joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f6801
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x449d68
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x6f6821
call fcn.006f67c9
mov eax, dword [ebp - 4]
jmp 0x6f683a
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x6f6842
test al, 7
jne 0x6f6826
cmp esi, 8
jb 0x6f68cb
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x6f684b
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x6f68ed
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x6f68d2
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x6f6979
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
xor edx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
xor edx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ecx + 8]
mov edx, dword [edx + 0xc]
xor ebx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
xor edx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ecx, edx
mov esi, edx
shr esi, 0x15
shl ecx, 0xb
or ecx, esi
mov esi, dword [ebp - 0x18]
and esi, 3
add ecx, ebx
xor ecx, dword [eax + esi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edi, ecx
mov esi, ecx
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [eax + esi + 0x104]
movzx edi, byte [eax + edi + 0x104]
shl edi, 8
or esi, edi
mov edi, ecx
shr edi, 0x10
shr ecx, 0x18
and edi, 0xff
and ecx, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl edi, 0x10
shl ecx, 0x18
or esi, edi
or esi, ecx
mov ecx, ebx
xor esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov esi, ebx
shr esi, 0xf
shl ecx, 0x11
or ecx, esi
mov esi, dword [ebp - 0x18]
and esi, 3
xor ecx, edx
add ecx, dword [eax + esi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edi, ecx
mov esi, ecx
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [eax + esi + 0x104]
movzx edi, byte [eax + edi + 0x104]
shl edi, 8
or esi, edi
mov edi, ecx
shr edi, 0x10
shr ecx, 0x18
and edi, 0xff
and ecx, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl edi, 0x10
shl ecx, 0x18
or esi, edi
or esi, ecx
xor esi, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
mov ecx, esi
mov edx, ecx
mov ebx, dword [ebp - 0x10]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x20
jl 0x6f69c5
mov ecx, dword [ebp - 0x14]
xor ebx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ecx], ebx
xor edx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor edx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor edx, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 4]
call fcn.006f6cbd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f6b11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx]
xor ecx, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
xor edx, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov esi, dword [ecx + 8]
mov edi, dword [eax + 0xc]
xor esi, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
xor edi, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
push 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 4]
push eax
call fcn.007250b9
add esp, 0xc
mov dword [ebp - 0x18], 0x1f
mov eax, edi
mov edx, edi
mov ecx, dword [ebp - 0x18]
shr edx, 0x15
and ecx, 3
shl eax, 0xb
or eax, edx
add eax, esi
xor eax, dword [ebx + ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
xor ecx, ecx
mov edx, eax
and edx, 0xff
mov cl, byte [ebx + edx + 0x104]
mov edx, eax
shr edx, 8
and edx, 0xff
movzx edx, byte [ebx + edx + 0x104]
shl edx, 8
or ecx, edx
mov edx, eax
shr edx, 0x10
shr eax, 0x18
and edx, 0xff
and eax, 0xff
movzx edx, byte [ebx + edx + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl edx, 0x10
shl eax, 0x18
or ecx, edx
or ecx, eax
mov eax, esi
xor ecx, dword [ebp - 8]
mov edx, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
shr edx, 0xf
and ecx, 3
shl eax, 0x11
or eax, edx
xor eax, edi
add eax, dword [ebx + ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
xor ecx, ecx
mov edx, eax
and edx, 0xff
mov cl, byte [ebx + edx + 0x104]
mov edx, eax
shr edx, 8
and edx, 0xff
movzx edx, byte [ebx + edx + 0x104]
shl edx, 8
or ecx, edx
mov edx, eax
shr edx, 0x10
shr eax, 0x18
and edx, 0xff
and eax, 0xff
movzx edx, byte [ebx + edx + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl edx, 0x10
shl eax, 0x18
or ecx, edx
or ecx, eax
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov eax, ecx
mov edi, eax
mov esi, dword [ebp - 0x10]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jge 0x6f6b72
mov eax, dword [ebp - 0x14]
xor esi, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [eax], esi
xor edi, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
xor ecx, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [eax + 8], ecx
mov eax, ebx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor edx, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
mov dword [ecx + 0xc], edx
lea edx, [ebp - 0x28]
call fcn.006f6cbd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f6cbd
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x449d68
xor ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [ebx + esi*4]
xor dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW], esi
movzx esi, byte [edx + ecx + 1]
mov esi, dword [ebx + esi*4]
xor dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW], esi
movzx esi, byte [edx + ecx + 2]
mov esi, dword [ebx + esi*4]
xor dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW], esi
movzx esi, byte [edx + ecx + 3]
mov esi, dword [ebx + esi*4]
xor dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW], esi
add ecx, 4
cmp ecx, 0x10
jl 0x6f6cc6
pop esi
pop ebx
ret

Function at 0x6f75a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
jg 0x6f75c1
xor eax, eax
jmp 0x6f7682
mov edx, dword [ebp - 0xc]
test edx, edx
jns 0x6f75cb
add edx, 0xf
sar edx, 4
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, 4
mov ecx, dword [eax]
xor ecx, dword [edx]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, ebx
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 0xc]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.006f7a05
add dword [ebp - 8], 0x10
mov edx, dword [ebp - 0x14]
dec edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jle 0x6f765e
mov eax, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
xor ecx, dword [edx]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
add ebx, 0x10
lea edx, [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.006f7a05
add dword [ebp - 8], 0x10
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jg 0x6f761a
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x14]
shl eax, 4
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6f7689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x6f76a0
test esi, esi
jg 0x6f76a7
xor eax, eax
jmp 0x6f774f
push 0x10
mov edx, dword [ebp - 4]
add edx, 4
push edx
lea ecx, [ebp - 0x28]
push ecx
call fcn.007250b9
add esp, 0xc
test esi, esi
jns 0x6f76c3
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x6f7734
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.006f7f81
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x6f76d0
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.007250b9
add esp, 0xc
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6f7759
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 4
push 0x20
push edx
lea edx, [esp + 0x14]
push edx
call fcn.007250b9
add esp, 0xc
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x6f77c2
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x6f778d
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x6f77ba
cmp ecx, 4
jl 0x6f778b
cmp ecx, 4
jne 0x6f77c2
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x6f77cd
cmp esi, 0xa
jle 0x6f77af
cmp esi, 0xa
jg 0x6f7960
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x44a168]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x44a168]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x44a168]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x44a168]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x44a368]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x6f7870
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x6f790e
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x6f7850
inc edx
cmp edx, dword [esp + 8]
jl 0x6f784e
jmp 0x6f790e
mov edx, 1
jmp 0x6f788e
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x6f7879
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x6f7899
adc eax, 0
cmp edx, eax
jl 0x6f7877
mov eax, dword [esp + 8]
sar eax, 1
jns 0x6f78a8
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x6f790e
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x6f78f3
inc edx
cmp edx, dword [esp + 8]
jl 0x6f78f1
xor edx, edx
jmp 0x6f794c
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x6f7916
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x6f7944
cmp ecx, 4
jl 0x6f7914
cmp ecx, 4
jne 0x6f794c
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x6f7957
cmp esi, 0xa
jle 0x6f7939
cmp esi, 0xa
jle 0x6f77d6
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6f7969
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, reloc.PSAPI.DLL_GetMappedFileNameW
lea ebx, reloc.PSAPI.DLL_GetMappedFileNameW
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, reloc.PSAPI.DLL_GetMappedFileNameW
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x6f797b
inc eax
cmp eax, 4
jl 0x6f7979
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.007250b9
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x6f7977
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6fa061
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x6fa081
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x6fa068
cmp dword [eax], 0x11
jbe 0x6fa09d
mov dword [eax], 0x11
jmp 0x6fa090
dec dword [eax]
cmp dword [eax], 0
je 0x6fa09d
mov edx, dword [eax]
cmp dword [eax + edx*4], 0
je 0x6fa08e
ret

Function at 0x6fa92d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x6fa975
mov eax, 1
jmp 0x6fa94d
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x6fa943
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, ebx
push edx
add eax, edi
push eax
call fcn.007250b9
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x6fa9db
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jbe 0x6fa9b4
mov eax, 1
jmp 0x6fa98c
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x6fa982
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, esi
push edx
add eax, edi
push eax
call fcn.007250b9
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x6fa9db
mov eax, dword [ebx]
test eax, eax
jbe 0x6fa9c7
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x6fa9c7
dec eax
test eax, eax
ja 0x6fa9ba
mov dword [edi], eax
test eax, eax
jbe 0x6fa9db
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x6fa9cd
pop edi
pop esi
pop ebx
ret
Function at 0x7044f5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffff70
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 8], edx
mov esi, dword [esp + 8]
jmp 0x704572
xor eax, eax
mov edx, dword [esp]
add edx, esi
add edx, eax
mov cl, byte [edx + 1]
mov byte [esp + eax + 0x19], cl
mov bl, byte [edx]
sub bl, cl
mov byte [esp + eax + 0x18], bl
mov dl, byte [edx + 2]
sub dl, cl
mov byte [esp + eax + 0x1a], dl
add eax, 3
cmp eax, 0x78
jl 0x704520
mov ebx, 3
mov cl, byte [esp + ebx + 0x18]
sub cl, byte [esp + ebx + 0x15]
movsx ecx, cl
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 8]
add dword [esp + edx*4 + 0xc], eax
inc ebx
cmp ebx, 0x78
jl 0x70454c
add esi, 0x780
mov eax, dword [esp + 4]
add eax, 0xffffff88
cmp esi, eax
jl 0x70451e
inc dword [esp + 8]
cmp dword [esp + 8], 2
jle 0x704518
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jb 0x70459e
cmp eax, dword [esp + 0x14]
ja 0x70459e
xor eax, eax
jmp 0x7045aa
mov eax, 1
cmp edx, dword [esp + 0x14]
jbe 0x7045aa
inc eax
add esp, 0x90
pop esi
pop ebx
ret
Function at 0x7684d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x7684df
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x7685c7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x7684f0
pop ebp
test edi, edi
je 0x7685ec
jmp 0x7685d0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
add ecx, 1
sub edi, 1
jne 0x7685d0
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x769b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x769b6e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x769b62
cmp dword [edi + 0x7c], ebx
je 0x769b7d
call fcn.00769f50
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.007698c0
add esp, 0xc
test eax, eax
je 0x769ba4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.00787ff3
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x769be5
push 0x4000
call fcn.00787ff3
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x769bf2
push esi
call fcn.00787db9
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x769c3a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00768910
test eax, eax
jne 0x769c3a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x769c64
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x769c6d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
mov al, byte [esi + 0x6c]
neg al
lea edx, [esi + 0x70]
mov dword [edx], reloc.PSAPI.DLL_GetMappedFileNameW
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp ebp, ebx
mov dword [esi + 0x7c], eax
je 0x769ca6
mov cl, byte [ebp]
cmp cl, bl
je 0x769ca6
call fcn.00768600
add ebp, 1
jne 0x769c95
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x76b710
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x4493fc]
xor eax, esp
mov dword [esp + 0x60], eax
test ecx, ecx
mov eax, dword [ebp + 8]
push esi
jne 0x76b72e
xor eax, eax
push ecx
lea esi, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call fcn.0076b600
add esp, 4
mov ecx, esi
call fcn.0076b6a0
test edi, edi
je 0x76b791
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
mov eax, 0x10
call fcn.00787daa
mov esp, ebp
pop ebp
ret