joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7eaff9
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x7eb042
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.007c4a32
fmul qword [0x5e0598]
add esp, 4
call fcn.009247a2
xor dword [esi + 0x230], eax
movzx eax, byte [edi]
mov cl, byte [esi + eax + 0x130]
xor cl, byte [esi + 0x230]
mov byte [edi], cl
mov ecx, dword [esi + 0x230]
xor ecx, eax
inc edi
dec ebx
mov dword [esi + 0x230], ecx
jne 0x7eb003
pop edi
pop esi
pop ebx
ret 8

Function at 0x7eb059
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x7eb0a8
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.007c4a32
fmul qword [0x5e0598]
add esp, 4
call fcn.009247a2
mov ecx, dword [esi + 0x230]
xor ecx, eax
mov dword [esi + 0x230], ecx
mov eax, ecx
movzx ecx, byte [edi]
xor ecx, eax
mov al, byte [ecx + esi + 0x30]
mov byte [edi], al
movzx edx, al
mov eax, dword [esi + 0x230]
xor eax, edx
inc edi
dec ebx
mov dword [esi + 0x230], eax
jne 0x7eb063
pop edi
pop esi
pop ebx
ret 8

Function at 0x7ec782
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d7378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.007e8392
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
lea eax, [ecx*4 - 4]
push eax
mov dword [esi], 0x5ff334
mov dword [esi + 0x18], edx
mov dword [esi + 0x24], ecx
call fcn.0083d822
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x14], eax
add esp, 4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x7ec798
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d7378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.007e8392
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
lea eax, [ecx*4 - 4]
push eax
mov dword [esi], 0x5ff334
mov dword [esi + 0x18], edx
mov dword [esi + 0x24], ecx
call fcn.0083d822
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x14], eax
add esp, 4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x8415b2
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x8415c1
mov edi, 1
push edi
call fcn.00925b97
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x841615
push esi
call fcn.009252f3
mov esi, eax
call fcn.00844ef2
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x8415f8
mov edx, dword [0x67ebd8]
mov dword [fcn.0067ebd4], edx
test al, 0x18
je 0x841609
push edi
push 0x24
push 5
call fcn.00844652
add esp, 0xc
test esi, esi
pop esi
je 0x841630
push 1
call fcn.00924238
test byte [esp + 0x10], 0x20
je 0x841630
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x84ce32
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 0x24], cx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
xor eax, eax
ret
Function at 0x868dd2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [ebx + 0x35c]
mov eax, dword [esi + 0x2c]
mov eax, dword [eax]
movzx ecx, word [eax + 0x152]
mov ebp, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [esp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x20], ecx
mov cl, byte [eax]
cmp cl, 0xff
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
je 0x868e15
movzx edi, cl
inc edi
jmp 0x868e2a
movzx cx, byte [ebp + 0xd]
movzx di, byte [ebp + 0xe]
shl ecx, 8
add ecx, edi
movzx edi, cx
add edi, 3
lea ecx, [edi + ebp + 0xc]
mov dword [esp + 0x14], ecx
cmp dword [ebp], 0
je 0x868eb3
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push edx
push ebx
call fcn.008655e2
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
add esp, 0x14
test eax, eax
lea esi, [ecx + edx]
mov dword [esp + 0x10], esi
jne 0x868f69
jmp 0x868e64
mov esi, dword [esp + 0x10]
cmp esi, dword [ebp]
jae 0x868f69
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x24]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.008655e2
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
add edx, ecx
add esp, 0x14
test eax, eax
mov dword [esp + 0x10], edx
je 0x868e60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push ebx
call fcn.00865a32
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
neg eax
mov edx, eax
mov ecx, eax
mov byte [edi + ebp + 0xf], al
shr edx, 8
mov byte [edi + ebp + 0xe], dl
mov edx, dword [esp + 0x18]
shr ecx, 0x10
mov byte [edi + ebp + 0xd], cl
mov ecx, dword [esp + 0x14]
shr eax, 0x18
mov byte [edx], al
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebx + 0x330]
mov ecx, dword [edx + eax*8 + 4]
mov edx, dword [edx + eax*8]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
lea eax, [edi + ebp + 0x10]
push eax
push ecx
call fcn.00878e82
mov edx, dword [esi + 0x30]
mov eax, dword [edx + 0x78]
mov ecx, dword [esi + 0x3c]
imul eax, eax, 0x41c
sub ecx, eax
mov dword [esi + 0x38], ecx
mov eax, dword [ebx + 0x330]
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x180]
mov edx, eax
imul edx, edx, 0x38
add edx, edi
mov dword [ebx + 0x354], edx
mov ecx, dword [ecx + 0x6c]
mov dword [ecx + eax*8], 0xffffffff
mov dword [ecx + eax*8 + 4], 0xffffffff
mov eax, dword [esp + 0x38]
add esp, 0x14
test eax, eax
jne 0x868f69
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x38]
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
push eax
push ebx
call fcn.008655e2
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x88e4f2
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x88e50e
cmp dword [edi], 0x2d9507b3
je 0x88e50e
push edi
call fcn.0088e3e2
add esp, 4
mov ebx, dword [esp + 0x18]
test ebx, ebx
mov esi, dword [esp + 0x14]
je 0x88e51e
mov eax, ebx
jmp 0x88e578
mov eax, dword [esp + 0x1c]
add esi, 7
and esi, 0xfffffff8
add esi, 0x40
test eax, eax
jne 0x88e540
mov eax, dword [0x761d18]
push eax
push esi
call fcn.008d0162
add esp, 8
jmp 0x88e578
cmp esi, 0x2000
jae 0x88e55a
mov ecx, dword [0x761d18]
push ecx
push esi
call fcn.008d0162
add esp, 8
jmp 0x88e578
test al, 2
mov esi, 0x4000
je 0x88e573
test edi, edi
je 0x88e573
mov eax, dword [edi + 0x38]
mov dword [edi + 0x38], 0
jmp 0x88e578
call fcn.008cd852
test eax, eax
jne 0x88e580
pop edi
pop esi
pop ebx
ret
mov edi, dword [esp + 0x20]
mov ecx, edi
push ebp
mov dword [eax], 0x2d9507b3
lea ebp, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x88e592
sub ecx, ebp
lea edx, [ecx + edi - 7]
mov edi, dword [edx]
lea ecx, [eax + 4]
mov dword [ecx], edi
mov di, word [edx + 4]
mov word [ecx + 4], di
mov dl, byte [edx + 6]
mov byte [ecx + 6], dl
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov dword [eax + 0xc], ecx
mov ecx, 0x40
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
xor ecx, ecx
test ebx, ebx
setne cl
pop ebp
pop edi
mov dword [eax + 0x24], esi
pop esi
mov byte [eax + 0xb], 0
mov dword [eax + 0x28], edx
mov dword [eax + 0x38], 0
mov dword [eax + 0x2c], ecx
pop ebx
ret

Function at 0x88e9e2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x88ea17
push esi
lea ecx, [ecx]
movsx ecx, cl
mov esi, ecx
xor esi, eax
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add esi, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
mov eax, esi
jne 0x88e9f2
pop esi
ret
Function at 0x88f242
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
jmp 0x88f252
mov esi, dword [edi + 0xbc]
mov ecx, dword [0x7608c0]
xor eax, eax
cmp esi, 0xa
setne al
add eax, ecx
jne 0x88f2e5
push 0x75a7d0
call fcn.0088e022
add esp, 4
push 0x10c
push 0x6447ec
call fcn.0088de12
push eax
call fcn.0088de02
mov ecx, dword [0x67fa0c]
add esp, 4
push eax
push ecx
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
push 0x644a5c
call fcn.00925512
mov edx, dword [0x67fa10]
push 0x75a7d0
push edx
call fcn.00925512
mov eax, dword [0x7608c8]
mov dword [0x7608c4], 1
mov ecx, dword [eax]
add esp, 0x24
test ecx, ecx
je 0x88f2ee
mov dword [0x7608c8], 0
jmp 0x88f2ee
mov eax, dword [0x7608c4]
test eax, eax
je 0x88f325
push 0x10c
push 0x6447ec
call fcn.0088de12
push eax
call fcn.0088de02
mov ecx, dword [0x67fa14]
add esp, 4
push eax
push ecx
push 0x75a7d0
call fcn.00924278
push 0x3b9aca00
call fcn.0088de82
add esp, 0x18
cmp esi, 0x11
mov dword [edi + 0xbc], 0xa
je 0x88f476
cmp esi, 0x22
je 0x88f476
cmp esi, 0x25
je 0x88f476
cmp esi, 0x24
je 0x88f476
cmp esi, 0x26
je 0x88f476
cmp esi, 0xe
jne 0x88f396
push ebx
call fcn.008891d2
mov eax, dword [edi + 0xbc]
add esp, 4
cmp eax, 0xa
je 0x88f383
push ebx
call fcn.008e4fe2
add esp, 4
jmp 0x88f252
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [edx], 0xe
mov eax, 1
pop ebx
ret
cmp esi, 0xf
je 0x88f470
cmp esi, 0x23
je 0x88f470
cmp esi, 0x2d
je 0x88f470
cmp esi, 0xd
je 0x88f476
cmp esi, 0x20
jne 0x88f3d8
push 0x75a7d0
push 0x6449c0
call fcn.00925512
add esp, 8
push 1
call fcn.00924238
cmp esi, 0x27
jne 0x88f3f4
push 0x75a7d0
push 0x644820
call fcn.00925512
add esp, 8
jmp 0x88f48a
push esi
push 0x644800
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
call fcn.0088e022
add esp, 0x10
push 0x15e
push 0x6447ec
call fcn.0088de12
push eax
call fcn.0088de02
add esp, 4
push eax
mov eax, dword [0x67fa0c]
push eax
push 0x75a7d0
call fcn.00924278
mov ecx, dword [0x67fa10]
push ecx
push 0x75a7d0
call fcn.00924278
mov edx, dword [0x7608c8]
mov dword [0x7608c4], 1
mov eax, dword [edx]
add esp, 0x1c
test eax, eax
je 0x88f48a
mov dword [0x7608c8], 0
jmp 0x88f48a
push 0
push 0
jmp 0x88f481
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x88f48a
push eax
push 1
push edi
call fcn.0089f682
add esp, 0xc
mov eax, dword [edi + 0xbc]
cmp eax, 0xa
je 0x88f4ab
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov dword [edi + 0xbc], 0xa
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x10]
mov dword [edx], esi
mov dword [edi + 0xbc], 0xa
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x895752
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
test eax, eax
mov dword [esp], 0
je 0x895767
mov dword [esp], 1
push ebp
mov ebp, dword [esi + 4]
push edi
mov edi, dword [esi + 0xbc]
test edi, edi
mov dword [esp + 0xc], ebp
je 0x8957b2
jmp 0x895782
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 8]
cmp dword [eax], 0x10
jne 0x8957a2
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x8957ab
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [ecx + 0x10]
mov dword [eax + 0x10], ecx
jmp 0x8957ab
push eax
call fcn.008fa8d2
add esp, 4
mov edi, dword [edi + 0x38]
test edi, edi
jne 0x895782
mov eax, dword [esi + 0x88]
test eax, eax
je 0x895868
push ebx
mov ebx, dword [eax + 4]
cmp dword [esi + 0x90], ebx
jae 0x8957f9
mov edx, dword [esi + 0x84]
mov eax, dword [edx + ebx*4 - 4]
cmp dword [eax], 0x10
jne 0x8957f0
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x8957f9
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [ecx + 0x10]
mov dword [eax + 0x10], ecx
jmp 0x8957f9
push eax
call fcn.008fa8d2
add esp, 4
xor edx, edx
test ebx, ebx
jbe 0x895830
xor edi, edi
nop
mov eax, dword [esi + 0x84]
mov eax, dword [eax + edx*4]
mov ecx, dword [esi + 0x88]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [eax + 0xc]
add eax, 0xc
add ecx, edi
mov dword [ecx], ebp
mov eax, dword [eax + 4]
inc edx
add edi, 0x18
cmp edx, ebx
mov dword [ecx + 4], eax
jb 0x895802
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x44]
mov ecx, dword [esi + 0x8c]
mov edx, dword [esi + 0x88]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
lea edi, [esi + 8]
push edi
push eax
push ecx
push edx
push 0
push ebp
mov dword [edi + 0x38], eax
mov dword [edi + 0x58], ecx
call fcn.008abe42
add esp, 0x20
pop ebx
jmp 0x895897
mov ecx, dword [esi + 0x74]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x44]
xor edx, edx
test ecx, ecx
sete dl
lea edi, [esi + 8]
mov dword [edi + 0x38], eax
lea edx, [edx + edx + 1]
mov dword [edi + 0x58], edx
mov edx, dword [esp + 0x18]
push edx
push edi
push eax
push ebp
push ecx
call fcn.008ac322
add esp, 0x14
mov dword [edi + 0x5c], 0
mov dword [edi + 0x3c], 0x7514483
mov dword [edi + 0x54], 0x7711e160
pop edi
mov dword [esi + 0x78], 1
pop ebp
add esp, 8
ret
Function at 0x89a9f2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jbe 0x89aa23
mov edx, dword [esp + 8]
push edi
movzx ecx, byte [edx]
mov edi, ecx
xor edi, eax
xor edi, 0xff946a4f
shl edi, 8
add edi, eax
xor edi, 0x573ed587
add edi, ecx
inc edx
dec esi
mov eax, edi
jne 0x89aa02
pop edi
pop esi
ret

Function at 0x89b012
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x761c24]
add eax, 0x4c
mov dword [esp], 1
mov dword [esp + 4], eax
mov ecx, dword [esp + 4]
mov edx, 1
xchg dword [ecx], edx
mov dword [esp + 8], edx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x89b052
push 0x266
push 0x648aec
push eax
call fcn.008c9802
add esp, 0xc
push ebx
push ebp
mov ebp, dword [0x761c24]
mov ecx, dword [ebp + 0x8c]
test ecx, ecx
push edi
mov edi, 0xfffffffe
mov ebx, edi
je 0x89b0a7
push esi
jmp 0x89b072
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 4]
sub eax, 0x800
imul eax, esi
cmp eax, edi
jae 0x89b086
mov edi, eax
mov edx, dword [ecx + 8]
lea eax, [edx - 0x800]
imul eax, esi
sub eax, edx
sub eax, 0xf800
cmp eax, ebx
jae 0x89b09f
mov ebx, eax
mov ecx, dword [ecx + 0x50]
test ecx, ecx
jne 0x89b072
pop esi
mov eax, 0xcccccccd
mul edi
mov eax, dword [0x67f9cc]
shr edx, 3
sub edi, edx
add eax, 0xc
mov ecx, edi
shl eax, 0x10
shr ecx, 1
cmp eax, ecx
jb 0x89b0d0
mov dword [esp + 0xc], 0
jmp 0x89b141
mov ecx, edi
sub ecx, eax
mov eax, dword [ebp + 0xec]
cmp ecx, eax
jbe 0x89b0e0
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 3
sub ecx, edx
mov dword [ebp + 0xe0], edi
mov edx, ecx
shr edx, 3
mov eax, ecx
sub eax, edx
mov edx, dword [0x761c24]
mov dword [edx + 0xe4], eax
mov eax, ecx
shr eax, 4
mov edx, ecx
sub edx, eax
mov eax, dword [0x761c24]
mov dword [eax + 0xe8], edx
mov edx, ecx
shr edx, 5
mov eax, ecx
sub eax, edx
mov edx, dword [0x761c24]
mov dword [edx + 0xf0], eax
mov eax, dword [0x761c24]
mov dword [eax + 0xf4], ecx
mov ebp, dword [0x761c24]
lea eax, [ebp + 0x4c]
mov dword [esp + 0x14], eax
mov edx, 0
mov ecx, dword [esp + 0x14]
xchg dword [ecx], edx
mov ecx, dword [eax + 4]
test ecx, ecx
pop edi
pop ebp
pop ebx
je 0x89b166
push eax
call fcn.008c9a42
add esp, 4
mov eax, dword [esp]
test eax, eax
jne 0x89b18d
mov ecx, dword [0x67f9cc]
push ecx
push 0x648b00
push 0x75a7d0
call fcn.00924278
add esp, 0xc
push 1
call fcn.00924238
add esp, 0xc
ret
Function at 0x8a22d2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x34]
push ebx
push ebp
xor eax, eax
cmp edx, eax
push esi
push edi
mov dword [esp + 0x14], eax
jbe 0x8a2445
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x20]
mov ebp, dword [edx + 0x38]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp + edi + 4]
mov al, byte [ecx]
add ebp, edi
xor edx, edx
test al, al
je 0x8a2336
lea esp, [esp]
movsx eax, al
mov esi, eax
xor esi, edx
xor esi, 0xff946a4f
shl esi, 8
add esi, edx
xor esi, 0x573ed587
add esi, eax
mov al, byte [ecx + 1]
inc ecx
test al, al
mov edx, esi
jne 0x8a2312
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x10]
mov esi, ebx
mov al, byte [esi]
xor ecx, ecx
test al, al
je 0x8a236b
movsx eax, al
mov edi, eax
xor edi, ecx
xor edi, 0xff946a4f
shl edi, 8
add edi, ecx
xor edi, 0x573ed587
add edi, eax
mov al, byte [esi + 1]
inc esi
test al, al
mov ecx, edi
jne 0x8a2347
mov eax, dword [0x761c30]
mov esi, dword [eax + 0x30]
mov eax, ecx
xor eax, edx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, edx
xor eax, 0x62946a4f
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi + 8]
mov edi, dword [ecx + edx*4]
test edi, edi
je 0x8a2415
lea ebx, [ebx]
mov esi, dword [ebp + 4]
mov eax, dword [edi + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x8a23cc
test cl, cl
je 0x8a23c8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x8a23cc
add eax, 2
add esi, 2
test cl, cl
jne 0x8a23a8
xor eax, eax
jmp 0x8a23d1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x8a240f
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 0x10]
mov esi, ebx
jmp 0x8a23e2
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x8a2406
test cl, cl
je 0x8a2402
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x8a2406
add eax, 2
add esi, 2
test cl, cl
jne 0x8a23e2
xor eax, eax
jmp 0x8a240b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x8a241f
mov edi, dword [edi]
test edi, edi
jne 0x8a23a2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [ebp], edi
mov edx, dword [ecx + 0x34]
inc eax
add esi, 0x10
cmp eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jb 0x8a22f2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x8adc82
Capabilities:
Terminate process

Disassembly:
push 0
call fcn.008adbc2
add esp, 4
cmp eax, 0x48
jne 0x8adcee
mov eax, dword [0x761c94]
test eax, eax
jne 0x8adceb
test esi, esi
je 0x8adcbb
push 0x75a7d0
call fcn.0088e022
push esi
push 0x64b744
push 0x75a7d0
call fcn.00924278
add esp, 0x10
push 0x75a7d0
call fcn.0088e022
push 0x64b704
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
mov dword [0x761c94], 1
call fcn.00926757
add esp, 0x10
xor eax, eax
ret
cmp eax, 0x4a
jne 0x8adcf9
mov eax, 1
ret
cmp eax, 0x49
je 0x8adceb
test esi, esi
je 0x8add15
push esi
push 0x64b6ec
push 0x75a7d0
call fcn.00924278
add esp, 0xc
mov eax, dword [esp + 4]
push eax
push 0x64b6c8
push 0x75a7d0
call fcn.00924278
push 0x64b6a4
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
call fcn.00926757
add esp, 0x18
push 1
call fcn.00924238
int3
Function at 0x8aebf2
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x7608c0]
sub esp, 8
inc eax
jne 0x8aec78
push 0x75a7d0
call fcn.0088e022
add esp, 4
push 0x80d
push 0x64b43c
call fcn.0088de12
push eax
call fcn.0088de02
mov ecx, dword [0x67fa0c]
add esp, 4
push eax
push ecx
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
push 0x64b98c
call fcn.00925512
mov edx, dword [0x67fa10]
push 0x75a7d0
push edx
call fcn.00925512
mov eax, dword [0x7608c8]
mov dword [0x7608c4], 1
mov ecx, dword [eax]
add esp, 0x24
test ecx, ecx
je 0x8aec81
mov dword [0x7608c8], 0
jmp 0x8aec81
mov eax, dword [0x7608c4]
test eax, eax
je 0x8aecb8
push 0x80d
push 0x64b43c
call fcn.0088de12
push eax
call fcn.0088de02
mov ecx, dword [0x67fa14]
add esp, 4
push eax
push ecx
push 0x75a7d0
call fcn.00924278
push 0x3b9aca00
call fcn.0088de82
add esp, 0x18
mov edx, dword [0x761c78]
mov ecx, dword [0x761c7c]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
push esi
inc edx
add ecx, ebp
mov esi, ebx
push edi
mov dword [0x761c78], edx
mov dword [0x761c7c], ecx
and esi, 0xf
mov eax, dword [esi*4 + 0x763dc0]
mov edx, dword [esp + 0x28]
push eax
mov dword [esp + 0x14], edx
call fcn.008cb362
mov edx, dword [esp + 0x28]
add esp, 4
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
call dword [fcn.005df198]
cmp eax, 0xffffffff
jne 0x8aed30
call dword [fcn.005df10c]
test eax, eax
je 0x8aed30
mov eax, dword [esi*4 + 0x763dc0]
push eax
call fcn.008cb5e2
add esp, 4
jmp 0x8aed64
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push edx
push ebx
call dword [fcn.005df15c]
mov edi, eax
mov eax, dword [esi*4 + 0x763dc0]
push eax
call fcn.008cb5e2
add esp, 4
test edi, edi
je 0x8aed64
cmp dword [esp + 0x14], ebp
je 0x8aee5f
push 0
call fcn.008adbc2
add esp, 4
cmp eax, 0x48
je 0x8aee1d
cmp eax, 0x4a
je 0x8aece4
cmp eax, 0x49
jne 0x8aee6c
call dword [fcn.005df10c]
push eax
push 0x64b948
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
call fcn.00926757
push 0x75a7d0
call fcn.0088e022
add esp, 0x14
push 0x855
push 0x64b43c
call fcn.0088de12
push eax
call fcn.0088de02
mov ecx, dword [0x67fa0c]
add esp, 4
push eax
push ecx
push 0x75a7d0
call fcn.00924278
mov edx, dword [0x67fa10]
push edx
push 0x75a7d0
call fcn.00924278
mov eax, dword [0x7608c8]
mov dword [0x7608c4], 1
mov ecx, dword [eax]
add esp, 0x1c
test ecx, ecx
je 0x8aee13
mov dword [0x7608c8], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [0x761c94]
test eax, eax
jne 0x8aed89
push 0x75a7d0
call fcn.0088e022
push 0x64b704
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
mov dword [0x761c94], 1
call fcn.00926757
add esp, 0x10
jmp 0x8aed89
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push 0x638db0
push 0x64b6c8
push 0x75a7d0
call fcn.00924278
push 0x64b6a4
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
call fcn.00926757
add esp, 0x18
push 1
call fcn.00924238
int3
Function at 0x8cc5e2
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
lea ecx, [ebx + 4]
xor edi, edi
mov esi, 0xb
movzx edx, byte [ecx]
mov eax, edx
xor eax, edi
xor eax, 0xff946a4f
shl eax, 8
add eax, edi
xor eax, 0x573ed587
add eax, edx
movzx edx, byte [ecx + 1]
mov edi, edx
xor edi, eax
xor edi, 0xff946a4f
shl edi, 8
add edi, eax
xor edi, 0x573ed587
add edi, edx
add ecx, 2
dec esi
jne 0x8cc5f3
lea edx, [ebx + 0x26]
xor ecx, ecx
mov ebx, 0xaa3
movzx esi, byte [edx]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, esi
movzx esi, byte [edx + 1]
mov ecx, esi
xor ecx, eax
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, eax
xor ecx, 0x573ed587
add ecx, esi
movzx esi, byte [edx + 2]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, esi
movzx esi, byte [edx + 3]
mov ecx, esi
xor ecx, eax
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, eax
xor ecx, 0x573ed587
add ecx, esi
movzx esi, byte [edx + 4]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 5]
xor eax, 0x573ed587
add eax, esi
mov esi, ecx
xor esi, eax
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add ecx, esi
add edx, 6
dec ebx
jne 0x8cc636
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
ret

Function at 0x8cc6e2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
xor eax, eax
mov edi, 0xd
lea ecx, [ecx]
movzx esi, byte [edx]
mov ecx, esi
xor ecx, eax
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
xor ecx, 0x573ed587
add ecx, esi
mov esi, eax
xor esi, ecx
xor esi, 0xff946a4f
shl esi, 8
add esi, ecx
xor esi, 0x573ed587
add eax, esi
add edx, 2
dec edi
jne 0x8cc6f2
pop edi
pop esi
ret