joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20769fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
xor eax, eax
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 5], eax
mov dword [esp + 9], eax
cmp esi, 0x15
mov dword [esp + 0xd], eax
mov byte [esp + 4], 0
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
jae 0x20769ff2
mov eax, 1
pop esi
add esp, 0x18
ret
push 0x15
lea ecx, [esp + 8]
push 0
push ecx
call fcn.20769810
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x21], al
mov byte [esp + 0x1c], al
mov al, 0x53
mov byte [esp + 0x17], dl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x19], al
mov byte [esp + 0x14], al
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push esi
mov cl, 0x61
push edx
push eax
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x22], 0x66
mov byte [esp + 0x1e], cl
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x29], cl
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x27], 0x46
mov byte [esp + 0x2b], 0x75
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x26], 0x50
call fcn.20769150
add esp, 0x18
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x2076a140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 5], eax
mov dword [esp + 9], eax
cmp esi, 0xe
mov dword [esp + 0xd], eax
mov byte [esp + 4], 0
mov byte [esp + 0x11], al
jae 0x2076a16e
mov eax, 1
pop esi
add esp, 0x10
ret
push 0xe
lea ecx, [esp + 8]
push 0
push ecx
call fcn.20769810
mov al, 0x20
lea edx, [esp + 0x10]
mov byte [esp + 0x16], al
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x24]
push esi
mov cl, 0x61
push edx
push eax
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x44
mov byte [esp + 0x28], 0x31
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1f], 0x64
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x24], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x20], 0x6f
call fcn.20769150
add esp, 0x18
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x2076a1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 5], eax
mov dword [esp + 9], eax
cmp esi, 0xe
mov dword [esp + 0xd], eax
mov byte [esp + 4], 0
mov byte [esp + 0x11], al
jae 0x2076a20e
mov eax, 1
pop esi
add esp, 0x10
ret
push 0xe
lea ecx, [esp + 8]
push 0
push ecx
call fcn.20769810
mov al, 0x20
lea edx, [esp + 0x10]
mov byte [esp + 0x16], al
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x24]
push esi
mov cl, 0x61
push edx
push eax
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x44
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1f], 0x64
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x24], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x20], 0x6f
call fcn.20769150
add esp, 0x18
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x2076b780
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 0xc]
mov edx, 0xc6ef3720
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 8]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 4]
mov esi, dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add edx, 0x61c88647
sub ecx, esi
dec edi
jne 0x2076b7b9
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret 8

Function at 0x2076b860
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 4]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x2076b896
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x2076ba10
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
sub esi, ecx
lea eax, [edi + ecx]
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x2076ba33
inc ebp
cmp ebp, 4
jl 0x2076ba1b
cmp edi, 0xb0
jge 0x2076baea
mov ebp, 0x20717bb4
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, 0x80000003
jns 0x2076ba6e
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + 0x207179b4]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x2076ba5e
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x2076baa8
inc esi
cmp esi, 4
jl 0x2076ba9f
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x2076bac8
inc esi
cmp esi, 4
jl 0x2076babf
cmp edi, 0xb0
jl 0x2076ba58
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x2076bb00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebp
push esi
call fcn.2076bb90
add esp, 8
lea edi, [ebp + 0x10]
mov ebx, 9
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x207179b4]
mov byte [eax + esi - 1], dl
jl 0x2076bb20
push 0
push esi
call fcn.2076bbc0
push esi
call fcn.2076bc10
push edi
push esi
call fcn.2076bb90
add esp, 0x14
add edi, 0x10
dec ebx
jne 0x2076bb1e
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x207179b4]
mov byte [eax + esi - 1], dl
jl 0x2076bb55
push 0
push esi
call fcn.2076bbc0
add ebp, 0xa0
push ebp
push esi
call fcn.2076bb90
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x2076bb90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push esi
sub ecx, eax
mov esi, 0x10
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x2076bba1
pop esi
pop ebx
ret
Function at 0x2076bd30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
lea eax, [ebp + 0xa0]
push eax
push esi
call fcn.2076bb90
add esp, 8
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x20717ab4]
mov byte [eax + esi - 1], dl
jl 0x2076bd4e
push 0x10
push esi
call fcn.2076bbc0
add esp, 8
lea edi, [ebp + 0x90]
mov ebx, 9
push edi
push esi
call fcn.2076bb90
push esi
call fcn.2076bdc0
add esp, 0xc
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x20717ab4]
mov byte [eax + esi - 1], dl
jl 0x2076bd8b
push 0x10
push esi
call fcn.2076bbc0
add esp, 8
sub edi, 0x10
dec ebx
jne 0x2076bd79
push ebp
push esi
call fcn.2076bb90
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x2076bdc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor edi, edi
lea eax, [esp + edi + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
sub eax, ecx
mov esi, 1
mov dword [esp + 0x10], eax
lea edx, [esi - 2]
and edx, 3
add edx, edi
mov al, byte [edx + ebp]
push eax
push 9
call fcn.2076bce0
lea ecx, [esi + 1]
mov bl, al
and ecx, 3
add ecx, edi
mov dl, byte [ecx + ebp]
push edx
push 0xd
call fcn.2076bce0
xor bl, al
mov eax, esi
and eax, 3
add eax, edi
mov cl, byte [eax + ebp]
push ecx
push 0xb
call fcn.2076bce0
mov edx, dword [esp + 0x28]
xor bl, al
mov eax, dword [esp + 0x40]
mov cl, byte [edx + eax]
push ecx
push 0xe
call fcn.2076bce0
add esp, 0x20
xor bl, al
mov eax, dword [esp + 0x28]
inc esi
mov byte [eax], bl
lea edx, [esi - 1]
inc eax
cmp edx, 4
mov dword [esp + 0x28], eax
jl 0x2076bde6
add edi, 4
cmp edi, 0x10
jl 0x2076bdcd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebp], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
pop edi
mov dword [ebp + 0xc], eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x2076c6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.2077cfd0
mov ebp, dword [esp + 0x18]
add esp, 4
test ebp, ebp
je 0x2076c785
mov al, byte [esi + 1]
and al, 0xf
cmp al, 0xf
je 0x2076c6dd
pop edi
pop esi
mov ax, 0x1d02
pop ebp
ret
xor eax, eax
mov cl, byte [eax + esi + 8]
mov byte [eax + esi], cl
inc eax
cmp eax, 0x40
jb 0x2076c6df
push esi
push ebp
call fcn.2076bd30
add esp, 8
xor eax, eax
mov dl, byte [eax + esi + 0x10]
mov cl, byte [eax + esi]
xor cl, dl
mov byte [eax + esi], cl
inc eax
cmp eax, 0x10
jb 0x2076c6f8
lea edi, [esi + 0x10]
push ebx
push edi
push ebp
call fcn.2076bd30
mov ecx, 0xfffffff0
add esp, 8
mov eax, edi
sub ecx, esi
mov dl, byte [eax + 0x10]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jb 0x2076c721
lea edi, [esi + 0x20]
push edi
push ebp
call fcn.2076bd30
mov ecx, 0xffffffe0
add esp, 8
mov eax, edi
sub ecx, esi
mov dl, byte [eax + 0x10]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jb 0x2076c749
lea eax, [esi + 0x30]
push eax
push ebp
call fcn.2076bd30
mov cl, byte [esi + 6]
mov al, byte [esi + 0x3e]
add esp, 8
cmp cl, al
pop ebx
jne case.0x2076c7bf.4
mov dl, byte [esi + 7]
mov al, byte [esi + 0x3f]
cmp dl, al
je 0x2076c785
pop edi
pop esi
mov ax, 0x1d02
pop ebp
ret
mov dl, byte [esi + 4]
mov cl, byte [esi + 5]
xor eax, eax
mov al, byte [esi + 1]
mov edi, eax
add eax, edx
mov dl, byte [esi + 3]
add ecx, eax
mov al, byte [esi + 2]
add ecx, edx
add eax, ecx
xor ecx, ecx
mov cl, byte [esi]
and eax, 0xff
xor eax, ecx
je 0x2076c7b5
pop edi
pop esi
mov ax, 0x1d0d
pop ebp
ret
mov eax, edi
and eax, 0xf
cmp eax, 7
ja case.default.0x2076c7bf
jmp dword [eax*4 + 0x2076c808]
pop edi
pop esi
xor ax, ax
pop ebp
ret
pop edi
pop esi
mov ax, 0x1d41
pop ebp
ret
pop edi
pop esi
mov ax, 0x1d04
pop ebp
ret
pop edi
pop esi
mov ax, 0x1d0a
pop ebp
ret
pop edi
pop esi
mov ax, 0x1d15
pop ebp
ret
pop edi
pop esi
mov ax, 0x1d42
pop ebp
ret
pop edi
pop esi
mov ax, 0x1d3f
pop ebp
ret
pop edi
pop esi
mov ax, 0x1dff
pop ebp
ret
Function at 0x2076d050
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x158
push ebx
push ebp
push edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x10]
mov byte [esp + 0x64], al
rep stosd dword es:[edi], eax
mov ecx, 0x2b
lea edi, [esp + 0x65]
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x174]
mov ecx, 0x16
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [esp + 0xc]
cmp ebx, 0x3a
rep stosd dword es:[edi], eax
ja 0x2076d272
mov ebp, dword [esp + 0x178]
test ebp, ebp
je 0x2076d272
mov eax, dword [esp + 0x17c]
test eax, eax
je 0x2076d272
cmp dword [esp + 0x180], 0x50
jb 0x2076d272
push esi
lea esi, [esp + 0x118]
test ebx, ebx
je 0x2076d0f7
mov esi, dword [esp + 0x174]
lea eax, [esp + 0x1e]
push 2
push eax
mov byte [esp + 0x20], 7
call fcn.2076b9e0
mov cl, byte [esp + 0x16c]
mov dl, byte [esp + 0x170]
mov al, byte [esi]
mov byte [esp + 0x20], cl
mov cl, byte [esi + 1]
mov byte [esp + 0x21], dl
mov dl, byte [esi + 2]
mov byte [esp + 0x23], cl
mov byte [esp + 0x22], al
mov al, byte [esi + 3]
lea ecx, [esp + 0x26]
push 2
push ecx
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], al
call fcn.2076b9e0
cmp ebx, 4
jbe 0x2076d175
lea ecx, [ebx - 4]
add esi, 4
mov edx, ecx
lea edi, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, 0x39
mov ecx, edx
sub eax, ebx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jle 0x2076d181
push eax
lea eax, [esp + ebx + 0x28]
push eax
jmp 0x2076d17c
lea ecx, [esp + 0x28]
push 0x35
push ecx
call fcn.2076b9e0
cmp ebx, 4
jbe 0x2076d18f
sub bl, 4
mov byte [esp + 0x5d], bl
jmp 0x2076d194
mov byte [esp + 0x5d], 0
mov dl, byte [esp + 0x26]
mov al, byte [esp + 0x27]
lea ecx, [esp + 0x68]
push ebp
push ecx
mov byte [esp + 0x66], dl
mov byte [esp + 0x67], al
call fcn.2076ba10
lea edx, [esp + 0x58]
lea eax, [esp + 0x70]
push edx
push eax
call fcn.2076bd30
add esp, 0x10
xor eax, eax
mov cl, byte [esp + eax + 0x40]
mov bl, byte [esp + eax + 0x50]
xor bl, cl
mov byte [esp + eax + 0x50], bl
inc eax
cmp eax, 0x10
jb 0x2076d1c3
lea edx, [esp + 0x40]
lea eax, [esp + 0x68]
push edx
push eax
call fcn.2076bd30
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0x30]
mov bl, byte [esp + eax + 0x40]
xor bl, cl
mov byte [esp + eax + 0x40], bl
inc eax
cmp eax, 0x10
jb 0x2076d1eb
lea edx, [esp + 0x30]
lea eax, [esp + 0x68]
push edx
push eax
call fcn.2076bd30
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0x20]
mov bl, byte [esp + eax + 0x30]
xor bl, cl
mov byte [esp + eax + 0x30], bl
inc eax
cmp eax, 0x10
jb 0x2076d213
lea edx, [esp + 0x20]
lea eax, [esp + 0x68]
push edx
push eax
call fcn.2076bd30
lea ecx, [esp + 0x20]
lea edx, [esp + 0x70]
push ecx
push edx
call fcn.2076ba10
lea eax, [esp + 0x28]
push eax
call fcn.2077cfd0
mov edi, dword [esp + 0x194]
mov ecx, 0x14
lea esi, [esp + 0x2c]
add esp, 0x14
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop ebp
xor ax, ax
pop ebx
add esp, 0x158
ret
pop edi
pop ebp
mov ax, 0x1d10
pop ebx
add esp, 0x158
ret
Function at 0x2076e9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
xor eax, eax
mov ecx, 0x1e
mov dword [esp + 0xa], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0xe], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x12], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], ecx
mov word [esp + 0x16], ax
lea ecx, [esp + 8]
mov eax, 0x1f
push ecx
mov word [esp + 0xc], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x1c
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
call dword [fcn.20ad60b8]
mov edx, dword [esp + 8]
and edx, 0xffff
push edx
call fcn.20769270
add esp, 4
test eax, eax
je 0x2076ea75
mov dword [esp + 0x20], 0x1d
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
and eax, 0xffff
and edx, 0xffff
mov dword [esp + 4], eax
mov eax, dword [esp + 0xe]
and eax, 0xffff
push esi
push edi
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*8]
mov ecx, dword [esp + 0x1a]
and ecx, 0xffff
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
and eax, 0xffff
lea eax, [eax + edx*4]
mov edx, dword [esp + 0x1e]
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, dword [esp + 0x12]
and eax, 0xffff
lea esi, [edx + ecx*4 - 0x83d600]
xor ecx, ecx
lea edi, [eax - 1]
mov dword [esp + 8], esi
test edi, edi
jle 0x2076eb1d
lea edx, [esp + 0x24]
cmp ecx, 0xc
jge 0x2076eb11
mov eax, dword [edx]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 9
add esi, eax
inc ecx
add edx, 4
cmp ecx, edi
jl 0x2076eaf3
mov dword [esp + 8], esi
mov eax, dword [esp + 0x58]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
and eax, 0xffff
push edx
push eax
call fcn.20769500
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
and eax, 0xffff
push edx
push eax
call fcn.20769630
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
and eax, 0xffff
push edx
push eax
call fcn.20769740
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x88]
push ecx
push eax
mov word [esi + 4], ax
call fcn.207692b0
mov edx, dword [esp + 0x34]
mov word [esi + 6], ax
mov eax, dword [esp + 0x38]
push edx
push eax
call fcn.207693a0
mov ecx, dword [esp + 0x3c]
mov word [esi + 8], ax
push ecx
call fcn.207691f0
mov edx, dword [esp + 0x40]
mov word [esi + 0xa], ax
push edx
call fcn.20769220
mov word [esi + 0xc], ax
mov eax, dword [esp + 0x44]
push eax
call fcn.20769240
add esp, 0x40
mov word [esi + 0xe], ax
xor ax, ax
pop edi
pop esi
add esp, 0x4c
ret
Function at 0x2076efc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x430
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xc2
xor eax, eax
lea edi, [esp + 0x130]
mov dword [esp + 0x12c], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x440]
xor ecx, ecx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x15], ecx
mov dword [esp + 0xd], eax
cmp esi, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0xc], bl
mov byte [esp + 0x11], al
mov byte [esp + 0x14], bl
mov dword [esp + 0x19], ecx
jne 0x2076f036
pop edi
pop esi
mov ax, 0x10
pop ebx
add esp, 0x430
ret
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.20769a90
add esp, 8
cmp eax, 2
jne 0x2076f05b
pop edi
pop esi
mov ax, 0x13
pop ebx
add esp, 0x430
ret
lea eax, [esp + 0x28]
push 0x101
lea ecx, [esp + 0x138]
push eax
push ecx
mov dword [esp + 0x138], 0x30f
mov dword [esp + 0x13c], 1
call fcn.20769150
lea edx, [esp + 0x138]
push 0x30f
push edx
push 1
call fcn.2077dec0
mov eax, dword [esi + 4]
mov edi, 0x100
add esp, 0x18
test edi, eax
jne 0x2076f0bc
call fcn.2077d9b0
cmp eax, ebx
je 0x2076f0b9
cmp eax, 0x66
jne 0x2076f0bc
or dword [esi + 4], edi
mov eax, dword [esi + 4]
mov edi, 0x200
test edi, eax
jne 0x2076f16a
push 6
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.20769810
push 9
lea ecx, [esp + 0x24]
push ebx
push ecx
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x26], 0x6d
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x28], 0x6e
call fcn.20769810
push ebx
lea edx, [esp + 0x40]
push ebx
lea eax, [esp + 0x40]
push edx
push eax
push 1
lea ecx, [esp + 0x40]
push 8
lea edx, [esp + 0x3c]
push ecx
lea eax, [esi + 0x292]
push edx
push eax
mov byte [esp + 0x54], 0x35
mov byte [esp + 0x55], 0x36
mov byte [esp + 0x52], 0x33
mov byte [esp + 0x53], 0x34
mov byte [esp + 0x50], 0x31
mov byte [esp + 0x57], 0x38
mov byte [esp + 0x51], 0x32
mov byte [esp + 0x56], 0x37
call fcn.2077db30
add esp, 0x3c
cmp eax, ebx
je 0x2076f167
push eax
call fcn.2077d100
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x430
ret
or dword [esi + 4], edi
push ebp
push esi
mov dword [esi + 0xc], ebx
call fcn.2076ed90
mov ebp, eax
add esp, 4
cmp bp, bx
je 0x2076f1a9
lea edi, [esi + 0x292]
push ebx
push edi
push 1
call fcn.2077dd90
mov ecx, dword [esi + 4]
add esp, 0xc
and ch, 0xfd
mov dword [edi], ebx
mov dword [esi + 4], ecx
call fcn.2077da90
mov eax, dword [esi + 4]
and ah, 0xfe
mov dword [esi + 4], eax
mov ax, bp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x430
ret
Function at 0x20779e90
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
xor eax, eax
mov ecx, 0x10
lea edi, [edx + 0x1c]
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
rep stosd dword es:[edi], eax
pop edi
ret 4
Function at 0x207abca0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x15], eax
mov dword [esp + 5], ecx
mov dword [esp + 0x19], eax
mov dword [esp + 9], ecx
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x25], eax
mov dword [esp + 0x15], ecx
mov word [esp + 0x29], ax
mov word [esp + 0x19], cx
push esi
test ebp, ebp
push edi
mov byte [esp + 0x24], 0
mov byte [esp + 0x33], al
mov dword [esp + 0x10], 0x10
mov byte [esp + 0x14], al
mov byte [esp + 0x23], cl
jne 0x207abcfb
pop edi
pop esi
pop ebp
mov eax, 0x80000065
pop ebx
add esp, 0x24
ret
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x207abd10
pop edi
pop esi
pop ebp
mov eax, 0x80000066
pop ebx
add esp, 0x24
ret
mov esi, dword [esp + 0x40]
test esi, esi
jne 0x207abd25
pop edi
pop esi
pop ebp
mov eax, 0x80000067
pop ebx
add esp, 0x24
ret
mov ebx, dword [esp + 0x44]
test ebx, ebx
jne 0x207abd3a
pop edi
pop esi
pop ebp
mov eax, 0x80000068
pop ebx
add esp, 0x24
ret
cmp ebx, 0x10
jae 0x207abdb8
mov dl, bl
push 1
mov al, dl
push 2
mov ah, al
lea ecx, [esp + 0x18]
mov edx, eax
push 1
shl edx, 0x10
mov dx, ax
push ecx
mov dword [esp + 0x24], edx
lea eax, [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
lea edx, [esp + 0x34]
push edx
push 0x10
push eax
push 0
push 0
push 1
push edi
push ebp
call fcn.20798440
add esp, 0x30
test eax, eax
jne 0x207abe21
test ebx, ebx
jbe 0x207abe1f
lea ecx, [esp + 0x24]
lea eax, [esi + ebx]
sub ecx, esi
mov esi, ebx
mov dl, byte [ecx + eax - 1]
mov bl, byte [eax - 1]
dec eax
xor bl, dl
dec esi
mov byte [eax], bl
jne 0x207abd9f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
jbe 0x207abdf0
push 1
push 2
lea eax, [esp + 0x18]
push 1
push eax
push esi
push 0x10
push esi
push 0
push 0
push 1
push edi
push ebp
mov dword [esp + 0x40], 0x10
call fcn.20798440
add esp, 0x30
test eax, eax
jne 0x207abe21
sub ebx, 0xc
add esi, 0xc
cmp ebx, 0x10
ja 0x207abdba
push 1
push 2
lea ecx, [esp + 0x18]
lea esi, [esi + ebx - 0x10]
push 1
push ecx
push esi
push 0x10
push esi
push 0
push 0
push 1
push edi
push ebp
mov dword [esp + 0x40], 0x10
call fcn.20798440
add esp, 0x30
test eax, eax
jne 0x207abe21
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret