joyce8/EMBER2024-capa huggingface dataset:
Function at 0x841640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov ecx, dword [0xbd33e0]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea edi, [esp + 8]
xor ecx, ebp
mov dword [esp + 0x9c], ecx
mov ecx, esi
push edi
push eax
call fcn.008429e0
add esp, 8
test eax, eax
jne 0x8418ba
mov eax, fcn.007abe90
mov edx, 3
movzx ecx, byte [0xbbd973]
sub edx, eax
mov eax, edx
xor eax, fcn.007abe90
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x841852
mov al, byte [0xbbd973]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007abe90
sete cl
or cl, 6
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbd973], ah
jne 0x8416ae
mov edx, fcn.007abe90
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.007abe90
sete dl
or dl, 6
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x841717
mov eax, ecx
movzx edx, byte [0xbbd973]
xor eax, fcn.007abe90
sete al
or al, 6
movzx eax, al
bt edx, eax
jae 0x8416f7
jmp 0x841852
xor ecx, fcn.007abe90
movzx ecx, byte [0xbbd973]
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x84182d
mov eax, fcn.007abe90
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbbd950]
xor edx, fcn.007abe90
sete cl
or ecx, 0x7ade1516
add ecx, 0x400
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbbd950], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbbd954]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbbd954], eax
or edi, edx
not eax
mov edx, dword [0xbbd958]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbbd958], edx
or edi, eax
not edx
mov eax, dword [0xbbd95c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbbd95c], eax
or edi, edx
not eax
mov edx, dword [0xbbd960]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbbd960], edx
or eax, edi
not edx
imul edx, eax
mov eax, dword [0xbbd964]
mov edi, edx
shl edi, 5
xor eax, edx
shr edx, 0x1a
mov dword [0xbbd964], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbbd968]
mov edi, eax
shl edi, 6
xor edx, eax
shr eax, 0x19
mov dword [0xbbd968], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbbd96c], edx
mov dl, 1
shl dl, cl
or byte [0xbbd973], dl
mov eax, fcn.007abe90
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.007abe90
sete cl
or cl, 6
xor cl, 7
rol al, cl
and byte [0xbbd973], al
lea ecx, [esp + 8]
call fcn.00845730
fld qword [esp + 0x28]
fnstcw word [esp + 2]
lea edi, [esp + 0x38]
movzx eax, word [esp + 2]
mov word [esp + 2], 0xc7f
fldcw word [esp + 2]
mov word [esp + 2], ax
fistp dword [esp + 4]
fldcw word [esp + 2]
push dword [esp + 4]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0xbbd950
push edi
push 0x64
call fcn.00783420
add esp, 0x24
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push esi
call fcn.00789a60
add esp, 0x10
mov ecx, dword [esp + 0x9c]
xor ecx, ebp
call fcn.00989fe9
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x8443c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 4], edx
mov edi, fcn.00794d00
mov esi, ecx
mov eax, dword [0xbd33e0]
imul edi, edi
and edi, 3
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
cmp edi, 2
sete al
movzx edx, byte [0xbbd783]
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x844543
mov al, byte [0xbbd783]
xor ecx, ecx
cmp edi, 2
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbd783], ah
jne 0x844409
mov ecx, fcn.00794d00
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x844479
xor eax, eax
cmp ecx, 2
movzx edi, byte [0xbbd783]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 2]
bt edi, eax
jae 0x844457
jmp 0x844543
xor eax, eax
cmp ecx, 2
movzx edx, byte [0xbbd783]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x84451a
mov ecx, fcn.00794d00
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete al
mov ecx, eax
not ecx
and ecx, 0x6d1
lea ecx, [eax + ecx*2 + 0x3c0d612a]
mov eax, dword [0xbbd770]
xor eax, ecx
mov dword [0xbbd770], eax
not eax
mov edx, dword [0xbbd774]
imul eax, ecx
and cl, 7
lea edi, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbbd774], edx
or edi, eax
not edx
mov eax, dword [0xbbd778]
imul edx, edi
lea edi, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbbd778], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbbd77c], eax
or byte [0xbbd783], dl
mov eax, fcn.00794d00
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbbd783], al
mov bl, byte [esi]
lea ebp, [esi + 1]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
cmp bl, 0x2d
cmovne ebp, esi
push eax
push ecx
push edx
push 0xbbd770
push ebp
call fcn.00845060
add esp, 0x14
mov edi, 1
cmp eax, 3
jne 0x8445e7
add ebp, 0xa
mov byte [esp + 3], bl
movzx ecx, byte [ebp]
mov ebx, ebp
inc ebp
movzx eax, byte [ecx + 0xb4bd18]
and al, 1
cmp ecx, 0x54
je 0x84457c
test al, al
jne 0x84457c
mov esi, dword [esp + 4]
mov ecx, ebx
mov edx, esi
call fcn.00844600
test eax, eax
je 0x8445af
cmp byte [ebx], 0
jne 0x8445e7
mov byte [esi + 0x2b], 0
mov byte [esi + 0x28], 0
mov byte [esi + 0x2a], 1
mov eax, dword [esp + 0x10]
mov ecx, eax
neg ecx
cmp byte [esp + 3], 0x2d
cmovne ecx, eax
xor edi, edi
mov dword [esi + 8], ecx
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x10], eax
cmp byte [esi + 0x2c], 0
je 0x8445e7
mov ecx, esi
call fcn.00842b20
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00989fe9
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x845120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0xbd33e0]
mov esi, edx
mov edx, ecx
xor eax, esp
mov dword [esp + 0xc], eax
movzx eax, byte [edx]
mov edi, edx
inc edx
test byte [eax + 0xb4bd18], 1
jne 0x845136
mov dword [esi + 0x1c], 0
mov al, byte [edi]
cmp al, 0x2d
jne 0x84515b
mov dword [esp], 0xffffffff
jmp 0x84516a
cmp al, 0x2b
jne 0x845217
mov dword [esp], 1
mov ebp, fcn.007c8cb0
xor eax, eax
movzx ebx, byte [0xbbd7af]
imul ebp, ebp
and ebp, 3
cmp ebp, 2
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x8452e0
mov al, byte [0xbbd7af]
xor ebx, ebx
cmp ebp, 2
mov ah, 1
sete bl
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbd7af], ah
jne 0x84519f
mov ecx, fcn.007c8cb0
xor ebx, ebx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete bl
mov ebp, ebx
not ebx
lea ebx, [ebp + ebx*2 + 4]
and bl, 7
xor bl, 7
movzx ebx, bl
bt eax, ebx
jae 0x84522c
xor eax, eax
cmp ecx, 2
movzx ebp, byte [0xbbd7af]
sete al
mov ebx, eax
not ebx
lea eax, [eax + ebx*2 + 4]
and al, 7
movzx eax, al
bt ebp, eax
jae 0x8451f1
jmp 0x8452e0
mov ecx, eax
or cl, 0x20
cmp cl, 0x7a
je 0x845314
test al, al
jmp 0x84532a
xor eax, eax
cmp ecx, 2
movzx ebx, byte [0xbbd7af]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x8452b5
mov ecx, fcn.007c8cb0
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete al
mov ecx, eax
not ecx
and ecx, 0x8b
lea ecx, [eax + ecx*2 - 0x285d30cc]
mov eax, dword [0xbbd7a0]
mov ebx, ecx
shr ebx, 0x1f
or ebx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbbd7a0], eax
not eax
imul ebx, eax
mov eax, dword [0xbbd7a4]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbbd7a4], eax
or ebp, ebx
not eax
imul eax, ebp
xor dword [0xbbd7a8], eax
mov ah, 1
shl ah, cl
or byte [0xbbd7af], ah
mov eax, fcn.007c8cb0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
sete cl
mov eax, ecx
not eax
lea ecx, [ecx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbbd7af], al
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push 0xbbd7a0
push edx
call fcn.00845060
add esp, 0x10
mov cl, 1
cmp eax, 2
jne 0x84532d
imul eax, dword [esp + 8], 0x3c
add edi, 6
mov edx, edi
add eax, dword [esp + 4]
imul eax, dword [esp]
mov dword [esi + 0x1c], eax
movzx ecx, byte [edx]
mov eax, edx
inc edx
test byte [ecx + 0xb4bd18], 1
jne 0x845314
mov byte [esi + 0x2d], 1
cmp byte [eax], 0
setne cl
movzx esi, cl
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x846b10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edx, 0x994e6e
mov esi, ecx
xor eax, eax
movzx edi, byte [0xbbdf87]
not edx
and edx, 1
mov ecx, edx
add ecx, 0x994e6e
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edi, eax
jb 0x846c6d
mov al, byte [0xbbdf87]
mov edi, edx
xor ecx, ecx
mov ah, 1
add edi, 0x994e6e
sete cl
mov ebx, ecx
not ebx
lea ecx, [ebx + ecx*2]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbdf87], ah
jne 0x846b4d
mov ecx, 0x994e6e
xor edx, edx
movzx eax, al
not ecx
and ecx, 1
mov edi, ecx
add edi, 0x994e6e
sete dl
mov ebx, edx
not ebx
lea edx, [ebx + edx*2]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x846bd0
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbbdf87]
add edx, 0x994e6e
sete al
mov edx, eax
not edx
lea eax, [edx + eax*2]
and al, 7
movzx eax, al
bt edi, eax
jae 0x846ba6
jmp 0x846c6d
xor eax, eax
add ecx, 0x994e6e
movzx edx, byte [0xbbdf87]
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edx, eax
jb 0x846c42
mov eax, 0x994e6e
xor ecx, ecx
mov edi, dword [0xbbdf7c]
not eax
and eax, 1
add eax, 0x994e6e
sete cl
mov eax, ecx
xor eax, 0xc3e4ea87
lea ecx, [eax + ecx*2 + 0x8a0]
mov edx, ecx
xor edi, ecx
shr edx, 0x1f
mov dword [0xbbdf7c], edi
not edi
or edx, ecx
and cl, 7
imul edx, edi
xor dword [0xbbdf80], edx
mov dl, 1
shl dl, cl
or byte [0xbbdf87], dl
mov eax, 0x994e6e
xor ecx, ecx
not eax
and eax, 1
add eax, 0x994e6e
sete cl
mov eax, ecx
not eax
lea ecx, [eax + ecx*2]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbbdf87], al
push 2
push 0xbbdf7c
push esi
call fcn.00794d00
add esp, 0xc
cmp eax, 7
je 0x846c86
pop esi
pop edi
pop ebx
ret
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.0078a090
Function at 0x87d5b0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
call fcn.00887fe0
add esp, 4
test eax, eax
mov dword [esi], eax
jne 0x87d5d3
push 1
call fcn.0087d550
add esp, 4
xor eax, eax
pop esi
ret
push 0x87d8f0
push eax
call fcn.00888bd0
add esp, 8
push 0x87da30
push 0x87d940
push dword [esi]
call fcn.00888b50
add esp, 0xc
push 0x87dae0
push dword [esi]
call fcn.00888b80
add esp, 8
push esi
push dword [esi]
call fcn.00888a80
add esp, 8
mov eax, 1
pop esi
ret
Function at 0x88dbe0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x88dcce
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x14], edx
mov ebp, dword [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x10]
mov ecx, dword [esp]
add ecx, esi
mov dword [esp], ecx
mov ecx, ebp
adc edi, ebp
shld ecx, esi, 0xd
shld esi, ebp, 0xd
mov ebp, edx
xor ecx, edi
xor esi, dword [esp]
add ebx, eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
adc ecx, edx
shld ebp, eax, 0x10
shld eax, edx, 0x10
xor ebp, ecx
mov dword [esp + 0x18], ecx
mov ecx, edi
mov edi, dword [esp]
xor eax, ebx
add ecx, eax
mov edx, ebp
mov dword [esp], ecx
adc edi, ebp
shld edx, eax, 0x15
shld eax, ebp, 0x15
mov ebp, dword [esp + 8]
xor eax, ecx
xor edx, edi
add ebx, esi
mov ecx, dword [esp + 8]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x18]
adc ebx, dword [esp + 8]
shld ebp, esi, 0x11
shld esi, ecx, 0x11
mov ecx, dword [esp + 0xc]
xor esi, dword [esp + 4]
inc ecx
xor ebp, ebx
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
jne 0x88dc1d
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], esi
mov esi, dword [esp]
mov dword [ecx + 0xc], ebp
mov dword [ecx + 4], edi
mov dword [ecx], esi
mov dword [ecx + 0x1c], edx
mov edx, dword [esp + 4]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x89a260
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov ebp, ecx
mov eax, 0xffffffff
mov ecx, esi
sub ecx, edx
cmp ecx, 2
jl 0x89a39f
mov al, byte [edx]
mov edi, dword [esp + 0x20]
mov ebx, edx
test al, al
jne 0x89a296
movzx eax, byte [ebx + 1]
movzx eax, byte [ebp + eax + 0x48]
jmp 0x89a2a2
movsx edx, byte [ebx + 1]
movsx ecx, al
call fcn.00896fe0
add eax, 0xffffffec
cmp eax, 7
ja case.0x89a2aa.21
jmp dword [eax*4 + 0xb5fe08]
add ebx, 2
mov ecx, ebp
mov edx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0089a930
add ebx, 2
mov eax, 0x21
mov dword [edi], ebx
jmp 0x89a39f
mov dword [esp + 4], ebp
lea eax, [ebx + 2]
mov ebp, esi
sub ebp, eax
cmp ebp, 2
jge 0x89a2f4
mov eax, 0xffffffff
jmp 0x89a39f
mov dword [edi], ebx
jmp 0x89a39d
mov dword [esp], edi
movzx ecx, byte [ebx + 2]
mov edi, eax
movzx eax, byte [ebx + 3]
test cl, cl
jne 0x89a310
mov ecx, dword [esp + 4]
movzx eax, byte [ecx + eax + 0x48]
jmp 0x89a31b
movsx ecx, cl
movsx edx, al
call fcn.00896fe0
cmp eax, 0x1e
ja 0x89a398
mov ecx, 0x1400000
bt ecx, eax
jb 0x89a37f
mov ecx, 0x200600
bt ecx, eax
jb 0x89a373
cmp eax, 0x1e
jne 0x89a398
cmp ebp, 4
mov eax, 0xffffffff
jl 0x89a39f
mov cl, byte [ebx + 4]
movzx eax, byte [ebx + 5]
test cl, cl
jne 0x89a359
mov ecx, dword [esp + 4]
movzx eax, byte [ecx + eax + 0x48]
jmp 0x89a364
movsx ecx, cl
movsx edx, al
call fcn.00896fe0
cmp eax, 0x1e
ja 0x89a373
mov ecx, 0x40200600
bt ecx, eax
jb 0x89a398
mov eax, dword [esp]
mov dword [eax], edi
mov eax, 0x10
jmp 0x89a39f
lea eax, [edi + 2]
mov ebp, esi
mov ebx, edi
sub ebp, eax
cmp ebp, 1
jg 0x89a2f7
mov eax, 0xffffffff
jmp 0x89a39f
mov eax, dword [esp]
mov dword [eax], edi
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x948fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov eax, dword [0xbd33e0]
mov ebp, dword [esp + 0xac]
xor eax, esp
mov dword [esp + 0x90], eax
push ebp
call fcn.009527d0
add esp, 4
mov esi, eax
test eax, eax
jne 0x9490ed
mov ebx, dword [esp + 0xb4]
mov edi, dword [esp + 0xa8]
test ebx, ebx
mov dword [edi + 0x110], ebp
jne 0x949004
mov esi, 0x20001
jmp 0x9490ed
imul edx, ebp, 0x64
mov esi, 0x16
mov eax, dword [edx + 0xc27c84]
cmp eax, 0x80
ja 0x9490ed
mov ecx, dword [edx + 0xc27c88]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
lea esi, [edx + 0xc27c88]
mov dword [esp + 8], edx
cmp ecx, ebx
jae 0x94907c
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp], esi
lea ecx, [edi + 0x228]
push edx
push ecx
push ebx
push eax
push ebp
call fcn.0094e310
add esp, 0x14
mov edx, dword [esp + 4]
mov esi, eax
test eax, eax
jne 0x9490ed
mov esi, dword [esp]
mov eax, dword [esi]
mov ecx, eax
sub ecx, edx
jbe 0x9490a8
lea eax, [edi + edx + 0x228]
jmp 0x94909c
lea ecx, [edi + 0x228]
push ebx
push eax
push ecx
call fcn.009876a0
add esp, 0xc
mov eax, dword [esi]
mov ecx, eax
sub ecx, ebx
jbe 0x9490a8
lea eax, [edi + ebx + 0x228]
push ecx
push eax
call fcn.009891f0
add esp, 8
mov eax, dword [esi]
mov ebx, esi
test eax, eax
je 0x9490c4
xor ecx, ecx
movzx edx, byte [edi + ecx + 0x228]
xor dl, 0x36
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, eax
jb 0x9490b0
push edi
mov esi, dword [esp + 0xc]
call dword [esi + 0xc27cd0]
mov ecx, esi
add esp, 4
mov esi, eax
test eax, eax
jne 0x9490ed
lea eax, [esp + 0x10]
push dword [ebx]
push eax
push edi
call dword [ecx + 0xc27cd4]
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x94
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x949110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0xbd33e0]
mov ebx, dword [esp + 0x11c]
xor eax, esp
mov dword [esp + 0x104], eax
mov edi, dword [ebx + 0x110]
push edi
call fcn.009527d0
add esp, 4
mov esi, eax
test eax, eax
jne 0x949228
imul ebp, edi, 0x64
lea edi, [esp + 4]
mov eax, dword [ebp + 0xc27c84]
mov dword [esp], eax
push edi
push ebx
call dword [ebp + 0xc27cd8]
add esp, 8
mov esi, eax
test eax, eax
jne 0x949228
mov eax, dword [ebp + 0xc27c88]
test eax, eax
je 0x949190
xor ecx, ecx
movzx edx, byte [ebx + ecx + 0x228]
xor dl, 0x5c
mov byte [esp + ecx + 0x84], dl
inc ecx
cmp ecx, eax
jb 0x949179
push ebx
call dword [ebp + 0xc27cd0]
add esp, 4
mov esi, eax
test eax, eax
jne 0x949228
lea eax, [ebp + 0xc27c88]
lea ecx, [esp + 0x84]
push dword [eax]
push ecx
push ebx
call dword [ebp + 0xc27cd4]
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x949228
lea eax, [ebp + 0xc27cd4]
push dword [esp]
push edi
push ebx
call dword [eax]
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x949228
lea ecx, [esp + 0x84]
lea eax, [ebp + 0xc27cd8]
push ecx
push ebx
call dword [eax]
add esp, 8
mov esi, eax
test eax, eax
jne 0x949228
mov edi, dword [esp]
mov eax, dword [esp + 0x124]
xor esi, esi
mov ecx, 0
test edi, edi
je 0x949226
mov edx, dword [esp + 0x120]
xor ecx, ecx
cmp ecx, dword [eax]
jae 0x949226
movzx ebx, byte [esp + ecx + 0x84]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, edi
jb 0x949212
mov dword [eax], ecx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x94e3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0xbd33e0]
mov ebx, dword [esp + 0x3c]
xor eax, esp
mov dword [esp + 0x18], eax
push dword [ebx]
call fcn.00952830
add esp, 4
mov edi, eax
test eax, eax
jne 0x94e476
mov ecx, dword [ebx + 4]
mov edi, 0x16
lea eax, [ecx - 1]
cmp eax, 0x7f
ja 0x94e476
mov eax, dword [esp + 0x38]
xor edx, edx
mov dword [esp + 4], eax
div ecx
and ecx, 3
or ecx, edx
jne 0x94e476
imul edx, dword [ebx], 0x58
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ecx, dword [edx + 0xc28934]
test ecx, ecx
jne 0x94e48b
cmp dword [esp + 0x38], 0
je 0x94e474
lea eax, [ebx + 0x88]
lea ecx, [esp + 8]
mov dword [esp], eax
push eax
push ecx
push ebp
call dword [edx + 0xc2891c]
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x94e476
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x94e46e
mov ecx, dword [esp + eax + 8]
mov edx, dword [ebp + eax]
xor ecx, dword [ebx + eax + 8]
mov dword [ebx + eax + 8], edx
mov dword [esi + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x94e451
sub dword [esp + 4], ecx
jne 0x94e4af
xor edi, edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00989fe9
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebx + 0x88]
add ebx, 8
push edx
push ebx
push eax
push esi
push ebp
call ecx
add esp, 0x14
mov ecx, dword [esp + 0x18]
mov esi, eax
xor ecx, esp
call fcn.00989fe9
mov eax, esi
jmp 0x94e483
imul eax, dword [ebx], 0x58
add esi, ecx
add ebp, ecx
push dword [esp]
lea ecx, [esp + 0xc]
push ecx
push ebp
call dword [eax + 0xc2891c]
jmp 0x94e43f

Function at 0x94e740
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, edx
mov ebp, ecx
push 0xbcca24
call fcn.009834a0
add esp, 4
xor edi, edi
test eax, eax
je 0x94e78d
mov ebx, eax
push str.SystemFunction036
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x94e775
push ebx
call sub.KERNEL32.dll_FreeLibrary
jmp 0x94e78d
push esi
push ebp
call eax
mov byte [esp + 3], al
push ebx
call sub.KERNEL32.dll_FreeLibrary
xor edi, edi
cmp byte [esp + 3], 1
cmove edi, esi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x94e84c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0xbd33e0]
xor eax, ebp
test edx, edx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
je 0x94e865
mov esi, dword [esp + 8]
xor ebx, ebx
xor eax, eax
xor edi, edi
mov dword [esp + 0x10], ecx
mov ecx, 7
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp + 0x14], ecx
call fcn.0094e880
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push ebx
push 8
lea eax, [esp + 0x20]
push eax
call fcn.00988160
add esp, 0xc
mov ebx, eax
and eax, 1
xor edi, eax
call fcn.0094e880
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push ebx
push 8
lea eax, [esp + 0x20]
push eax
call fcn.00988160
add esp, 0xc
mov ebx, eax
and eax, 1
xor eax, esi
mov esi, edi
cmp edi, eax
je 0x94e7e8
mov ecx, dword [esp + 4]
add ecx, ecx
or ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
lea ecx, [ecx - 1]
jne 0x94e7e2
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov byte [ecx], dl
dec esi
lea ecx, [ecx + 1]
jne 0x94e7cd
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.00989fe9
mov eax, dword [esp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x94f860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x30]
push dword [ebx]
call fcn.00952830
add esp, 4
test eax, eax
jne 0x94f9c3
mov ecx, dword [ebx + 4]
mov eax, 0x16
lea edx, [ecx - 1]
cmp edx, 0x7f
ja 0x94f9c3
test cl, 3
jne 0x94f9c3
mov edx, dword [ebx + 8]
cmp edx, 0x80
ja 0x94f9c3
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
cmp edx, ecx
jne 0x94f914
cmp ecx, esi
ja 0x94f914
imul eax, dword [ebx], 0x58
mov eax, dword [eax + 0xc28938]
test eax, eax
je 0x94f914
lea edx, [ebx + 0x110]
mov dword [esp + 8], eax
mov eax, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0xc]
mov dword [esp], edx
lea edx, [ebx + 0x10]
mov dword [esp + 4], edx
xor edx, edx
div ecx
push dword [esp + 0xc]
push dword [esp + 4]
push dword [esp + 0xc]
push eax
push ebp
push edi
call dword [esp + 0x20]
add esp, 0x18
test eax, eax
jne 0x94f9c3
mov ecx, dword [ebx + 4]
mov eax, esi
xor edx, edx
div ecx
mov esi, edx
xor eax, eax
test esi, esi
je 0x94f9c3
lea eax, [ebx + 0x110]
lea edx, [ebx + 0x10]
mov dword [esp + 8], eax
lea eax, [ebx + 0x90]
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
cmp eax, ecx
jne 0x94f970
push ebx
call fcn.00954ff0
add esp, 4
imul eax, dword [ebx], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0xc28918]
add esp, 0xc
test eax, eax
jne 0x94f9c3
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 4]
jmp 0x94f974
test eax, eax
jne 0x94f9ac
xor eax, eax
cmp esi, ecx
jb 0x94f9ac
xor eax, eax
test ecx, ecx
jle 0x94f998
mov ecx, dword [ebx + eax + 0x90]
xor ecx, dword [edi + eax]
mov dword [ebp + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x94f980
add edi, ecx
add ebp, ecx
sub esi, ecx
mov dword [ebx + 8], ecx
xor eax, eax
test esi, esi
je 0x94f9c3
mov ecx, dword [ebx + 4]
jmp 0x94f938
mov cl, byte [edi]
lea edx, [eax + 1]
inc edi
dec esi
mov dword [ebx + 8], edx
xor cl, byte [ebx + eax + 0x90]
mov byte [ebp], cl
inc ebp
jmp 0x94f9a1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret