
test ecx, ecx
jle 0x945e58
mov ecx, dword [ebx + eax + 0x90]
xor ecx, dword [edi + eax]
mov dword [ebp + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x945e40
add edi, ecx
add ebp, ecx
sub esi, ecx
mov dword [ebx + 8], ecx
xor eax, eax
test esi, esi
je 0x945e83
mov ecx, dword [ebx + 4]
jmp 0x945df8
mov cl, byte [edi]
lea edx, [eax + 1]
inc edi
dec esi
mov dword [ebx + 8], edx
xor cl, byte [ebx + eax + 0x90]
mov byte [ebp], cl
inc ebp
jmp 0x945e61
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret