joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4156d5
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov dword [0x422078], eax
mov eax, dword [0x422078]
cmp eax, 0xffffffff
jne 0x4156f6
call sym._abort
nop
leave
ret

Function at 0x415866
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], sym._pthread_tls_init
mov dword [esp], 0x42f0fc
call sym.__pthread_once_raw
mov eax, dword [0x422078]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4158ad
mov eax, dword [ebp - 0x20]
jmp 0x4159f8
call sym._pop_pthread_mem
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x4158c4
cmp dword [ebp - 0x20], 0
jne 0x4158ce
mov eax, 0
jmp 0x4159f8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._replace_spin_keys
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4159a0
call sym._abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x422078]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4159f5
call sym._abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x415abc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call sym.___pthread_self_lite
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.__pthread_cleanup_dest
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x415b17
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x422078]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x415c41
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x415ba9
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x415b66
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x422078]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x415c41
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x415bd9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x415c41
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x422078]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x417e8c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x422088
call sym._pthread_spin_lock
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x417eb8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x417efa
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x422088
call sym._pthread_spin_unlock
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x41ef50
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4220d8], 0
jne 0x41f076
mov byte [0x4220d8], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41f044
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41f034
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4231cd
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x420d40
jmp 0x420d38
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x41effa
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x420d33
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x420dd0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0x4220c8
call sym._pthread_mutex_init
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4220cc], 0
mov dword [0x4220d0], 0
mov dword [0x4220d4], 0
call sym._getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x420e66
jmp 0x420f26
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
je 0x420ee0
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x420e50
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x420e50
cmp byte [ebx + 0xf], 0x2e
jne 0x420e50
add ebx, 0x10
lea esi, [esp + 0x18]
mov edi, dword [esi]
test edi, edi
je 0x420ec3
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x420ecd
cmp byte [ebx + edi], 0x3d
je 0x420f54
add esi, 0xc
lea eax, [esp + 0x30]
cmp eax, esi
jne 0x420ea6
jmp 0x420e50
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4220d4], ebx
test ebx, ebx
jne 0x420f35
mov dword [esp], sym.___tcf_0
call sym._atexit
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x4220d4], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x4220d0], eax
test eax, eax
je 0x420f92
xor edx, edx
mov dword [0x4220cc], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x420f13
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x420f82
test dl, dl
jne 0x420e50
test eax, eax
js 0x420e50
mov dword [esi + 8], eax
jmp 0x420e50
xor ecx, ecx
mov dword [0x4220d4], ecx
jmp 0x420f13
Function at 0xa7c360
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
mov byte [edi], al
mov al, byte [ecx]
push esi
xor esi, esi
test al, al
je 0xa7c387
mov edx, edi
sub edx, ecx
push ebx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc esi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
cmp byte [ecx], 0
jne 0xa7c372
pop ebx
mov byte [esi + edi], 0
mov eax, edi
pop esi
ret

Function at 0xa7c390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x25
call fcn.00a7c070
mov cl, byte [eax]
mov byte [ebx], cl
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
je 0xa7c3c5
mov esi, ebx
sub esi, eax
mov dl, byte [eax + 1]
mov cl, byte [esi + eax]
inc edi
inc eax
dec dl
xor dl, cl
mov byte [esi + eax], dl
cmp byte [eax], 0
jne 0xa7c3b1
mov eax, ebx
mov byte [edi + ebx], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7c3d0
sub eax, edx
mov byte [eax + ebx], 0x3a
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7c3e2
sub eax, edx
mov byte [eax + ebx], 0x20
mov eax, dword [esp + 0x10]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7c3f5
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xa7c401
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7c420
sub eax, edx
test ebp, ebp
mov byte [eax + ebx], 0x28
je 0xa7c459
mov eax, ebp
mov edx, ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7c435
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xa7c441
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebx
pop esi
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7c461
sub eax, edx
mov byte [eax + ebx], 0x29
ret

Function at 0xa7c7c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [ecx + 0x3c]
movzx eax, word [edx + ecx + 0x14]
add eax, edx
lea eax, [eax + ecx + 0x18]
movzx ecx, word [edx + ecx + 6]
lea ecx, [ecx + ecx*4]
push esi
lea esi, [eax + ecx*8]
cmp eax, esi
jae 0xa7c7fe
mov edi, edi
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xa7c7ea
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp edx, edi
ja 0xa7c7f7
add edx, ecx
cmp edi, edx
jb 0xa7c800
add eax, 0x28
cmp eax, esi
jb 0xa7c7e0
xor eax, eax
pop esi
ret
Function at 0xa7ce60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
push 0
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x400
push ebx
push 0
push 0x1300
call dword [esi + 0x7c]
test eax, eax
je 0xa7ceba
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov ecx, dword [esp + 0xc]
push 0x10
push edx
push ecx
push 0
call eax
mov edx, dword [esp + 0xc]
push edx
mov edi, eax
call dword [esi + 0x34]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov esi, ecx
nop
xor edx, edx
mov edi, 0x10
div edi
cmp edx, 9
jbe 0xa7cef3
add dl, 0x57
jmp 0xa7cef6
add dl, 0x30
mov byte [ecx], dl
inc ecx
test eax, eax
ja 0xa7cee0
mov byte [ecx], 0
dec ecx
mov dl, byte [esi]
mov al, byte [ecx]
mov byte [ecx], dl
dec ecx
mov byte [esi], al
inc esi
cmp esi, ecx
jb 0xa7cf01
push 0x22
call fcn.00a7c070
mov cl, byte [eax]
mov byte [esp + 0x24], cl
mov cl, byte [eax]
add esp, 4
xor esi, esi
test cl, cl
je 0xa7cf44
lea ecx, [esp + 0x20]
sub ecx, eax
lea ecx, [ecx]
mov dl, byte [eax + 1]
mov bl, byte [ecx + eax]
inc esi
inc eax
dec dl
xor dl, bl
mov byte [ecx + eax], dl
cmp byte [eax], 0
jne 0xa7cf30
lea eax, [esp + 0x20]
mov byte [esp + esi + 0x20], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cf50
sub eax, edx
mov byte [esp + eax + 0x20], 0x28
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cf65
sub eax, edx
mov byte [esp + eax + 0x20], 0x29
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cf80
sub eax, edx
mov bl, 0x20
mov byte [esp + eax + 0x20], bl
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cf96
sub eax, edx
mov byte [esp + eax + 0x20], 0x3d
lea eax, [esp + 0x20]
lea edx, [eax + 1]
jmp 0xa7cfb0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cfb0
sub eax, edx
mov byte [esp + eax + 0x20], bl
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cfc4
sub eax, edx
mov byte [esp + eax + 0x20], 0x30
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cfe0
sub eax, edx
mov byte [esp + eax + 0x20], 0x78
lea eax, [esp + 0x10]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7cff4
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xa7d002
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
push 0x10
push edx
lea ecx, [esp + 0x28]
push ecx
push 0
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa7d040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x14
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0xc], cl
je 0xa7d095
lea esi, [esp + 0xc]
sub esi, eax
jmp 0xa7d080
mov cl, byte [eax + 1]
mov bl, byte [esi + eax]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, bl
test cl, cl
mov byte [esi + eax], dl
jne 0xa7d080
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
mov byte [esp + edi + 0x14], 0
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa7d0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0xa7d124
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0xa7d110
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa7d130
sub eax, edx
mov byte [esp + eax + 0xb], bl
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa7d170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0xc], cl
je 0xa7d1c5
lea esi, [esp + 0xc]
sub esi, eax
jmp 0xa7d1b0
mov cl, byte [eax + 1]
mov bl, byte [esi + eax]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, bl
test cl, cl
mov byte [esi + eax], dl
jne 0xa7d1b0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
mov byte [esp + edi + 0x14], 0
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa7d200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 9
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0xc], cl
je 0xa7d255
lea esi, [esp + 0xc]
sub esi, eax
jmp 0xa7d240
mov cl, byte [eax + 1]
mov bl, byte [esi + eax]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, bl
test cl, cl
mov byte [esi + eax], dl
jne 0xa7d240
lea eax, [esp + 0xc]
push 0
push eax
lea ebx, [esp + 0x28]
mov byte [esp + edi + 0x14], 0
call fcn.00a7c390
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
push ecx
push edx
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa7d290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x20]
push 0x27
rep stosd dword es:[edi], eax
call fcn.00a7c070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0xa7d2e4
lea esi, [esp + 0xc]
sub esi, eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0xa7d2d0
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa7d2f0
sub eax, edx
mov byte [esp + eax + 0xb], bl
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa7d330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x26
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0xc], cl
je 0xa7d385
lea esi, [esp + 0xc]
sub esi, eax
jmp 0xa7d370
mov cl, byte [eax + 1]
mov bl, byte [esi + eax]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, bl
test cl, cl
mov byte [esi + eax], dl
jne 0xa7d370
lea eax, [esp + 0xc]
push 0
push eax
lea ebx, [esp + 0x28]
mov byte [esp + edi + 0x14], 0
call fcn.00a7c390
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
push ecx
push edx
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret