joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c60d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [0xbd33e0]
xor eax, esp
mov dword [esp + 0x58], eax
cmp word [edx + 0x18], 0
jne 0x7c60fd
mov ecx, 0x1c6a
call fcn.007a5560
mov esi, 0xb
jmp 0x7c629d
mov ebx, dword [edx + 0x34]
mov edi, edx
mov ebp, ecx
lea eax, [esp + 0xc]
lea edx, [esp + 0x14]
mov ecx, ebx
push 0
push 0
push eax
call fcn.007ac4b0
add esp, 0xc
mov esi, eax
test eax, eax
mov dword [esp + 0x10], eax
jne 0x7c629d
mov eax, dword [edi + 0x24]
mov dword [esp], ebp
mov dword [esp + 8], eax
push eax
push edi
call dword [edi + 0x4c]
add esp, 8
mov ebp, dword [esp + 0x14]
mov edx, 0xd
mov word [esp + 6], ax
mov ecx, ebp
call fcn.007aaf90
lea eax, [esp + 8]
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x18]
xor edx, edx
mov dword [esp + 0x20], eax
lea eax, [esp + 6]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], 2
push ebp
push 1
call fcn.007c7540
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jne 0x7c6294
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebp + 0x12]
movzx edx, word [esp + 6]
add eax, 0xfffffffe
sub eax, ecx
sub eax, edx
mov dword [ebp + 0x14], eax
cmp byte [ebx + 0x11], 0
je 0x7c61ec
mov edx, dword [esp + 0xc]
lea esi, [esp + 0x10]
mov ecx, ebx
push esi
mov eax, dword [esp + 4]
push dword [eax + 4]
push 5
call fcn.007acf50
add esp, 0xc
movzx eax, word [esp + 6]
cmp ax, word [ebp + 0x10]
jbe 0x7c61ec
mov ecx, ebp
mov edx, ebp
push esi
push dword [esp + 0xc]
call fcn.007ad2d0
add esp, 8
mov edx, dword [edi + 0x40]
movzx esi, word [edi + 0x18]
movzx ecx, word [edi + 0x1a]
mov ebp, dword [esp + 0x70]
movzx ebx, byte [edx + esi*2 - 2]
movzx edx, byte [edx + esi*2 - 1]
lea eax, [ebp + 4]
shl ebx, 8
or edx, ebx
and edx, ecx
xor ecx, ecx
add edx, dword [edi + 0x38]
mov dword [esp + 8], edx
mov esi, ecx
inc ecx
lea ebx, [edx + esi + 1]
cmp ecx, 8
mov dword [esp + 8], ebx
ja 0x7c6230
movzx ebx, byte [edx + esi]
test bl, bl
js 0x7c6218
mov ebx, dword [esp]
add ecx, edx
lea edx, [edx + esi + 0xa]
lea esi, [ecx + 1]
mov dword [esp + 8], esi
movzx ecx, byte [ecx]
mov byte [eax], cl
inc eax
test cl, cl
jns 0x7c6252
mov ecx, dword [esp + 8]
cmp ecx, edx
jb 0x7c6239
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x7c627a
movzx edx, word [ebx + 0x18]
lea esi, [esp + 0x10]
sub eax, ebp
mov ecx, ebx
push esi
push dword [edi + 4]
push 0
push eax
push ebp
call fcn.007c5360
add esp, 0x14
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x38]
movzx ecx, byte [ebx + 9]
mov edx, dword [esp + 0xc]
lea ecx, [eax + ecx + 8]
call fcn.004b5980
mov ecx, dword [esp + 0x14]
jmp 0x7c6298
mov esi, eax
mov ecx, ebp
call fcn.007ac490
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7cc8c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0xbd33e0]
mov esi, dword [esp + 0x18]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x7cca76
dec eax
lea ecx, [esp + 0x20]
lea edi, [esi + 0x28]
mov dword [esi + 0x10], eax
inc dword [esi + 0x14]
mov dword [esp], ecx
cmp dword [esi + 0x38], 0
je 0x7cca41
mov edx, fcn.007fd300
xor eax, eax
movzx ebx, byte [0xbb6357]
imul edx, edx
and edx, 3
cmp edx, 2
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x7cca31
mov al, byte [0xbb6357]
xor ecx, ecx
cmp edx, 2
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb6357], ah
jne 0x7cc931
mov ecx, fcn.007fd300
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7cc9ac
xor eax, eax
cmp ecx, 2
movzx ebx, byte [0xbb6357]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x7cc985
jmp 0x7cca31
xor eax, eax
cmp ecx, 2
movzx edx, byte [0xbb6357]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7cca05
mov ecx, fcn.007fd300
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete al
mov ecx, eax
not ecx
and ecx, 0x4e1
lea ecx, [eax + ecx*2 + 0x797d931e]
mov al, 1
xor dword [0xbb6350], ecx
and cl, 7
shl al, cl
or byte [0xbb6357], al
mov eax, fcn.007fd300
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb6357], al
push 1
push 0xbb6350
push edi
call fcn.00782dd0
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ebx, dword [esp + 0x1c]
test eax, eax
je 0x7cca5c
push dword [esi + 0x24]
push dword [esi + 0x20]
push eax
push edi
call fcn.00783530
add esp, 0x10
push dword [esp]
push ebx
push edi
call fcn.00781190
add esp, 0xc
cmp byte [esi + 0x3c], 7
jne 0x7cca76
mov dword [esi + 0x18], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00989fe9
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x7d1810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, fcn.007abe90
xor ebx, ebx
mov ebp, 0x47
mov dword [esp + 8], ecx
not eax
and eax, 1
mov dword [esp + 0x14], eax
xor ecx, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov esi, dword [ecx*4 + 0xb56750]
mov edi, dword [ecx*4 + 0xb56870]
mov dword [esp + 0x1c], ecx
mov edx, 1
add eax, fcn.007abe90
mov eax, 1
sete bl
xor ebx, 0x7ba5855f
add ebx, 0x1140
xor ebx, dword [ecx*4 + 0xb56990]
mov ecx, ebx
and cl, 7
shl eax, cl
movzx ebp, cl
xor cl, 7
shl edx, cl
movzx ecx, byte [esi + edi - 1]
bt ecx, ebp
jb 0x7d191a
mov dword [esp], eax
mov al, byte [esi + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [esi + edi - 1], cl
jne 0x7d189b
mov ecx, dword [esp]
movzx eax, al
test edx, eax
je 0x7d18bc
movzx eax, byte [esi + edi - 1]
test ecx, eax
je 0x7d18b1
jmp 0x7d191a
movzx eax, byte [esi + edi - 1]
test ecx, eax
jne 0x7d1914
lea ecx, [edi - 4]
shr ecx, 2
je 0x7d190d
xor eax, eax
mov ebp, esi
mov dword [esp + 0x18], ecx
mov ecx, ebp
mov dword [esp + 0x20], ebp
mov ebp, dword [ebp]
mov dword [esp + 4], ebx
xor ebp, ebx
mov dword [ecx], ebp
mov ecx, eax
not ebp
inc eax
shl dword [esp + 4], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp + 4]
imul ebx, ebp
mov ebp, dword [esp + 0x20]
add ebp, 4
cmp eax, ecx
jne 0x7d18d5
mov eax, dword [esp]
or byte [esi + edi - 1], al
not dl
and byte [esi + edi - 1], dl
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0x48
jne 0x7d183a
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
lea eax, [ebx + ebp]
mov esi, eax
shr esi, 0x1f
add esi, eax
sar esi, 1
mov edi, esi
shl edi, 4
push dword [edi + 0xb4cd58]
push dword [esp + 0xc]
call fcn.00783700
add esp, 8
test eax, eax
je 0x7d196f
lea ecx, [esi - 1]
inc esi
test eax, eax
cmovns ebx, esi
cmovs ebp, ecx
cmp ebx, ebp
jle 0x7d1830
xor eax, eax
jmp 0x7d1975
lea eax, [edi + 0xb4cd58]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7d2e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [edx + 0x38]
mov edi, dword [ecx]
mov ebx, dword [esp + 0x24]
mov esi, edx
lea ebp, [eax*4 + 8]
add eax, 3
cmp eax, dword [edi + 0x74]
jl 0x7d3058
mov edx, fcn.00789480
mov dword [esp + 4], ecx
mov dword [esp + 8], ebp
mov ebp, fcn.00789480
xor eax, eax
mov dword [esp + 0xc], edi
or edx, 2
xor ebp, 2
movzx edi, byte [0xbb76cb]
mov ecx, edx
add ecx, ebp
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jb 0x7d303d
mov al, byte [0xbb76cb]
mov dword [esp], ebx
mov edi, edx
xor ebx, ebx
mov ah, 1
add edi, ebp
sete bl
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb76cb], ah
jne 0x7d2e9f
mov ecx, fcn.00789480
mov edi, fcn.00789480
xor edx, edx
movzx eax, al
or ecx, 2
xor edi, 2
mov ebx, ecx
add ebx, edi
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7d2f22
mov ebx, dword [esp]
mov edx, ecx
xor eax, eax
movzx ebp, byte [0xbb76cb]
add edx, edi
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2 + 4]
and al, 7
movzx eax, al
bt ebp, eax
jae 0x7d2efb
jmp 0x7d303d
xor eax, eax
add ecx, edi
movzx edx, byte [0xbb76cb]
mov ebx, dword [esp]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7d300e
mov ecx, fcn.00789480
mov edx, fcn.00789480
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x80b
lea ecx, [eax + ecx*2 + 0x47962504]
mov eax, dword [0xbb76b0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb76b0], eax
not eax
imul edx, eax
mov eax, dword [0xbb76b4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb76b4], eax
or edi, edx
not eax
mov edx, dword [0xbb76b8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb76b8], edx
or edi, eax
not edx
mov eax, dword [0xbb76bc]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb76bc], eax
or edi, edx
not eax
mov edx, dword [0xbb76c0]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb76c0], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb76c4], edx
mov dl, 1
shl dl, cl
or byte [0xbb76cb], dl
mov eax, fcn.00789480
mov ecx, fcn.00789480
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
not eax
lea ecx, [edx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb76cb], al
push dword [esi]
push 0xbb76b0
push dword [esp + 0xc]
call fcn.0078de60
add esp, 0xc
mov edi, dword [esp + 0xc]
mov ebp, dword [esp + 8]
mov edx, dword [esi + 0x3c]
mov ecx, edi
push 0
push ebp
call fcn.00799570
add esp, 8
test eax, eax
je 0x7d308b
mov ecx, dword [esi + 0x38]
lea edx, [ecx + 1]
mov dword [esi + 0x38], edx
mov dword [eax + ecx*4], ebx
mov dword [eax + ecx*4 + 4], 0
mov dword [esi + 0x3c], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00780810
Function at 0x7d3420
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, 0x840870
mov edx, ecx
movzx ecx, byte [0xbb7723]
imul esi, esi
and esi, 3
cmp esi, 3
sete al
or al, 2
movzx eax, al
bt ecx, eax
jb 0x7d363c
mov al, byte [0xbb7723]
cmp esi, 3
mov ah, 1
sete cl
or cl, 2
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7723], ah
jne 0x7d344f
mov ecx, 0x840870
movzx esi, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete ah
or ah, 2
xor ah, 7
movzx eax, ah
bt esi, eax
jae 0x7d34a9
cmp ecx, 3
movzx esi, byte [0xbb7723]
sete al
or al, 2
movzx eax, al
bt esi, eax
jae 0x7d348d
jmp 0x7d363c
cmp ecx, 3
movzx esi, byte [0xbb7723]
sete al
or al, 2
movzx eax, al
bt esi, eax
jb 0x7d361b
mov eax, 0x840870
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
mov eax, dword [0xbb76f0]
sete cl
or ecx, 0x4543ba5a
xor eax, ecx
mov dword [0xbb76f0], eax
not eax
mov esi, dword [0xbb76f4]
imul eax, ecx
and cl, 3
lea edi, [eax + eax]
xor esi, eax
shr eax, 0x1e
mov dword [0xbb76f4], esi
or edi, eax
not esi
mov eax, dword [0xbb76f8]
imul esi, edi
lea edi, [esi*4]
xor eax, esi
shr esi, 0x1d
mov dword [0xbb76f8], eax
or edi, esi
not eax
mov esi, dword [0xbb76fc]
imul eax, edi
lea edi, [eax*8]
xor esi, eax
shr eax, 0x1c
mov dword [0xbb76fc], esi
or edi, eax
not esi
mov eax, dword [0xbb7700]
imul esi, edi
mov edi, esi
shl edi, 4
xor eax, esi
shr esi, 0x1b
mov dword [0xbb7700], eax
or esi, edi
not eax
imul eax, esi
mov esi, dword [0xbb7704]
mov edi, eax
shl edi, 5
xor esi, eax
shr eax, 0x1a
mov dword [0xbb7704], esi
or eax, edi
not esi
imul esi, eax
mov eax, dword [0xbb7708]
mov edi, esi
shl edi, 6
xor eax, esi
shr esi, 0x19
mov dword [0xbb7708], eax
or esi, edi
not eax
imul eax, esi
mov esi, dword [0xbb770c]
mov edi, eax
shl edi, 7
xor esi, eax
shr eax, 0x18
mov dword [0xbb770c], esi
or eax, edi
not esi
imul esi, eax
mov eax, dword [0xbb7710]
mov edi, esi
shl edi, 8
xor eax, esi
shr esi, 0x17
mov dword [0xbb7710], eax
or esi, edi
not eax
imul eax, esi
mov esi, dword [0xbb7714]
mov edi, eax
shl edi, 9
xor esi, eax
shr eax, 0x16
mov dword [0xbb7714], esi
or eax, edi
not esi
imul esi, eax
mov eax, dword [0xbb7718]
mov edi, esi
shl edi, 0xa
xor eax, esi
shr esi, 0x15
mov dword [0xbb7718], eax
or esi, edi
not eax
imul eax, esi
xor dword [0xbb771c], eax
mov ah, 1
shl ah, cl
or byte [0xbb7723], ah
mov eax, 0x840870
imul eax, eax
and eax, 3
cmp eax, 3
mov al, 0xfe
sete cl
or cl, 2
xor cl, 7
rol al, cl
and byte [0xbb7723], al
push edx
push 0xbb76f0
push 0x15
call fcn.00783470
add esp, 0xc
pop esi
pop edi
ret
Function at 0x7d74a0
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push esi
add edx, 0xffffff38
cmp dx, 0x6b
ja case.0x7d74b7.1
mov eax, dword [ecx + 4]
mov esi, dword [esp + 8]
movzx ecx, dx
jmp dword [ecx*4 + 0xb58b88]
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cba90
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cb9e0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cb9f0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cbc20
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cbce0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cbcc0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cbd30
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007cbaa0
mov edx, dword [esi]
mov ecx, dword [eax]
pop esi
jmp fcn.007d3840
mov edx, dword [esi + 4]
jmp 0x7d74fc
mov edx, dword [esi + 4]
jmp 0x7d74ca
pop esi
ret
Function at 0x7d7530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
lea ebx, [ecx + 8]
mov ebp, dword [ecx + 4]
mov esi, ecx
cmp dword [ecx], ebx
jbe 0x7d754c
mov ecx, esi
call fcn.007f7570
cmp dword [esi], ebx
ja 0x7d7541
mov edi, 0x7c81c0
mov ebx, 0x7c81c0
xor eax, eax
movzx edx, byte [0xbb7aab]
or edi, 2
xor ebx, 2
mov ecx, edi
add ecx, ebx
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2]
and al, 3
movzx eax, al
bt edx, eax
jb 0x7d7722
mov al, byte [0xbb7aab]
mov dword [esp], ebp
mov ebp, edi
xor edx, edx
add ebp, ebx
sete dl
mov ecx, edx
not ecx
lea ecx, [edx + ecx*2]
mov dl, 1
and cl, 3
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbb7aab], dl
jne 0x7d7589
mov ecx, 0x7c81c0
mov edx, 0x7c81c0
xor ebx, ebx
movzx eax, al
or ecx, 2
xor edx, 2
mov edi, ecx
add edi, edx
sete bl
mov edi, ebx
not ebx
lea ebx, [edi + ebx*2]
and bl, 3
xor bl, 7
movzx edi, bl
bt eax, edi
jae 0x7d7609
mov ebp, dword [esp]
mov edi, ecx
xor eax, eax
add edi, edx
movzx edi, byte [0xbb7aab]
sete al
mov ebx, eax
not ebx
lea eax, [eax + ebx*2]
and al, 3
movzx eax, al
bt edi, eax
jae 0x7d75e3
jmp 0x7d7722
xor eax, eax
add ecx, edx
movzx edx, byte [0xbb7aab]
mov ebp, dword [esp]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2]
and al, 3
movzx eax, al
bt edx, eax
jb 0x7d76f4
mov ecx, 0x7c81c0
mov edx, 0x7c81c0
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x405
lea ecx, [eax + ecx*2 - 0x7f57b6c8]
mov eax, dword [0xbb7a90]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb7a90], eax
not eax
imul edx, eax
mov eax, dword [0xbb7a94]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb7a94], eax
or edi, edx
not eax
mov edx, dword [0xbb7a98]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb7a98], edx
or edi, eax
not edx
mov eax, dword [0xbb7a9c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb7a9c], eax
or edi, edx
not eax
mov edx, dword [0xbb7aa0]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb7aa0], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb7aa4], edx
mov dl, 1
shl dl, cl
or byte [0xbb7aab], dl
mov eax, 0x7c81c0
mov ecx, 0x7c81c0
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
not eax
lea ecx, [edx + eax*2]
mov al, 0xfe
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb7aab], al
push 0xbb7a90
push ebp
call fcn.0078de60
add esp, 8
mov dword [esi + 4], ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7d78f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edx, fcn.007ff740
mov edi, ecx
movzx ecx, byte [0xbb7e13]
and edx, 1
inc edx
mov eax, edx
xor eax, fcn.007ff740
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x7d7a10
mov al, byte [0xbb7e13]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007ff740
sete cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7e13], ah
jne 0x7d7925
mov ecx, fcn.007ff740
movzx eax, al
and ecx, 1
inc ecx
mov edx, ecx
xor edx, fcn.007ff740
sete dl
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7d798b
mov eax, ecx
movzx edx, byte [0xbb7e13]
xor eax, fcn.007ff740
sete al
or al, 4
movzx eax, al
bt edx, eax
jae 0x7d796b
jmp 0x7d7a10
xor ecx, fcn.007ff740
movzx ecx, byte [0xbb7e13]
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x7d79ef
mov eax, fcn.007ff740
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007ff740
mov eax, dword [0xbb7e08]
sete cl
or ecx, 0x9f914144
add ecx, 0x1110
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb7e08], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
xor dword [0xbb7e0c], edx
mov dl, 1
shl dl, cl
or byte [0xbb7e13], dl
mov eax, fcn.007ff740
and eax, 1
inc eax
xor eax, fcn.007ff740
mov al, 0xfe
sete cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb7e13], al
mov ebp, dword [edi]
mov ecx, edi
mov edx, 0x16
push 0
push 0
push 0xbb7e08
call fcn.008002d0
add esp, 0xc
test eax, eax
jne 0x7d7a81
mov ecx, edi
call fcn.007f7590
test eax, eax
je 0x7d7a81
mov edi, eax
cmp esi, 7
je 0x7d7a71
cmp dword [ebp + 0x14], 0
jle 0x7d7a71
xor ebx, ebx
cmp esi, 9
sete bl
xor esi, esi
inc ebx
mov ecx, edi
mov edx, 2
push ebx
push esi
call fcn.007d10d0
add esp, 8
mov ecx, edi
mov edx, esi
call fcn.0078e0d0
inc esi
cmp esi, dword [ebp + 0x14]
jl 0x7d7a51
mov ecx, edi
mov edx, 1
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007f75b0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7e3a00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [edx + 0x34]
test ecx, ecx
je 0x7e3c5c
mov dword [edx + 0x38], 0
or byte [edx + 5], 1
xor eax, eax
mov edi, edx
mov ebx, dword [ecx + 0x34]
mov dword [ecx + 0x38], edi
or byte [ecx + 5], 1
inc eax
mov edi, ecx
test ebx, ebx
mov ecx, ebx
jne 0x7e3a1f
test byte [edx + 5], 4
jne 0x7e3c5c
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
jle 0x7e3c5c
cmp eax, ecx
jl 0x7e3c5c
mov eax, fcn.0082ea80
mov edx, 3
movzx ecx, byte [0xbba2c7]
sub edx, eax
mov eax, edx
xor eax, fcn.0082ea80
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7e3c4e
mov al, byte [0xbba2c7]
mov ecx, edx
mov ah, 1
xor ecx, fcn.0082ea80
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbba2c7], ah
jne 0x7e3a83
mov edx, fcn.0082ea80
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.0082ea80
sete dl
not dl
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7e3af2
mov eax, ecx
movzx edx, byte [0xbba2c7]
xor eax, fcn.0082ea80
sete al
not al
and al, 3
movzx eax, al
bt edx, eax
jae 0x7e3ad0
jmp 0x7e3c4e
xor ecx, fcn.0082ea80
movzx ecx, byte [0xbba2c7]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7e3c27
mov eax, fcn.0082ea80
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbba2a0]
xor edx, fcn.0082ea80
sete cl
xor ecx, 0xddc932b3
add ecx, 0xa08
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbba2a0], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbba2a4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbba2a4], eax
or edi, edx
not eax
mov edx, dword [0xbba2a8]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbba2a8], edx
or edi, eax
not edx
mov eax, dword [0xbba2ac]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbba2ac], eax
or edi, edx
not eax
mov edx, dword [0xbba2b0]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbba2b0], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbba2b4]
mov edi, edx
shl edi, 5
xor eax, edx
shr edx, 0x1a
mov dword [0xbba2b4], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbba2b8]
mov edi, eax
shl edi, 6
xor edx, eax
shr eax, 0x19
mov dword [0xbba2b8], edx
or eax, edi
not edx
mov ebx, dword [0xbba2bc]
imul edx, eax
mov edi, edx
shl edi, 7
xor ebx, edx
shr edx, 0x18
mov dword [0xbba2bc], ebx
or edx, edi
not ebx
imul ebx, edx
mov dl, 1
xor dword [0xbba2c0], ebx
shl dl, cl
or byte [0xbba2c7], dl
mov eax, fcn.0082ea80
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.0082ea80
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbba2c7], al
push 0xbba2a0
push esi
call fcn.0078de60
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x7e5cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
test edx, edx
je 0x7e5e91
mov eax, dword [ecx]
mov edx, dword [edx]
mov esi, ecx
cmp edx, dword [eax + 0x74]
jle 0x7e5e91
mov edi, 0x799340
xor eax, eax
movzx edx, byte [0xbba51b]
mov ebp, dword [esp + 0x14]
imul edi, edi
and edi, 3
cmp edi, 1
seta al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x7e5e82
mov al, byte [0xbba51b]
xor ecx, ecx
cmp edi, 1
mov ah, 1
seta cl
mov ebx, ecx
xor ebx, 3
lea ecx, [ebx + ecx*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbba51b], ah
jne 0x7e5d0f
mov ecx, 0x799340
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
mov ebx, edx
xor ebx, 3
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7e5d7c
xor eax, eax
cmp ecx, 1
movzx edi, byte [0xbba51b]
seta al
mov edx, eax
xor edx, 3
lea eax, [edx + eax*2]
bt edi, eax
jae 0x7e5d5b
jmp 0x7e5e82
xor eax, eax
cmp ecx, 1
movzx edx, byte [0xbba51b]
seta al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x7e5e5a
mov eax, 0x799340
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 0x6a7c7373
lea ecx, [eax + ecx*2 + 0x1108]
mov eax, dword [0xbba500]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbba500], eax
not eax
imul edx, eax
mov eax, dword [0xbba504]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbba504], eax
or edi, edx
not eax
mov edx, dword [0xbba508]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbba508], edx
or edi, eax
not edx
mov eax, dword [0xbba50c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbba50c], eax
or edi, edx
not eax
mov edx, dword [0xbba510]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbba510], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbba514], edx
mov dl, 1
shl dl, cl
or byte [0xbba51b], dl
mov eax, 0x799340
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 3
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbba51b], al
push ebp
push 0xbba500
push esi
call fcn.0078de60
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret