joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8297b0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [esp + 8], edx
mov edx, dword [edx + 0x48]
mov esi, ecx
mov edi, dword [esp + 0x3c]
mov ebp, dword [esi + 8]
mov eax, dword [esi + 0x2c]
movzx ecx, word [edx + 0x18]
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], ebp
movzx ebp, word [edx + 0x2a]
mov edx, dword [edx + 0x20]
lea ebx, [eax + 1]
add edi, ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esi]
add eax, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x2c], eax
call fcn.00810d50
mov ecx, dword [esi]
mov edx, eax
mov dword [esp + 0x14], esi
call fcn.0078a6b0
test ebp, ebp
mov dword [esp], eax
je 0x829890
mov eax, dword [esp + 8]
mov dword [esp + 4], ebx
xor ebx, ebx
cmp dword [esp + 0x38], 0
mov esi, dword [esp + 0xc]
mov edi, dword [eax + 8]
sete bl
mov ecx, esi
lea edx, [ebx*4 + 0x21]
push edi
call fcn.007f9600
add esp, 4
mov ecx, esi
mov edx, 0xb
call fcn.007f75b0
lea edx, [ebx + ebx*2 + 0x16]
mov ebx, dword [esp + 4]
mov dword [esp + 0x18], eax
mov ecx, esi
push ebp
push ebx
push 0
push edi
call fcn.0078dfd0
add esp, 0x10
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov dword [ecx + 0x14], eax
mov ecx, esi
call fcn.007f75c0
xor esi, esi
mov ecx, dword [esp + 0xc]
lea eax, [esi + ebx]
mov edx, 0x59
push eax
push esi
push edi
call fcn.007d10f0
add esp, 0xc
inc esi
cmp esi, ebp
jne 0x829874
cmp bp, word [esp + 0x10]
jae 0x829998
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ebx
lea ebx, [ebx + ebp]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + ebp*4]
mov edx, edi
push ebx
push dword [esp + 0x3c]
push ebp
push dword [esp + 0x14]
call fcn.008292d0
add esp, 0x10
cmp eax, ebx
je 0x8298f5
cmp dword [esp + 0x1c], 1
mov esi, eax
jne 0x8298e2
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
call fcn.007fc440
mov ebx, esi
jmp 0x8298f9
mov ecx, dword [esp + 0xc]
mov edx, 0x4e
push ebx
push esi
call fcn.007d10d0
add esp, 8
mov ebx, dword [esp + 4]
movzx eax, word [edi + 0xc]
test al, 1
je 0x82991b
cmp dword [esp], 0
je 0x82998d
mov eax, dword [edi]
mov ecx, 0x800
mov eax, dword [eax + 4]
and eax, ecx
jne 0x829986
jmp 0x82998d
test eax, 0x100
jne 0x82998d
mov eax, dword [edi]
test byte [edi + 0xb], 8
mov esi, dword [eax + 0x10]
jne 0x829954
mov ecx, esi
call fcn.007fe7a0
test eax, eax
je 0x829954
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
lea eax, [ebx + ebp]
mov edx, 0x32
push dword [edi + 0xc]
push eax
call fcn.007d10d0
add esp, 8
cmp dword [esp], 0
je 0x82998d
mov edi, dword [esp]
mov ecx, esi
movsx edx, byte [edi + ebp]
call fcn.007fd060
cmp al, 0x41
je 0x829972
movzx eax, byte [edi + ebp]
jmp 0x829978
mov al, 0x41
mov byte [edi + ebp], 0x41
movsx edx, al
mov ecx, esi
call fcn.00829fa0
test eax, eax
je 0x82998d
mov eax, dword [esp]
mov byte [eax + ebp], 0x41
inc ebp
cmp ebp, dword [esp + 0x10]
jne 0x82989b
mov eax, dword [esp]
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x829b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [0xbd33e0]
mov esi, ecx
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [ecx + 0x28]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x829b79
test byte [esi + 0x39], 4
je 0x829d94
mov edi, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
lea ebx, [esp + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edi
mov dword [esp + 8], ecx
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
cmp word [esi + 0x34], 0
je 0x829d94
mov ebp, fcn.007cf2a0
xor edi, edi
mov dword [esp + 4], esi
not ebp
and ebp, 1
mov eax, dword [esi + 4]
movsx ebx, word [eax + edi*2]
cmp ebx, 0xfffffffe
jne 0x829c21
mov ecx, dword [esp + 0xc]
lea eax, [edi + edi*4]
mov ecx, dword [ecx + eax*4 + 4]
mov dword [esp + 0x10], ecx
call fcn.007fa6f0
test eax, eax
jne 0x829d87
mov eax, 0x82a030
jmp 0x829d53
test bx, bx
js 0x829d87
mov eax, dword [esp + 8]
lea ecx, [ebx + ebx*4]
mov eax, dword [eax + 4]
test byte [eax + ecx*4 + 0x10], 0x20
je 0x829d87
mov edx, dword [eax + ecx*4 + 8]
test edx, edx
je 0x829d4a
mov ecx, ebp
xor eax, eax
add ecx, fcn.007cf2a0
movzx ecx, byte [0xbb3b93]
sete al
bt ecx, eax
jb 0x829d3a
mov al, byte [0xbb3b93]
mov ecx, ebp
mov ah, 1
add ecx, fcn.007cf2a0
sete cl
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb3b93], ah
jne 0x829c6d
mov ecx, ebp
movzx eax, al
add ecx, fcn.007cf2a0
sete cl
xor cl, 7
movzx ecx, cl
bt eax, ecx
jae 0x829cbf
mov ecx, ebp
xor eax, eax
add ecx, fcn.007cf2a0
movzx ecx, byte [0xbb3b93]
sete al
bt ecx, eax
jae 0x829ca4
jmp 0x829d3a
mov ecx, ebp
xor eax, eax
add ecx, fcn.007cf2a0
movzx ecx, byte [0xbb3b93]
sete al
bt ecx, eax
jb 0x829d23
mov eax, ebp
xor ecx, ecx
add eax, fcn.007cf2a0
mov eax, dword [str.2_p0]
sete cl
or ecx, 0x713e5c68
add ecx, 0x408
mov dword [esp], ecx
xor eax, ecx
mov ecx, dword [esp]
mov dword [str.2_p0], eax
not eax
shr ecx, 0x1f
or ecx, dword [esp]
imul ecx, eax
mov al, 1
xor dword [0xbb3b8c], ecx
mov ecx, dword [esp]
and cl, 7
shl al, cl
or byte [0xbb3b93], al
mov eax, ebp
add eax, fcn.007cf2a0
mov al, 0xfe
sete cl
xor cl, 7
rol al, cl
and byte [0xbb3b93], al
mov ecx, edx
mov edx, str.2_p0
call fcn.00783720
test eax, eax
jne 0x829d87
mov eax, 0x82a0a0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], edi
lea esi, [esp + 0x2c]
mov ecx, esi
mov edx, dword [eax + 0x10]
mov ebx, eax
call fcn.007fd1d0
mov edx, dword [ebx + 8]
mov ecx, esi
call fcn.007fd300
mov edx, dword [ebx + 0xc]
mov ecx, esi
call fcn.007fd300
mov esi, dword [esp + 4]
movzx eax, word [esi + 0x34]
inc edi
cmp edi, eax
jb 0x829bef
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00989fe9
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x82a230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
cmp dword [ecx + 0x58], 0
mov eax, 1
jne 0x82a38d
mov eax, fcn.00845740
mov edx, 3
sub edx, eax
mov dword [esp + 0x10], edx
xor edi, edi
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov esi, dword [edi*4 + 0xb57390]
mov ebp, dword [edi*4 + 0xb573a0]
mov dword [esp + 0x18], edi
xor ecx, fcn.00845740
sete al
mov ecx, eax
xor ecx, 0x923cbc1f
lea edx, [ecx + eax*2 + 0x3c0]
mov eax, 1
xor edx, dword [edi*4 + 0xb573b0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [esi + ebp - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x82a343
mov dword [esp + 4], eax
mov al, byte [esi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x82a2c8
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x82a2ea
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x82a2df
jmp 0x82a343
mov dword [esp + 0xc], ebx
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x82a339
lea ecx, [ebp - 4]
shr ecx, 2
je 0x82a331
xor eax, eax
mov ebx, esi
mov dword [esp + 0x14], ecx
mov edi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor edi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], edi
not edi
add ebx, 4
imul edx, edi
cmp eax, ecx
jne 0x82a307
mov eax, dword [esp + 4]
or byte [esi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [esi + ebp - 1], al
mov edi, dword [esp + 0x18]
inc edi
cmp edi, 4
jne 0x82a25c
mov ecx, dword [esp + 8]
mov eax, dword [ecx + 0x2c]
mov edx, dword [eax + 0x20]
mov eax, 1
cmp edx, 0xbb87ec
je 0x82a38d
cmp edx, 0xbb87e0
je 0x82a38d
cmp edx, 0xbb9c24
je 0x82a38d
cmp edx, 0xbb9c40
je 0x82a38d
mov ecx, dword [ecx + 0x24]
test ecx, ecx
jne 0x82a256
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x82a6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebp, edx
mov esi, ecx
call fcn.007f7590
mov ecx, esi
mov ebx, eax
call fcn.007fcfa0
mov ecx, ebx
mov edx, 0x45
mov dword [esp + 0x10], eax
push eax
push 0
call fcn.007d10d0
add esp, 8
cmp edi, 3
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
jl 0x82a768
mov ecx, esi
call fcn.007fcfa0
mov esi, ebp
mov ebp, eax
mov ecx, ebx
mov edx, 0x73
push 0xffffffffffffffff
push 0xc26bbd
push 0
push eax
push 0
call fcn.007f75d0
add esp, 0x14
mov ecx, ebx
call fcn.007fdcb0
add eax, 2
mov ecx, ebx
mov edx, 0x39
push esi
push eax
push ebp
call fcn.007d10f0
add esp, 0xc
mov ecx, ebx
mov edx, 0x53
call fcn.0078e010
jmp 0x82a783
mov ecx, ebx
call fcn.007fdcb0
add eax, 2
mov ecx, ebx
mov edx, 0xf
push eax
push ebp
call fcn.007d10d0
add esp, 8
mov eax, fcn.007c2850
mov ecx, 3
xor edx, edx
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov edi, dword [edx*4 + 0xb573c0]
mov esi, dword [edx*4 + str._8__8]
mov dword [esp + 0x24], edx
xor eax, fcn.007c2850
mov eax, 1
sete bl
xor ebx, 0x333c7561
add ebx, 0x104
xor ebx, dword [edx*4 + 0xb57400]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x82a87b
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x82a7fd
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x82a81f
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x82a814
jmp 0x82a87b
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x82a875
lea ecx, [esi - 4]
shr ecx, 2
je 0x82a86d
xor eax, eax
mov ebp, edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ebp
mov ecx, ebp
mov ebp, dword [ebp]
mov dword [esp], ebx
xor ebp, ebx
mov dword [ecx], ebp
mov ecx, eax
not ebp
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x20]
or ebx, dword [esp]
imul ebx, ebp
mov ebp, dword [esp + 0x28]
add ebp, 4
cmp eax, ecx
jne 0x82a838
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
not dl
and byte [edi + esi - 1], dl
mov edx, dword [esp + 0x24]
inc edx
cmp edx, 5
jne 0x82a795
mov ebp, dword [esp + 0xc]
mov ecx, ebp
call fcn.007fdcb0
mov edi, dword [esp + 0x14]
add eax, 2
mov ecx, ebp
mov edx, dword [edi*4 + str.99699]
push dword [esp + 8]
push eax
mov ebx, dword [esp + 0x18]
push ebx
call fcn.007d10f0
add esp, 0xc
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.007fc3c0
mov ecx, ebp
mov edx, 0x44
push 2
push 1
call fcn.007d10d0
add esp, 8
mov edx, dword [edi*4 + 0xb50668]
mov ecx, ebp
push 0xffffffffffffffff
call fcn.007f7b70
add esp, 4
mov ecx, esi
mov edx, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007fc440
Function at 0x82a900
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
mov ebp, dword [ecx + 4]
mov esi, edx
mov ecx, eax
call fcn.007f7590
test ebp, ebp
je 0x82aa12
mov edi, eax
mov ebx, ebp
cmp dword [ebp + 0x58], 0
jne 0x82a986
mov eax, dword [ebx + 0x2c]
test byte [eax + 5], 0x10
je 0x82a986
cmp byte [ebx + 0x11], 0x5a
je 0x82a986
mov ecx, edi
mov edx, 0x48
push dword [ebx + 0x38]
push 0
call fcn.007d10d0
add esp, 8
mov ecx, edi
mov edx, 0x21
push dword [ebx + 0x3c]
call fcn.007f9600
add esp, 4
mov ecx, edi
mov edx, 0x59
push dword [ebx + 0x38]
push 0
push dword [ebx + 0x3c]
call fcn.007d10f0
add esp, 0xc
mov ecx, edi
call fcn.007fdcb0
lea edx, [eax - 2]
mov ecx, edi
call fcn.007f75c0
jmp 0x82aa07
cmp dword [ebx + 0x40], 0
jne 0x82aa07
mov ecx, ebx
call fcn.0082b800
mov ecx, edi
test esi, esi
je 0x82a9e4
mov edx, 0x9d
push eax
push dword [ebx + 0x34]
call fcn.007d10d0
add esp, 8
mov edx, dword [ebx + 0x2c]
mov ecx, edi
push 0xfffffffffffffff8
call fcn.007f7b70
add esp, 4
mov ecx, edi
mov edx, 0x4d
push dword [ebx + 0x38]
push dword [ebx + 0x34]
call fcn.007d10d0
add esp, 8
mov ecx, edi
mov edx, 0x48
push dword [ebx + 0x34]
push 0
call fcn.007d10d0
add esp, 8
jmp 0x82aa07
mov edx, 0x9c
push dword [ebx + 0x38]
push eax
push dword [ebx + 0x34]
call fcn.007d10f0
add esp, 0xc
mov edx, dword [ebx + 0x2c]
mov ecx, edi
push 0xfffffffffffffff8
call fcn.007f7b70
add esp, 4
mov ebx, dword [ebx + 0x24]
test ebx, ebx
jne 0x82a91e
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x82b5f0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp + 8], edx
mov ebp, dword [ecx]
mov ebx, ecx
mov eax, dword [esp + 0x4c]
mov ecx, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
call fcn.007f7590
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
mov ecx, ebp
mov edi, dword [eax + 0xc]
call fcn.007fcfa0
mov ecx, ebp
mov dword [esp + 0x20], eax
call fcn.007fcfa0
mov esi, dword [ebp + 0x2c]
mov dword [esp], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], edi
inc esi
mov dword [ebp + 0x2c], esi
test byte [edi + 0xc], 1
jne 0x82b664
mov dword [esp + 0xc], 0x69
jmp 0x82b68a
mov ecx, dword [esp + 8]
xor eax, eax
mov edx, 0x37
cmp ecx, 0x36
sete al
xor eax, 0x39
cmp ecx, 0x39
cmovne edx, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0x6a
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.0082bae0
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, ebx
push dword [esp]
call fcn.0082bae0
add esp, 4
mov edi, dword [esp + 0x18]
mov edx, 0x73
mov ecx, edi
push 0xffffffffffffffff
push 0xc26bbe
push 0
push esi
push 0
call fcn.007f75d0
add esp, 0x14
mov ecx, edi
mov edx, 0x39
push ebp
push 0
push esi
call fcn.007d10f0
add esp, 0xc
mov edx, dword [esp + 0xc]
mov ebx, eax
mov ecx, edi
push ebp
push ebp
push dword [esp + 0xc]
call fcn.007d10f0
add esp, 0xc
mov ecx, edi
mov edx, ebx
call fcn.007f75c0
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 8]
test byte [eax + 0xc], 2
je 0x82b7be
mov ecx, edi
mov edx, 0x33
push ebp
call fcn.007f9600
add esp, 4
cmp ebx, 0x36
mov dword [esp + 4], eax
je 0x82b744
cmp ebx, 0x37
je 0x82b74d
cmp ebx, 0x39
jne 0x82b761
mov ecx, edi
mov edx, 0xb
push esi
push 0
jmp 0x82b759
mov ecx, edi
mov edx, 0x33
jmp 0x82b754
mov ecx, edi
mov edx, 0x32
push esi
push dword [esp + 4]
call fcn.007d10d0
add esp, 8
mov ecx, edi
call fcn.007fdcb0
add eax, 3
mov ecx, edi
mov edx, 0xb
push eax
push 0
call fcn.007d10d0
add esp, 8
mov edx, dword [esp + 4]
mov ecx, edi
call fcn.007f75c0
mov ecx, edi
mov edx, 0x32
push esi
push dword [esp + 4]
call fcn.007d10d0
add esp, 8
cmp ebx, 0x39
je 0x82b7a6
cmp ebx, 0x36
jne 0x82b7be
mov ecx, edi
call fcn.007fdcb0
inc eax
mov ecx, edi
mov edx, 0xffffffff
push eax
call fcn.007f77b0
add esp, 4
mov ecx, edi
mov edx, ebx
push ebp
push esi
mov ebx, dword [esp + 8]
push ebx
call fcn.007d10f0
add esp, 0xc
mov ecx, edi
mov edx, pe_nt_image_headers32
call fcn.0078e010
mov esi, dword [esp + 0x28]
mov edx, ebp
mov ecx, esi
call fcn.007fc440
mov ecx, esi
mov edx, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007fc440
Function at 0x832150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edx, dword [esp + 0x14]
mov edi, ecx
movsx ebx, word [edx + 0x28]
test ebx, ebx
js 0x8322a9
mov ebp, fcn.00783c30
movzx ecx, byte [0xbba5db]
and ebp, 1
inc ebp
mov eax, ebp
xor eax, fcn.00783c30
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x832285
mov al, byte [0xbba5db]
mov ecx, ebp
mov ah, 1
xor ecx, fcn.00783c30
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbba5db], ah
jne 0x832197
mov ecx, fcn.00783c30
and ecx, 1
inc ecx
mov ebp, ecx
xor ebp, fcn.00783c30
movzx ebp, al
sete ah
not ah
and ah, 3
xor ah, 7
movzx eax, ah
bt ebp, eax
jae 0x832203
mov eax, ecx
movzx ebp, byte [0xbba5db]
xor eax, fcn.00783c30
sete al
not al
and al, 3
movzx eax, al
bt ebp, eax
jae 0x8321e1
jmp 0x832285
xor ecx, fcn.00783c30
movzx ecx, byte [0xbba5db]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x832262
mov eax, fcn.00783c30
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00783c30
mov eax, dword [0xbba5d0]
sete cl
xor ecx, 0x2df3d03
add ecx, 0x538
xor eax, ecx
mov dword [0xbba5d0], eax
not eax
imul eax, ecx
and cl, 7
xor dword [0xbba5d4], eax
mov ah, 1
shl ah, cl
or byte [0xbba5db], ah
mov eax, fcn.00783c30
and eax, 1
inc eax
xor eax, fcn.00783c30
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbba5db], al
mov eax, dword [edx + 4]
lea ecx, [ebx + ebx*4]
mov ebx, 0x613
push dword [eax + ecx*4]
push dword [edx]
push 0xbba5d0
push dword [edi]
call fcn.0078df10
add esp, 0x10
jmp 0x832400
mov ebx, fcn.007b04d0
movzx ecx, byte [0xbba5eb]
not ebx
and ebx, 1
mov eax, ebx
add eax, fcn.007b04d0
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x8323ea
mov al, byte [0xbba5eb]
mov ecx, ebx
mov ah, 1
add ecx, fcn.007b04d0
sete cl
not cl
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbba5eb], ah
jne 0x8322d9
mov ecx, fcn.007b04d0
not ecx
and ecx, 1
mov ebx, ecx
add ebx, fcn.007b04d0
movzx ebx, al
sete ah
not ah
and ah, 7
xor ah, 7
movzx eax, ah
bt ebx, eax
jae 0x832346
mov eax, ecx
movzx ebx, byte [0xbba5eb]
add eax, fcn.007b04d0
sete al
not al
and al, 7
movzx eax, al
bt ebx, eax
jae 0x832324
jmp 0x8323ea
add ecx, fcn.007b04d0
movzx ecx, byte [0xbba5eb]
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x8323c6
mov eax, fcn.007b04d0
xor ecx, ecx
not eax
and eax, 1
add eax, fcn.007b04d0
mov eax, dword [0xbba5dc]
sete cl
xor ecx, 0x6981440f
add ecx, 0x500
mov ebx, ecx
xor eax, ecx
shr ebx, 0x1f
mov dword [0xbba5dc], eax
not eax
or ebx, ecx
and cl, 7
imul ebx, eax
mov eax, dword [0xbba5e0]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbba5e0], eax
or ebp, ebx
not eax
imul eax, ebp
xor dword [0xbba5e4], eax
mov ah, 1
shl ah, cl
or byte [0xbba5eb], ah
mov eax, fcn.007b04d0
not eax
and eax, 1
add eax, fcn.007b04d0
mov al, 0xfe
sete cl
not cl
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbba5eb], al
mov ebx, 0xa13
push dword [edx]
push 0xbba5dc
push dword [edi]
call fcn.0078df10
add esp, 0xc
mov ecx, edi
mov edx, ebx
push 2
push 0xfffffffffffffff9
push eax
push esi
call fcn.007fc3d0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x8338a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
movzx ebx, byte [edx + 7]
mov edi, edx
mov esi, ecx
mov al, 1
test ebx, ebx
je 0x8338b7
mov eax, ebx
movzx edx, al
mov ecx, esi
call fcn.007d13b0
test ebx, ebx
jne 0x8338dc
mov ecx, esi
xor edx, edx
push 0
push dword [edi]
push 0
call fcn.007d1410
add esp, 0x34
jmp 0x833a29
movzx edi, byte [edi + 6]
mov eax, fcn.0098bcfc
xor ebp, ebp
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
imul eax, eax
and eax, 3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
xor edi, edi
mov dword [esp + 0x10], ebp
xor eax, eax
cmp dword [esp + 0x1c], 2
mov esi, dword [edi*4 + 0xb57420]
mov ebp, dword [edi*4 + str._b_f_f_f_b]
mov dword [esp + 0x24], edi
sete al
mov ecx, eax
not ecx
and ecx, 0x129
lea edx, [eax + ecx*2 + 0xe3d8c16]
mov eax, 1
xor edx, dword [edi*4 + 0xb575c0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [esi + ebp - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x8339e7
mov dword [esp + 4], eax
mov al, byte [esi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x83396c
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x83398e
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x833983
jmp 0x8339e7
mov dword [esp + 0x18], ebx
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x8339dd
lea ecx, [ebp - 4]
shr ecx, 2
je 0x8339d5
xor eax, eax
mov ebx, esi
mov dword [esp + 0x20], ecx
mov edi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor edi, edx
shr edx, cl
mov ecx, dword [esp + 0x20]
or edx, dword [esp]
mov dword [ebx], edi
not edi
add ebx, 4
imul edx, edi
cmp eax, ecx
jne 0x8339ab
mov eax, dword [esp + 4]
or byte [esi + ebp - 1], al
mov eax, dword [esp + 0x18]
not al
and byte [esi + ebp - 1], al
mov edi, dword [esp + 0x24]
inc edi
cmp edi, 0x33
jne 0x833903
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, esi
mov edx, ebp
push 0
mov edi, dword [esp + 0x18]
push dword [edi*4 + 0xb4d1d8]
push 0
call fcn.007d1410
add esp, 0xc
mov ebx, dword [esp + 8]
inc ebp
inc edi
cmp ebp, ebx
jne 0x8338f9
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x833ae0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
test ecx, ecx
je 0x833d95
mov edx, 0x83cfc0
mov eax, 0x83cfc0
mov esi, ecx
movzx ecx, byte [0xbbad17]
and edx, 1
xor edx, eax
cmp edx, 0xffffffff
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x833c2b
mov al, byte [0xbbad17]
cmp edx, 0xffffffff
mov ah, 1
sete cl
not cl
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbad17], ah
jne 0x833b1e
mov ecx, 0x83cfc0
mov edx, 0x83cfc0
movzx eax, al
and ecx, 1
xor ecx, edx
cmp ecx, 0xffffffff
sete dl
not dl
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x833b82
cmp ecx, 0xffffffff
movzx edx, byte [0xbbad17]
sete al
not al
and al, 7
movzx eax, al
bt edx, eax
jae 0x833b64
jmp 0x833c2b
cmp ecx, 0xffffffff
movzx ecx, byte [0xbbad17]
sete al
not al
and al, 7
movzx eax, al
bt ecx, eax
jb 0x833c04
mov edx, 0x83cfc0
mov eax, 0x83cfc0
xor ecx, ecx
and edx, 1
xor edx, eax
mov eax, dword [0xbbad08]
cmp edx, 0xffffffff
sete cl
xor ecx, 0xa5dba4ef
add ecx, 0x400
xor eax, ecx
mov edx, ecx
mov dword [0xbbad08], eax
shr edx, 0x1f
not eax
mov ebx, dword [0xbbad0c]
or edx, ecx
and cl, 7
imul edx, eax
lea edi, [edx + edx]
xor ebx, edx
shr edx, 0x1e
mov dword [0xbbad0c], ebx
or edi, edx
not ebx
mov dl, 1
imul ebx, edi
shl dl, cl
xor dword [0xbbad10], ebx
or byte [0xbbad17], dl
mov ecx, 0x83cfc0
mov eax, 0x83cfc0
and ecx, 1
xor ecx, eax
mov al, 0xfe
cmp ecx, 0xffffffff
sete cl
not cl
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbbad17], al
mov ecx, esi
mov edx, 0xbbad08
call fcn.00783720
test eax, eax
jne 0x833c45
mov eax, 1
jmp 0x833d9a
mov edx, fcn.0078a8e0
xor eax, eax
movzx edi, byte [0xbbad23]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.0078a8e0
sete al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edi, eax
jb 0x833d81
mov al, byte [0xbbad23]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, fcn.0078a8e0
sete cl
mov ebx, ecx
xor ebx, 5
lea ecx, [ebx + ecx*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbad23], ah
jne 0x833c78
mov ecx, fcn.0078a8e0
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov edi, ecx
xor edi, fcn.0078a8e0
sete dl
mov ebx, edx
xor ebx, 5
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x833cf2
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbbad23]
xor edx, fcn.0078a8e0
sete al
mov edx, eax
xor edx, 5
lea eax, [edx + eax*2]
bt edi, eax
jae 0x833ccc
jmp 0x833d81
xor eax, eax
xor ecx, fcn.0078a8e0
movzx edx, byte [0xbbad23]
sete al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x833d59
mov eax, fcn.0078a8e0
xor ecx, ecx
mov edi, dword [0xbbad18]
and eax, 1
inc eax
xor eax, fcn.0078a8e0
sete cl
mov eax, ecx
xor eax, 0x880c39a5
lea ecx, [eax + ecx*2]
mov edx, ecx
xor edi, ecx
and cl, 7
mov dword [0xbbad18], edi
not edi
or edx, 1
imul edx, edi
xor dword [0xbbad1c], edx
mov dl, 1
shl dl, cl
or byte [0xbbad23], dl
mov eax, fcn.0078a8e0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0078a8e0
sete cl
mov eax, ecx
xor eax, 5
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbbad23], al
mov ecx, esi
mov edx, 0xbbad18
call fcn.00783720
test eax, eax
jne 0x833d95
xor eax, eax
jmp 0x833d9a
mov eax, 0xffffffff
pop esi
pop edi
pop ebx
ret