joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042c6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10042c7e
pop dword [ebp - 0x24]
mov eax, 0x58b732f8
sub eax, 0x48b3067a
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x30174c69
add dword [ebp - 0x34], 0x1e3af8e2
mov dword [ebp - 0x30], 0x2bdc9b7e
add dword [ebp - 0x30], 0x656b0c7
mov dword [ebp - 0x2c], 0xc9aa3175
add dword [ebp - 0x2c], 0x82a212b9
mov dword [ebp - 0x28], 0xa4c65627
sub dword [ebp - 0x28], 0xa4c65627
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x4e3665b4
sub dword [ebp - 0x34], 0xd9c3fc5e
mov dword [ebp - 0x30], 0x2369b9eb
add dword [ebp - 0x30], 0x1e02a78a
mov dword [ebp - 0x2c], 0x568aaa85
add dword [ebp - 0x2c], 0xce4c1e7
mov dword [ebp - 0x28], 0xd1074184
add dword [ebp - 0x28], 0x2ef8be7c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x50e4fd4c
add eax, 0xbf2102c8
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x5873d
push 0
call eax
mov ecx, 0x5229
mov esi, eax
mov edx, 0xab423ade
sub edx, 0x9b397ede
add edx, dword [ebp - 0x24]
mov edi, 0x27bb7704
sub edi, 0x350fa44c
mov dword [ebp - 0xc], 0x9c1c9d1b
mov ebx, dword [edx]
mov dword [ebp - 0x10], 0x4a1da056
xor ebx, edi
xor dword [ebp - 8], ecx
mov dword [esi], ebx
add dword [ebp - 0x18], 0x10036154
add esi, 0xad4cbcbe
sub esi, 0xad4cbcba
add edx, 0xdaf5e9c
sub edx, 0xdaf5e98
loop 0x10042d95
add eax, 0xb9c25096
sub eax, 0xb9c1151f
xor ebx, ebx
add ebx, eax
add eax, 0x6712bba0
add eax, 0x98ed4465
mov ecx, 0xcc751e19
add ecx, 0x438ae1e7
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5e5f30b9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x44480129
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x4016f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x405101], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401737
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401f47
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x401f60
call eax
test eax, eax
jne 0x401f60
push 0xfffffffffffffffe
jmp 0x401f7a
push 1
push 0x405010
push 0x405008
call fcn.00401b41
add esp, 0xc
test eax, eax
je 0x401f80
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401b41
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x401fa6
mov esi, 0x404c1e
mov cl, 0x20
jmp 0x401faf
cmp al, 0x20
ja 0x401fb9
inc esi
mov al, byte [esi]
test al, al
jne 0x401faa
cmp al, 0x20
jbe 0x401fd0
mov al, byte [esi]
cmp al, 0x22
jne 0x401fc2
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x401fbb
jmp 0x401fd0
cmp al, cl
ja 0x401fd6
inc esi
mov al, byte [esi]
test al, al
jne 0x401fcb
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x401fff
movzx eax, word [ebp - 0x14]
jmp 0x402002
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402037
pop ecx
pop esi
leave
ret

Function at 0x402037
Capabilities:
Terminate process

Disassembly:
call fcn.00402081
push 0
push 0x405018
push 0x405014
call fcn.00401b41
push 0
push 0x405020
push 0x40501c
call fcn.00401b41
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000f9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000f9cf
pop dword [ebp - 0x28]
mov eax, 0x810905c7
sub eax, 0x71080bf8
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc5715ffd
add dword [ebp - 0x38], 0x88e0e54e
mov dword [ebp - 0x34], 0xc130dc17
add dword [ebp - 0x34], 0x7102702e
mov dword [ebp - 0x30], 0xbf7a89dc
sub dword [ebp - 0x30], 0x732e45ae
mov dword [ebp - 0x2c], 0x4e2c15cb
sub dword [ebp - 0x2c], 0x4e2c15cb
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6a94d9d2
add dword [ebp - 0x38], 0x9dd8f84
mov dword [ebp - 0x34], 0x902f444d
add dword [ebp - 0x34], 0xb13d1d28
mov dword [ebp - 0x30], 0x2ba01681
add dword [ebp - 0x30], 0x37cf55eb
mov dword [ebp - 0x2c], 0x270d2bcb
add dword [ebp - 0x2c], 0xd8f2d435
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xaf7e0485
add eax, 0x6083ab8f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3f71b
push 0
call eax
mov ecx, 0x1b6e3422
add ecx, 0xe49217aa
mov edi, eax
mov edx, 0x26ac5401
add edx, 0xe9565bff
add edx, dword [ebp - 0x28]
mov esi, 0x26090c6
xor dword [ebp - 4], edx
mov ebx, dword [edx]
xor dword [ebp - 0x20], eax
sub ebx, esi
sub dword [ebp - 0x18], esi
mov dword [edi], ebx
xor dword [ebp - 0x14], ebx
add edi, 0x13259c16
add edi, 0xecda63ee
add edx, 4
loop 0x1000fae6
add eax, 0xe8d70292
add eax, 0x172a1f71
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x704d1ba6
add ecx, 0x9fb2e45a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x6fa3a720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 0x10]
test dh, 0x10
je 0x6fa3a73c
test dword [ebx + 0x58], 0x90000
je 0x6fa3a795
mov eax, dword [ebx + 0x328]
cmp eax, 1
je 0x6fa3a75f
test dh, 0x20
jne 0x6fa3a770
and dh, 0x80
jne 0x6fa3a7e4
mov dword [ebx + 0x328], 1
mov dword [ebx + 0x330], 0
add esp, 0x28
xor eax, eax
pop ebx
ret
test byte [ebx + 0x32c], 2
je 0x6fa3a74c
cmp eax, 0x10
mov dword [ebx + 0x330], 2
jg 0x6fa3a7be
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.6fa3c9e0
test byte [ebx + 0x5d], 0x80
jne 0x6fa3a73c
mov eax, dword [ebx + 0x328]
cmp eax, 1
je 0x6fa3a75f
test byte [ebx + 0x32c], 1
je 0x6fa3a747
cmp eax, 0x10
mov dword [ebx + 0x330], 1
jle 0x6fa3a7fb
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Application_has_requested__d_threads._Using_a_thread_count_greater_than__d_is_not_recommended._n
mov dword [esp + 4], 0x18
mov dword [esp], ebx
call sub.avutil_54.dll_av_log
jmp 0x6fa3a7e9
cmp eax, 0x10
jg 0x6fa3a7be
mov eax, dword [ebx + 0x330]
test al, 2
jne 0x6fa3a788
test al, 1
je 0x6fa3a769
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.6fa3b8d0
Function at 0x6fc72ef0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x7074ac10
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6fc72f50
Function at 0x6fc738c0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x6fc738f8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x6fc738ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6fc738fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6fc738e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x6fd1d790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x50]
mov dword [esp + 0x20], edx
add edx, 0xc
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov edx, dword [edx + 0x4c]
mov dword [esp + 0x28], edx
add edx, 0x10
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x24]
mov esi, dword [edx + 0x3c]
mov edx, dword [esp + 0x20]
mov ecx, esi
mov eax, dword [edx + 0x78]
neg ecx
test edi, edi
lea eax, [eax + ecx*8 - 8]
mov dword [esp + 0x1c], eax
lea eax, [esi - 0x30]
jle 0x6fd1d8c2
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov ebx, dword [esp + 0x24]
add eax, dword [esp + 0x1c]
sub edi, 0x18
mov ecx, edi
movzx edx, byte [ecx + 0x18]
add ebp, 1
imul edx, edx, 0x1010101
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
movzx edx, byte [eax - 1]
add ecx, esi
imul edx, edx, 0x1010101
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
add eax, esi
cmp ebx, ebp
jne 0x6fd1d7f4
mov ebp, dword [esp + 0x1c]
mov ecx, 0xffffffe8
mov edx, esi
sub ecx, esi
mov eax, edi
add ebp, ecx
neg edx
mov edi, ebp
mov ebx, 0x18
mov dword [esp + 0x18], edx
mov ebp, eax
mov dword [esp], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
call sub.msvcrt.dll_memcpy
add edi, dword [esp + 0x18]
sub ebx, 1
jne 0x6fd1d855
mov eax, dword [esp + 0x28]
mov ebp, 0x18
mov edx, dword [esp + 0x1c]
add eax, 0xf
imul eax, esi
lea ebx, [edx + eax - 0x18]
mov eax, dword [esp + 0x24]
imul eax, esi
lea edi, [edx + eax - 0x18]
mov dword [esp], edi
add edi, esi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_memcpy
sub ebp, 1
jne 0x6fd1d890
add dword [esp + 0x20], 4
mov edx, dword [esp + 0x2c]
cmp dword [esp + 0x20], edx
jne 0x6fd1d7a6
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x1c]
lea edi, [edx - 0x18]
mov ebp, edx
jmp 0x6fd1d839
Function at 0x6fd651a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x3c
mov eax, ecx
mov dword [esp + 0x34], edi
mov edi, dword [ecx]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], ebp
test edi, edi
je 0x6fd65310
mov ebx, dword [ecx + 0xb4]
mov esi, dword [esp + 0x40]
lea edx, [ebx - 2]
test esi, esi
mov dword [ecx + 0xb4], edx
jne 0x6fd65280
cmp edx, 0xff
ja 0x6fd65261
lea ebx, [edx + edx]
mov esi, dword [ecx + 0xb0]
mov dword [ecx + 0xb4], ebx
mov ebx, dword [ecx + 0xc0]
add esi, esi
lea edx, [ebx + 1]
mov dword [ecx + 0xb0], esi
mov dword [ecx + 0xc0], edx
test edx, edx
js 0x6fd65261
lea ecx, [edx + 0xd]
mov ebx, esi
shr ebx, cl
lea ecx, [edx - 8]
mov dword [eax + 0xc0], ecx
mov ecx, 0x13
sub ecx, edx
mov edx, 0xffffffff
shr edx, cl
and edx, esi
cmp ebx, 0xff
mov dword [eax + 0xb0], edx
je 0x6fd65331
mov esi, dword [eax + 0xbc]
mov ebp, eax
test esi, esi
jne 0x6fd652b2
mov edx, 1
and ebx, 0xff
mov dword [ebp + 0xbc], edx
mov dword [ebp + 0xb8], ebx
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret 4
mov ecx, dword [ecx + 0xb0]
mov ebx, 0x100
mov dword [eax + 0xb4], ebx
mov ebx, dword [eax + 0xc0]
add edx, ecx
mov esi, edx
shl esi, 7
lea edx, [ebx + 7]
mov dword [eax + 0xb0], esi
mov dword [eax + 0xc0], edx
jmp 0x6fd65208
mov eax, ebx
mov edx, dword [edi]
shr eax, 8
mov ecx, eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xb8]
add ecx, eax
mov dword [esp], ecx
mov ecx, edi
call dword [edx + 4]
sub esp, 4
mov eax, dword [esp + 0x1c]
add eax, 0xff
cmp esi, 1
movzx edi, al
je 0x6fd6524a
mov esi, esi
lea edi, [edi]
mov ecx, dword [ebp]
dec esi
mov eax, dword [ecx]
mov dword [esp], edi
call dword [eax + 4]
sub esp, 4
cmp esi, 1
jne 0x6fd652f0
jmp 0x6fd6524a
mov edx, dword [esp + 0x40]
xor ebx, ebx
xor edx, 0x7e
mov ecx, dword [edx*4 + 0x70764240]
add dword [eax + 0xc8], ecx
adc dword [eax + 0xcc], ebx
jmp 0x6fd65261
inc dword [eax + 0xbc]
jmp 0x6fd65261
Function at 0x6fdc0250
Capabilities:
Create thread

Disassembly:
push ebx
mov edx, 0x6fdc0230
sub esp, 0x38
mov ebx, ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebx + 4], eax
mov ebx, dword [esp + 0x2c]
test ebx, ebx
setne al
add esp, 0x38
pop ebx
ret
Function at 0x6fde2490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x20], edx
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
add eax, 7
sar eax, 3
mov dword [esi + 0x7c], eax
mov eax, dword [edx + 0x44]
mov ebx, eax
shr ebx, 0x1f
add ebx, eax
mov eax, 0xffffffff
sar ebx, 1
add ebx, 7
sar ebx, 3
cmp ebx, 0xcc0000
mov dword [esi + 0x80], ebx
ja 0x6fde24e3
lea eax, [ebx + ebx*4]
shl eax, 5
add eax, 8
mov dword [esp], eax
call fcn.703e62e0
lea edx, [ebx - 1]
mov dword [eax + 4], ebx
mov dword [esp + 0x14], eax
add eax, 8
cmp edx, 0xffffffff
mov dword [esp + 0x18], eax
je 0x6fde259b
mov eax, dword [esp + 0x14]
mov ebp, edx
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ebx, [eax + 0xc]
lea esi, [esi]
lea edi, [edi]
mov ecx, ebx
dec ebp
call fcn.6fed1210
lea eax, [ebx + 0x48]
mov dword [esp], eax
call edi
mov ecx, ebx
add ebx, 0xa0
sub esp, 4
mov dword [esp], 0xc
call fcn.6fd65450
mov dword [ebx - 0x6c], 1
mov dword [ebx - 0x68], 1
sub esp, 4
mov dword [esp], 0x8c0
call fcn.6fd4e5a0
fld qword [0x7046fa00]
mov dword [ebx - 0x40], eax
mov eax, 0x10
mov dword [ebx - 0x14], eax
fnstcw word [esp + 0x1e]
movzx eax, word [esp + 0x1e]
or ax, 0xc00
mov word [esp + 0x1c], ax
fldcw word [esp + 0x1c]
fistp dword [ebx - 0x10]
fldcw word [esp + 0x1e]
cmp ebp, 0xffffffff
jne 0x6fde2520
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0x80]
mov dword [esi + 0x24], eax
test edx, edx
jle 0x6fde25d8
mov eax, dword [esp + 0x14]
lea edi, [edx + edx*4]
mov ebx, dword [esi + 0x7c]
shl edi, 5
mov ecx, dword [esi + 0x20]
add edi, eax
lea esi, [esi]
mov dword [eax + 0xa0], ebx
add eax, 0xa0
mov dword [eax + 4], edx
mov dword [eax - 0x98], ecx
cmp eax, edi
jne 0x6fde25c0
mov dword [esp], edx
mov ecx, esi
call fcn.6fdc0480
sub esp, 4
test al, al
jne 0x6fde2680
mov dword [esi + 4], 0
mov eax, dword [esi + 0x20]
mov ebp, dword [eax + 0xbc]
test ebp, ebp
je 0x6fde266c
mov eax, dword [esp + 0x44]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0x80]
mov ebx, dword [edx + 0x48]
mov edi, dword [edx + 0x44]
lea ecx, [eax + ebx*2]
mov eax, dword [esp + 0x44]
mov dword [esi + 0x78], ecx
mov eax, dword [eax + 0x50]
imul ebx, eax
add ebx, edi
mov ebp, ebx
lea edi, [esi + 0x38]
lea ebx, [esi + 0x28]
imul eax, ecx
add ebx, 4
mov dword [esp], eax
call fcn.6fd4e5a0
mov dword [ebx - 4], eax
add eax, ebp
mov dword [ebx + 0x14], eax
cmp ebx, edi
je 0x6fde2654
mov eax, dword [esp + 0x44]
mov ecx, dword [esi + 0x78]
mov eax, dword [eax + 0x50]
jmp 0x6fde262e
mov eax, dword [esi + 0x40]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax + 0x50]
mov byte [esi + 0x51], 1
mov byte [esi + 0x50], 0
mov dword [esi + 0x54], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov ecx, esi
call fcn.6fdc08c0
jmp 0x6fde25f4
Function at 0x6fde2690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov esi, dword [eax + ecx*4]
mov ecx, dword [esp + 0x78]
test edx, edx
mov ebp, dword [esi + 0x18]
mov eax, dword [eax + ecx*4]
mov edi, dword [eax]
mov dword [esp + 0x44], edi
je 0x6fde271b
mov edi, dword [edx + 0xc]
mov dword [esp + 0x38], edi
mov edi, dword [edx + 8]
mov edx, dword [edx + 4]
mov dword [esp + 0x3c], edi
xor edi, edi
test edx, edx
jne 0x6fde27e8
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x38]
add edx, 6
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edi
mov edx, dword [ebx + 0x78]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x10], edx
mov edx, dword [ebx + 0x28]
mov dword [esp + 4], edx
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
call dword [0x70e9dc48]
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x44], eax
mov edx, dword [esi + 0x48]
test edx, edx
jle 0x6fde27f7
mov eax, dword [esi + 0x44]
lea edi, [ebp*8]
xor ecx, ecx
mov dword [esp + 0x4c], edi
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x48], ecx
xor ecx, ecx
mov dword [esp + 0x38], edi
mov edi, ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ecx
nop
test eax, eax
jle 0x6fde27c1
mov eax, dword [esp + 0x3c]
xor ebx, ebx
lea ebp, [eax*4]
mov eax, edi
mov edi, esi
mov esi, eax
mov esi, esi
lea edi, [edi]
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x44]
mov ecx, dword [edi]
mov dword [esp + 4], esi
add eax, ebx
add ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [0x70e9d60c]
mov ecx, dword [edi + 0x19f0]
mov ecx, dword [ecx + ebp]
cmp eax, ecx
cmovge eax, ecx
add ebx, 8
add dword [esp + 0x40], eax
add ebp, 4
mov eax, dword [edi + 0x44]
inc dword [esp + 0x3c]
cmp eax, ebx
jg 0x6fde2770
mov ebx, esi
mov esi, edi
mov edx, dword [esi + 0x48]
mov edi, ebx
add dword [esp + 0x48], 8
mov ebp, dword [esp + 0x4c]
add dword [esp + 0x38], ebp
mov ebx, dword [esp + 0x48]
cmp edx, ebx
jg 0x6fde2750
mov eax, dword [esp + 0x40]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea ecx, [edx - 1]
mov edi, 0x40
shl edi, cl
jmp 0x6fde26d7
xor eax, eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x6fde3b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x6c
mov edi, dword [esp + 0x88]
lea ecx, [ecx + 0x10]
mov ebp, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
movzx edx, byte [esp + 0x8c]
mov esi, dword [eax + edi*4]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
sub edi, ebp
mov dword [esp + 4], ebp
mov dword [esp], eax
mov byte [esp + 0x53], dl
call fcn.6fde2e20
mov eax, dword [esi + 0x58]
mov edx, dword [esi + 0x5c]
mov ecx, dword [ebx + 0xd0]
sub esp, 0x10
mov dword [esp + 0x40], eax
lea eax, [edi + edi*8]
shl eax, 4
mov dword [esp + 0x44], edx
mov edx, edi
mov edi, dword [esi + eax + 0x58]
mov ebp, dword [esi + eax + 0x5c]
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x48], edi
mov edi, dword [ebx + 0xbc]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x54], eax
sub eax, ecx
mov ebp, eax
fild dword [edi + 0x98]
fmul qword [0x707658d8]
mov ecx, dword [edi + 0x78]
mov eax, dword [edi + 0x74]
mov dword [esp + 0x58], ecx
cmp eax, ecx
fld st(0)
je 0x6fde3bc8
fmul dword [0x70765908]
test eax, eax
lea ecx, [eax + 3]
cmovns ecx, eax
sar ecx, 2
cmp ebp, ecx
jg 0x6fde3cd0
fstp st(1)
fmul dword [0x70765908]
fild qword [esp + 0x48]
fild qword [esp + 0x40]
fld st(2)
fsubr dword [0x707658e0]
fmul st(1)
fxch st(2)
fcomi st(2)
fstp st(2)
setae al
jb 0x6fde3ca0
cmp byte [esp + 0x53], 0
je 0x6fde3cb0
mov ecx, dword [esi + edx*4 + 0x19a8]
mov edx, dword [ebx + 0xc8]
mov ebx, dword [ebx + 0xcc]
cmp edx, 2
jg 0x6fde3cf0
fxch st(2)
imul edx, ebx
fstp qword [esp + 0x28]
sub edx, ecx
fdivrp st(1)
mov byte [esp + 0x53], al
mov eax, dword [esp + 0x48]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x44]
mov dword [esp], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], edx
mov edx, 3
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov eax, 0x70765780
mov dword [esp + 8], eax
fsubr dword [0x707658e0]
fstp qword [esp + 0x20]
call fcn.6fd4e660
movzx eax, byte [esp + 0x53]
jmp 0x6fde3cc0
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x6fde3cc0
fstp st(0)
fstp st(0)
fstp st(0)
lea esi, [esi]
lea edi, [edi]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
cmp ebp, eax
jg 0x6fde3d10
fstp st(1)
mov dword [esp + 0x58], ebp
fild dword [esp + 0x58]
mov dword [esp + 0x58], eax
fmulp st(1)
fild dword [esp + 0x58]
fdivp st(1)
jmp 0x6fde3be3
cmp ebx, 2
jle 0x6fde3c2b
fxch st(2)
sub edx, 2
sub ebx, 2
imul edx, ebx
jmp 0x6fde3c30
mov ecx, ebp
fsub st(1), st(0)
sub ecx, eax
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x58]
fild dword [esp + 0x5c]
sub ecx, eax
mov dword [esp + 0x58], ecx
fmulp st(2)
fild dword [esp + 0x58]
fdivp st(2)
faddp st(1)
jmp 0x6fde3be3
Function at 0x6fdea3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
test edx, edx
je 0x6fdea584
mov eax, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6fdea56c
mov ebx, dword [esp + 4]
mov edi, dword [esp + 0x28]
mov ecx, dword [esi]
add edi, ebx
nop
lea esi, [esi]
movzx eax, byte [ebx]
sar eax, 7
lea eax, [eax + ecx*2]
shr ecx, 0xf
movzx eax, ax
and ecx, 1
mov ebp, ecx
mov edx, ecx
shl ebp, 5
shl edx, 0xc
add edx, ebp
add ecx, edx
xor ecx, eax
mov dword [esi], ecx
movzx edx, byte [ebx]
sar edx, 6
and edx, 1
lea eax, [edx + ecx*2]
shr ecx, 0xf
movzx edx, ax
mov ebp, ecx
mov eax, ecx
shl ebp, 5
shl eax, 0xc
add eax, ebp
add eax, ecx
xor eax, edx
mov dword [esi], eax
movzx edx, byte [ebx]
sar edx, 5
and edx, 1
lea ecx, [edx + eax*2]
shr eax, 0xf
movzx ecx, cx
mov ebp, eax
mov edx, eax
shl ebp, 5
shl eax, 0xc
add eax, ebp
add eax, edx
xor ecx, eax
mov dword [esi], ecx
movzx edx, byte [ebx]
sar edx, 4
and edx, 1
lea eax, [edx + ecx*2]
shr ecx, 0xf
movzx edx, ax
mov ebp, ecx
mov eax, ecx
shl ebp, 5
shl eax, 0xc
add eax, ebp
add eax, ecx
xor eax, edx
mov dword [esi], eax
movzx edx, byte [ebx]
sar edx, 3
and edx, 1
inc ebx
lea ecx, [edx + eax*2]
shr eax, 0xf
movzx ecx, cx
mov ebp, eax
mov edx, eax
shl ebp, 5
shl eax, 0xc
add eax, ebp
add eax, edx
xor ecx, eax
mov dword [esi], ecx
movzx edx, byte [ebx - 1]
sar edx, 2
and edx, 1
lea edx, [edx + ecx*2]
shr ecx, 0xf
movzx edx, dx
mov ebp, ecx
mov eax, ecx
shl ebp, 5
shl eax, 0xc
add eax, ebp
add eax, ecx
xor edx, eax
mov dword [esi], edx
mov ebp, edx
movzx edx, byte [ebx - 1]
sar edx, 1
and edx, 1
lea eax, [edx + ebp*2]
mov edx, ebp
shr edx, 0xf
movzx ecx, ax
mov ebp, edx
mov eax, edx
shl ebp, 5
shl eax, 0xc
add eax, ebp
add eax, edx
xor eax, ecx
mov dword [esi], eax
movzx edx, byte [ebx - 1]
and edx, 1
lea ecx, [edx + eax*2]
shr eax, 0xf
movzx ecx, cx
mov ebp, eax
mov edx, eax
shl ebp, 5
shl edx, 0xc
add edx, ebp
add eax, edx
xor ecx, eax
cmp ebx, edi
mov dword [esi], ecx
jne 0x6fdea440
inc dword [esp]
mov ebx, dword [esp + 0x2c]
add dword [esp + 4], ebx
mov eax, dword [esp]
cmp eax, dword [esp + 0x24]
jne 0x6fdea420
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret