joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a0420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [0xc26b14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
test ebx, ebx
je 0x7a05ff
mov eax, fcn.0082ccb0
mov edi, 0xc26b14
and eax, 1
inc eax
mov dword [esp + 0x1c], eax
cmp dword [ebx + 0x5c], 0
jne 0x7a05f0
mov eax, dword [ebx]
mov dword [esp + 0x10], edi
test eax, eax
je 0x7a046c
push eax
call fcn.00780c00
add esp, 4
cmp dword [ebx + 0x4c], 0
jle 0x7a059a
xor edi, edi
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov edi, dword [ecx*4 + 0xb559d0]
mov ebp, dword [ecx*4 + 0xb55b10]
mov dword [esp + 0x24], ecx
mov edx, 1
xor eax, fcn.0082ccb0
mov eax, 1
sete bl
or ebx, 0x5ffd7460
add ebx, 0x400
xor ebx, dword [ecx*4 + 0xb55610]
mov ecx, ebx
and cl, 7
shl eax, cl
movzx esi, cl
xor cl, 7
shl edx, cl
movzx ecx, byte [edi + ebp - 1]
bt ecx, esi
jb 0x7a0561
mov dword [esp], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7a04e3
mov ecx, dword [esp]
movzx eax, al
test edx, eax
je 0x7a0504
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7a04f9
jmp 0x7a0561
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7a055b
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7a0554
xor eax, eax
mov esi, edi
mov dword [esp + 0x20], ecx
mov ecx, esi
mov dword [esp + 0x28], esi
mov esi, dword [esi]
mov dword [esp + 4], ebx
xor esi, ebx
mov dword [ecx], esi
mov ecx, eax
not esi
inc eax
shl dword [esp + 4], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x20]
or ebx, dword [esp + 4]
imul ebx, esi
mov esi, dword [esp + 0x28]
add esi, 4
cmp eax, ecx
jne 0x7a051d
mov eax, dword [esp]
or byte [edi + ebp - 1], al
not dl
and byte [edi + ebp - 1], dl
mov ecx, dword [esp + 0x24]
inc ecx
cmp ecx, 0x50
jne 0x7a0482
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [ebx + 0x54]
push dword [eax + edi*8 + 4]
call dword [0xbb3744]
mov eax, dword [ebx + 0x54]
push dword [eax + edi*8]
call dword [0xbb34a4]
inc edi
cmp edi, dword [ebx + 0x4c]
jl 0x7a047c
mov eax, dword [ebx + 0x10]
inc eax
cmp eax, 2
jb 0x7a05af
lea eax, [ebx + 8]
push eax
call fcn.00799ad0
add esp, 4
cmp dword [esp + 0xc], 0
mov edi, dword [esp + 0x10]
je 0x7a05d5
call fcn.0079d240
push 0
push dword [ebx + 4]
push dword [esp + 0x10]
call fcn.00784aa0
add esp, 0xc
call fcn.0079d250
mov eax, dword [ebx + 0x64]
mov dword [edi], eax
push dword [ebx + 0x54]
call fcn.00780f60
add esp, 4
push ebx
call fcn.00780f60
add esp, 4
jmp 0x7a05f5
add ebx, 0x64
mov edi, ebx
mov ebx, dword [edi]
test ebx, ebx
jne 0x7a044f
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a0610
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, edx
call fcn.00783c30
test eax, eax
je 0x783f87
mov ecx, eax
mov edx, esi
mov edi, eax
call fcn.00799950
mov esi, eax
push edi
call fcn.00780f60
add esp, 4
mov eax, esi
jmp 0x783f89
xor eax, eax
pop esi
pop edi
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0xc26a74]
mov esi, ecx
cmp eax, 2
je 0x7a0755
call fcn.00783aa0
test eax, eax
jne 0x7a0755
mov eax, 0x799700
mov dword [esp + 8], esi
xor esi, esi
not eax
and eax, 1
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb559d0]
mov ebp, dword [esi*4 + 0xb55b10]
mov dword [esp + 0x18], esi
add ecx, 0x799700
sete al
mov ecx, eax
xor ecx, 0xf395b571
lea edx, [ecx + eax*2 + 0x118]
mov eax, 1
xor edx, dword [esi*4 + 0xb55750]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7a072f
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7a06b4
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x7a06d6
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7a06cb
jmp 0x7a072f
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7a0725
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7a071d
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7a06f3
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x50
jne 0x7a0648
call dword [0xbb3480]
mov ecx, dword [esp + 8]
mov edx, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp 0x783f60
mov ecx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00783c30
Function at 0x7a0770
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [esp + 4], ecx
mov edx, fcn.007a54f0
xor ecx, ecx
mov eax, dword [0xbd33e0]
imul edx, edx
and edx, 3
xor eax, esp
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], edx
xor edx, edx
cmp dword [esp + 0x10], 1
mov edi, dword [ecx*4 + 0xb559d0]
mov ebp, dword [ecx*4 + 0xb55b10]
mov dword [esp + 0x18], ecx
mov eax, 1
seta dl
xor edx, 0x17440651
add edx, 0x30c
xor edx, dword [ecx*4 + 0xb55890]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7a0876
mov dword [esp + 8], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7a07fb
mov ecx, dword [esp + 8]
movzx eax, al
test ebx, eax
je 0x7a081d
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7a0812
jmp 0x7a0876
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7a086c
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7a0864
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7a083a
mov eax, dword [esp + 8]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x7a0797
mov eax, dword [0xc26a74]
cmp eax, 2
je 0x7a089b
call fcn.00783aa0
test eax, eax
je 0x7a0920
mov ebp, dword [esp + 4]
lea esi, [esp + 0x1c]
lea edi, [esp + 0x40]
lea ebx, [esp + 0x44]
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
push esi
push 0
push ebp
call dword [0xbb3588]
test eax, eax
jne 0x7a091a
mov ecx, edi
mov edx, ebx
call fcn.0079d260
test eax, eax
jne 0x7a08fb
xor esi, esi
jmp 0x7a093a
mov eax, dword [esp + 0x1c]
jmp 0x7a092a
push dword [esp + 4]
call dword [0xbb3570]
mov ecx, eax
xor esi, esi
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
cmovne esi, ecx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a0950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, fcn.008465e0
mov edx, ecx
movzx ecx, byte [0xbb4b37]
imul esi, esi
and esi, 3
cmp esi, 3
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x7a0ab7
mov al, byte [0xbb4b37]
cmp esi, 3
mov ah, 1
sete cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb4b37], ah
jne 0x7a0980
mov ecx, fcn.008465e0
movzx esi, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete ah
or ah, 4
xor ah, 7
movzx eax, ah
bt esi, eax
jae 0x7a09da
cmp ecx, 3
movzx esi, byte [0xbb4b37]
sete al
or al, 4
movzx eax, al
bt esi, eax
jae 0x7a09be
jmp 0x7a0ab7
cmp ecx, 3
movzx esi, byte [0xbb4b37]
sete al
or al, 4
movzx eax, al
bt esi, eax
jb 0x7a0a96
mov eax, fcn.008465e0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
mov eax, dword [0xbb4b20]
sete cl
or ecx, 0x449c6450
add ecx, 0x104c
mov esi, ecx
xor eax, ecx
shr esi, 0x1f
mov dword [0xbb4b20], eax
not eax
or esi, ecx
and cl, 7
imul esi, eax
mov eax, dword [0xbb4b24]
mov ebx, esi
lea edi, [esi + esi]
shr ebx, 0x1e
or edi, ebx
xor eax, esi
mov dword [0xbb4b24], eax
not eax
mov esi, dword [0xbb4b28]
imul eax, edi
lea edi, [eax*4]
xor esi, eax
shr eax, 0x1d
mov dword [0xbb4b28], esi
or edi, eax
not esi
mov eax, dword [0xbb4b2c]
imul esi, edi
lea edi, [esi*8]
xor eax, esi
shr esi, 0x1c
mov dword [0xbb4b2c], eax
or edi, esi
not eax
imul eax, edi
xor dword [0xbb4b30], eax
mov ah, 1
shl ah, cl
or byte [0xbb4b37], ah
mov eax, fcn.008465e0
imul eax, eax
and eax, 3
cmp eax, 3
mov al, 0xfe
sete cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb4b37], al
mov ecx, 0xe
push 0xbb4b20
call fcn.007a0ad0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x7a0eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [ecx + 8]
test eax, eax
jle 0x7a0ee0
xor ebx, ebx
mov edi, eax
movzx eax, byte [edx + ebx]
mov ebp, dword [ecx]
xor byte [ebp + esi], al
inc esi
mov eax, edi
mov edi, 0
cmp esi, dword [ecx + 4]
cmovge esi, edi
inc ebx
cmp ebx, eax
jne 0x7a0ec1
mov dword [ecx + 8], esi
add dword [ecx + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a3ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0xbd33e0]
mov ebx, edx
mov esi, ecx
xor eax, ebp
mov dword [esp + 8], eax
call fcn.0079d240
mov ecx, dword [esi + 8]
mov edx, esp
call fcn.007a5380
test eax, eax
je 0x7a3f27
mov edi, eax
call fcn.0079d250
jmp 0x7a3f5c
mov eax, dword [ebp + 8]
cmp ebx, dword [esp]
mov ecx, eax
sbb ecx, dword [esp + 4]
jl 0x7a3f3f
call fcn.0079d250
jmp 0x7a413e
mov ecx, dword [esi + 8]
mov edx, ebx
push eax
call fcn.007a58c0
add esp, 4
mov edi, eax
call fcn.0079d250
test edi, edi
je 0x7a413e
mov edx, 0x78b490
xor eax, eax
movzx ebx, byte [0xbb4d2f]
and edx, 1
inc edx
mov ecx, edx
xor ecx, 0x78b490
sete al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt ebx, eax
jb 0x7a412d
mov al, byte [0xbb4d2f]
mov ebx, edx
xor ecx, ecx
mov ah, 1
xor ebx, 0x78b490
sete cl
mov ebx, ecx
xor ebx, 3
lea ecx, [ebx + ecx*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb4d2f], ah
jne 0x7a3f8f
mov ecx, 0x78b490
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, 0x78b490
sete dl
mov ebx, edx
xor ebx, 3
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7a4009
mov edx, ecx
xor eax, eax
movzx ebx, byte [0xbb4d2f]
xor edx, 0x78b490
sete al
mov edx, eax
xor edx, 3
lea eax, [edx + eax*2]
bt ebx, eax
jae 0x7a3fe3
jmp 0x7a412d
xor eax, eax
xor ecx, 0x78b490
movzx edx, byte [0xbb4d2f]
sete al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x7a4105
mov eax, 0x78b490
xor ecx, ecx
and eax, 1
inc eax
xor eax, 0x78b490
sete cl
mov eax, ecx
xor eax, 0x41faf22b
lea ecx, [eax + ecx*2 + 0x920]
mov eax, dword [0xbb4d10]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb4d10], eax
not eax
imul edx, eax
mov eax, dword [0xbb4d14]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb4d14], eax
or ebx, edx
not eax
mov edx, dword [0xbb4d18]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb4d18], edx
or ebx, eax
not edx
mov eax, dword [0xbb4d1c]
imul edx, ebx
lea ebx, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb4d1c], eax
or ebx, edx
not eax
mov edx, dword [0xbb4d20]
imul eax, ebx
mov ebx, eax
shl ebx, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb4d20], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [str._JPLW]
mov ebx, edx
shl ebx, 5
xor eax, edx
shr edx, 0x1a
mov dword [str._JPLW], eax
or edx, ebx
not eax
imul eax, edx
mov dl, 1
xor dword [0xbb4d28], eax
shl dl, cl
or byte [0xbb4d2f], dl
mov eax, 0x78b490
xor ecx, ecx
and eax, 1
inc eax
xor eax, 0x78b490
sete cl
mov eax, ecx
xor eax, 3
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb4d2f], al
push dword [esi + 0x6c]
push 0xbb4d10
push edi
call fcn.00783470
add esp, 0xc
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.00989fe9
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a5560
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, fcn.007bbfd0
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb4d0b]
not esi
and esi, 1
mov ecx, esi
add ecx, fcn.007bbfd0
sete al
mov ecx, eax
xor ecx, 3
lea eax, [eax + ecx*2]
bt edi, eax
jb 0x7a572d
mov al, byte [0xbb4d0b]
mov edi, esi
xor ecx, ecx
mov ah, 1
add edi, fcn.007bbfd0
sete cl
mov edi, ecx
not edi
and edi, 3
lea ecx, [ecx + edi*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb4d0b], ah
jne 0x7a5599
mov ecx, fcn.007bbfd0
xor ebx, ebx
movzx eax, al
not ecx
and ecx, 1
mov esi, ecx
add esi, fcn.007bbfd0
sete bl
mov esi, ebx
not esi
and esi, 3
lea ebx, [ebx + esi*2]
xor bl, 7
movzx esi, bl
bt eax, esi
jae 0x7a5618
mov esi, ecx
xor eax, eax
add esi, fcn.007bbfd0
movzx esi, byte [0xbb4d0b]
sete al
mov ebx, eax
xor ebx, 3
lea eax, [eax + ebx*2]
bt esi, eax
jae 0x7a55f2
jmp 0x7a572d
xor eax, eax
add ecx, fcn.007bbfd0
movzx esi, byte [0xbb4d0b]
sete al
mov ecx, eax
xor ecx, 3
lea eax, [eax + ecx*2]
bt esi, eax
jb 0x7a5701
mov ecx, fcn.007bbfd0
xor eax, eax
not ecx
and ecx, 1
add ecx, fcn.007bbfd0
sete al
mov esi, eax
not esi
and esi, 0x1f3
lea ecx, [eax + esi*2]
lea eax, [eax + esi*2 - 0xe21f400]
xor eax, dword [0xbb4cf0]
mov esi, ecx
and cl, 7
or esi, 0xf1de0c01
mov dword [0xbb4cf0], eax
not eax
imul esi, eax
mov eax, dword [0xbb4cf4]
lea edi, [esi + esi]
xor eax, esi
shr esi, 0x1e
mov dword [0xbb4cf4], eax
or edi, esi
not eax
mov esi, dword [0xbb4cf8]
imul eax, edi
lea edi, [eax*4]
xor esi, eax
shr eax, 0x1d
mov dword [0xbb4cf8], esi
or edi, eax
not esi
mov eax, dword [0xbb4cfc]
imul esi, edi
lea edi, [esi*8]
xor eax, esi
shr esi, 0x1c
mov dword [0xbb4cfc], eax
or edi, esi
not eax
mov esi, dword [0xbb4d00]
imul eax, edi
mov edi, eax
shl edi, 4
xor esi, eax
shr eax, 0x1b
mov dword [0xbb4d00], esi
or eax, edi
not esi
imul esi, eax
mov ah, 1
xor dword [0xbb4d04], esi
shl ah, cl
or byte [0xbb4d0b], ah
mov ecx, fcn.007bbfd0
xor eax, eax
not ecx
and ecx, 1
add ecx, fcn.007bbfd0
sete al
mov ecx, eax
not ecx
and ecx, 3
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb4d0b], al
mov ecx, 0xb
push 0xbb4cf0
call fcn.007a0ad0
add esp, 4
mov eax, 0xb
pop esi
pop edi
pop ebx
ret
Function at 0x7aa380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [ecx + 0x30], 0
jne 0x7aa5de
mov ebp, dword [ecx + 0xc]
mov esi, ecx
mov ecx, dword [ebp + 0x48]
mov edi, dword [ebp + 0x38]
call fcn.00788380
test eax, eax
jne 0x7aa5de
mov edx, fcn.00835840
xor eax, eax
movzx ebx, byte [0xbb4d97]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.00835840
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x7aa555
mov al, byte [0xbb4d97]
mov dword [esp], ebp
mov ebp, edx
xor ebx, ebx
mov ah, 1
xor ebp, fcn.00835840
sete bl
mov ecx, ebx
not ecx
lea ecx, [ecx + ebx*2]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb4d97], ah
jne 0x7aa3e3
mov ecx, fcn.00835840
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, fcn.00835840
sete dl
mov ebx, edx
not ebx
lea edx, [ebx + edx*2]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7aa468
mov ebp, dword [esp]
mov edx, ecx
xor eax, eax
movzx ebx, byte [0xbb4d97]
xor edx, fcn.00835840
sete al
mov edx, eax
not edx
lea eax, [edx + eax*2]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x7aa43e
jmp 0x7aa555
xor eax, eax
xor ecx, fcn.00835840
movzx edx, byte [0xbb4d97]
mov ebp, dword [esp]
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7aa52b
mov eax, fcn.00835840
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00835840
sete cl
mov eax, ecx
xor eax, 0x34d3f5f
lea ecx, [eax + ecx*2 + 0x40]
mov eax, dword [0xbb4d80]
xor eax, ecx
mov dword [0xbb4d80], eax
not eax
mov edx, dword [0xbb4d84]
imul eax, ecx
and cl, 7
lea ebx, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbb4d84], edx
or ebx, eax
not edx
mov eax, dword [0xbb4d88]
imul edx, ebx
lea ebx, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbb4d88], eax
or ebx, edx
not eax
mov edx, dword [0xbb4d8c]
imul eax, ebx
lea ebx, [eax*8]
xor edx, eax
shr eax, 0x1c
mov dword [0xbb4d8c], edx
or ebx, eax
not edx
mov al, 1
imul edx, ebx
shl al, cl
xor dword [0xbb4d90], edx
or byte [0xbb4d97], al
mov eax, fcn.00835840
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00835840
sete cl
mov eax, ecx
not eax
lea ecx, [eax + ecx*2]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb4d97], al
mov eax, dword [0xbb4d8c]
mov dword [edi + 0xc], eax
mov eax, dword [0xbb4d88]
mov dword [edi + 8], eax
mov eax, dword [0xbb4d84]
mov dword [edi + 4], eax
mov eax, dword [0xbb4d80]
mov dword [edi], eax
mov al, byte [esi + 0x25]
mov byte [edi + 0x10], al
mov al, byte [esi + 0x26]
mov byte [edi + 0x11], al
mov word [edi + 0x12], 0x101
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x28]
mov byte [edi + 0x14], al
lea eax, [edi + 0x18]
mov word [edi + 0x15], 0x2040
mov byte [edi + 0x17], 0x20
push 0x4c
push 0
push eax
call fcn.0098a5f0
add esp, 0xc
mov ecx, ebp
mov edx, 0xd
call fcn.007aaf90
or byte [esi + 0x18], 2
lea ecx, [edi + 0x34]
movzx edx, byte [esi + 0x11]
call fcn.004b5980
movzx edx, byte [esi + 0x12]
lea ecx, [edi + 0x40]
call fcn.004b5980
xor eax, eax
mov dword [esi + 0x30], 1
mov byte [edi + 0x1f], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7af000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x7c3400
xor esi, esi
mov dword [esp + 0xc], ecx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor eax, eax
cmp dword [esp + 0x10], 2
mov edi, dword [esi*4 + 0xb559d0]
mov ebp, dword [esi*4 + 0xb55b10]
mov dword [esp + 0x18], esi
mov ebx, 1
sete al
mov ecx, eax
xor ecx, 0x5b198297
lea edx, [ecx + eax*2 + 0x1050]
xor edx, dword [esi*4 + 0xb55c50]
mov esi, 1
mov ecx, edx
and cl, 7
shl esi, cl
movzx eax, cl
xor cl, 7
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
bt ecx, eax
jb 0x7af0fa
mov eax, esi
mov al, byte [edi + ebp - 1]
mov dword [esp], esi
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7af07e
mov ecx, dword [esp]
movzx eax, al
test ebx, eax
je 0x7af09f
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7af094
jmp 0x7af0fa
mov dword [esp + 8], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7af0f0
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7af0e9
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp + 4], edx
inc eax
shl dword [esp + 4], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp + 4]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7af0bc
mov eax, dword [esp]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x50
jne 0x7af01c
push 1
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [0xbb3780]
cmp eax, 0xc0
mov esi, 0
je 0x7af01c
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7ba6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.0066e960
mov dword [esp + 8], ecx
mov ecx, fcn.0066e960
xor edx, edx
xor eax, 2
or ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [edx*4 + 0xb55df0]
mov edi, dword [edx*4 + 0xb560b0]
mov dword [esp + 0x1c], edx
add eax, dword [esp + 0x10]
mov eax, 1
sete bl
or ebx, 0xe263bba
xor ebx, dword [edx*4 + 0xb56370]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7ba7b1
mov dword [esp + 4], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x7ba736
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x7ba758
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x7ba74d
jmp 0x7ba7b1
mov dword [esp + 0xc], edx
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x7ba7a7
lea ecx, [edi - 4]
shr ecx, 2
je 0x7ba79f
xor eax, eax
mov edx, ebp
mov dword [esp + 0x18], ecx
mov esi, dword [edx]
mov ecx, eax
mov dword [esp], ebx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, ebx
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp]
mov dword [edx], esi
not esi
add edx, 4
imul ebx, esi
cmp eax, ecx
jne 0x7ba775
mov eax, dword [esp + 4]
or byte [ebp + edi - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [ebp + edi - 1], al
mov edx, dword [esp + 0x1c]
inc edx
cmp edx, 0xb0
jne 0x7ba6d5
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0xb4c590]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7c0f30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ecx, 6
je 0x7c105b
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, fcn.007c9d10
mov dword [esp + 8], ecx
not edx
and edx, 1
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
xor edx, edx
mov edi, dword [eax*4 + 0xb566f0]
mov ebp, dword [eax*4 + 0xb56710]
mov dword [esp + 0x18], eax
add ecx, fcn.007c9d10
sete dl
mov ecx, edx
xor ecx, 0xa8ab6453
lea edx, [ecx + edx*2 + 0x1218]
xor edx, dword [eax*4 + 0xb56730]
mov eax, 1
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7c103b
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7c0fc0
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x7c0fe2
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7c0fd7
jmp 0x7c103b
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7c1031
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7c1029
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7c0fff
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 6
jne 0x7c0f54
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0xb4c930]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7c36d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [ecx + 0x32], 0
and byte [ecx + 1], 0xf9
movsx edx, byte [ecx + 0x44]
movzx eax, word [ecx + edx*2 + 0x46]
dec dl
mov word [ecx + 0x46], ax
mov eax, dword [ecx + 0x74]
mov byte [ecx + 0x44], dl
movsx edx, dl
mov edx, dword [ecx + edx*4 + 0x78]
mov dword [ecx + 0x74], edx
mov ecx, eax
jmp fcn.007ac4a0