joyce8/EMBER2024-capa huggingface dataset:
Function at 0x794d00
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, edx
call fcn.00778330
test eax, eax
je 0x778687
mov ecx, eax
mov edx, esi
mov edi, eax
call fcn.0078e050
mov esi, eax
push edi
call fcn.00775660
add esp, 4
mov eax, esi
jmp 0x778689
xor eax, eax
pop esi
pop edi
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0xc1f184]
mov esi, ecx
cmp eax, 2
je 0x794e45
call fcn.007781a0
test eax, eax
jne 0x794e45
mov eax, 0x78de00
mov dword [esp + 8], esi
xor esi, esi
not eax
and eax, 1
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb4d370]
mov ebp, dword [esi*4 + 0xb4d4b0]
mov dword [esp + 0x18], esi
add ecx, 0x78de00
sete al
mov ecx, eax
xor ecx, 0xf395b571
lea edx, [ecx + eax*2 + 0x118]
mov eax, 1
xor edx, dword [esi*4 + 0xb4d0f0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x794e1f
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x794da4
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x794dc6
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x794dbb
jmp 0x794e1f
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x794e15
lea ecx, [ebp - 4]
shr ecx, 2
je 0x794e0d
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x794de3
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x50
jne 0x794d38
call dword [0xbabb20]
mov ecx, dword [esp + 8]
mov edx, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp 0x778660
mov ecx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00778330
Function at 0x794e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [esp + 4], ecx
mov edx, fcn.00799c00
xor ecx, ecx
mov eax, dword [0xbcbae0]
imul edx, edx
and edx, 3
xor eax, esp
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], edx
xor edx, edx
cmp dword [esp + 0x10], 1
mov edi, dword [ecx*4 + 0xb4d370]
mov ebp, dword [ecx*4 + 0xb4d4b0]
mov dword [esp + 0x18], ecx
mov eax, 1
seta dl
xor edx, 0x17440651
add edx, 0x30c
xor edx, dword [ecx*4 + 0xb4d230]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x794f66
mov dword [esp + 8], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x794eeb
mov ecx, dword [esp + 8]
movzx eax, al
test ebx, eax
je 0x794f0d
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x794f02
jmp 0x794f66
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x794f5c
lea ecx, [ebp - 4]
shr ecx, 2
je 0x794f54
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x794f2a
mov eax, dword [esp + 8]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x50
jne 0x794e87
mov eax, dword [0xc1f184]
cmp eax, 2
je 0x794f8b
call fcn.007781a0
test eax, eax
je 0x795010
mov ebp, dword [esp + 4]
lea esi, [esp + 0x1c]
lea edi, [esp + 0x40]
lea ebx, [esp + 0x44]
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
push esi
push 0
push ebp
call dword [0xbabc28]
test eax, eax
jne 0x79500a
mov ecx, edi
mov edx, ebx
call fcn.00791950
test eax, eax
jne 0x794feb
xor esi, esi
jmp 0x79502a
mov eax, dword [esp + 0x1c]
jmp 0x79501a
push dword [esp + 4]
call dword [0xbabc10]
mov ecx, eax
xor esi, esi
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
cmovne esi, ecx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x795040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, fcn.0083ad70
mov edx, ecx
movzx ecx, byte [0xbad1d7]
imul esi, esi
and esi, 3
cmp esi, 3
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x7951a7
mov al, byte [0xbad1d7]
cmp esi, 3
mov ah, 1
sete cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbad1d7], ah
jne 0x795070
mov ecx, fcn.0083ad70
movzx esi, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete ah
or ah, 4
xor ah, 7
movzx eax, ah
bt esi, eax
jae 0x7950ca
cmp ecx, 3
movzx esi, byte [0xbad1d7]
sete al
or al, 4
movzx eax, al
bt esi, eax
jae 0x7950ae
jmp 0x7951a7
cmp ecx, 3
movzx esi, byte [0xbad1d7]
sete al
or al, 4
movzx eax, al
bt esi, eax
jb 0x795186
mov eax, fcn.0083ad70
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
mov eax, dword [0xbad1c0]
sete cl
or ecx, 0x449c6450
add ecx, 0x104c
mov esi, ecx
xor eax, ecx
shr esi, 0x1f
mov dword [0xbad1c0], eax
not eax
or esi, ecx
and cl, 7
imul esi, eax
mov eax, dword [0xbad1c4]
mov ebx, esi
lea edi, [esi + esi]
shr ebx, 0x1e
or edi, ebx
xor eax, esi
mov dword [0xbad1c4], eax
not eax
mov esi, dword [0xbad1c8]
imul eax, edi
lea edi, [eax*4]
xor esi, eax
shr eax, 0x1d
mov dword [0xbad1c8], esi
or edi, eax
not esi
mov eax, dword [0xbad1cc]
imul esi, edi
lea edi, [esi*8]
xor eax, esi
shr esi, 0x1c
mov dword [0xbad1cc], eax
or edi, esi
not eax
imul eax, edi
xor dword [0xbad1d0], eax
mov ah, 1
shl ah, cl
or byte [0xbad1d7], ah
mov eax, fcn.0083ad70
imul eax, eax
and eax, 3
cmp eax, 3
mov al, 0xfe
sete cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbad1d7], al
mov ecx, 0xe
push 0xbad1c0
call fcn.007951c0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x7955a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [ecx + 8]
test eax, eax
jle 0x7955d0
xor ebx, ebx
mov edi, eax
movzx eax, byte [edx + ebx]
mov ebp, dword [ecx]
xor byte [ebp + esi], al
inc esi
mov eax, edi
mov edi, 0
cmp esi, dword [ecx + 4]
cmovge esi, edi
inc ebx
cmp ebx, eax
jne 0x7955b1
mov dword [ecx + 8], esi
add dword [ecx + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x798600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0xbcbae0]
mov ebx, edx
mov esi, ecx
xor eax, ebp
mov dword [esp + 8], eax
call fcn.00791930
mov ecx, dword [esi + 8]
mov edx, esp
call fcn.00799a90
test eax, eax
je 0x798637
mov edi, eax
call fcn.00791940
jmp 0x79866c
mov eax, dword [ebp + 8]
cmp ebx, dword [esp]
mov ecx, eax
sbb ecx, dword [esp + 4]
jl 0x79864f
call fcn.00791940
jmp 0x79884e
mov ecx, dword [esi + 8]
mov edx, ebx
push eax
call fcn.00799fd0
add esp, 4
mov edi, eax
call fcn.00791940
test edi, edi
je 0x79884e
mov edx, 0x77fba0
xor eax, eax
movzx ebx, byte [0xbad3cf]
and edx, 1
inc edx
mov ecx, edx
xor ecx, 0x77fba0
sete al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt ebx, eax
jb 0x79883d
mov al, byte [0xbad3cf]
mov ebx, edx
xor ecx, ecx
mov ah, 1
xor ebx, 0x77fba0
sete cl
mov ebx, ecx
xor ebx, 3
lea ecx, [ebx + ecx*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbad3cf], ah
jne 0x79869f
mov ecx, 0x77fba0
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, 0x77fba0
sete dl
mov ebx, edx
xor ebx, 3
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x798719
mov edx, ecx
xor eax, eax
movzx ebx, byte [0xbad3cf]
xor edx, 0x77fba0
sete al
mov edx, eax
xor edx, 3
lea eax, [edx + eax*2]
bt ebx, eax
jae 0x7986f3
jmp 0x79883d
xor eax, eax
xor ecx, 0x77fba0
movzx edx, byte [0xbad3cf]
sete al
mov ecx, eax
xor ecx, 3
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x798815
mov eax, 0x77fba0
xor ecx, ecx
and eax, 1
inc eax
xor eax, 0x77fba0
sete cl
mov eax, ecx
xor eax, 0x41faf22b
lea ecx, [eax + ecx*2 + 0x920]
mov eax, dword [0xbad3b0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbad3b0], eax
not eax
imul edx, eax
mov eax, dword [0xbad3b4]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbad3b4], eax
or ebx, edx
not eax
mov edx, dword [0xbad3b8]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbad3b8], edx
or ebx, eax
not edx
mov eax, dword [0xbad3bc]
imul edx, ebx
lea ebx, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbad3bc], eax
or ebx, edx
not eax
mov edx, dword [0xbad3c0]
imul eax, ebx
mov ebx, eax
shl ebx, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbad3c0], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [str._JPLW]
mov ebx, edx
shl ebx, 5
xor eax, edx
shr edx, 0x1a
mov dword [str._JPLW], eax
or edx, ebx
not eax
imul eax, edx
mov dl, 1
xor dword [0xbad3c8], eax
shl dl, cl
or byte [0xbad3cf], dl
mov eax, 0x77fba0
xor ecx, ecx
and eax, 1
inc eax
xor eax, 0x77fba0
sete cl
mov eax, ecx
xor eax, 3
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbad3cf], al
push dword [esi + 0x6c]
push 0xbad3b0
push edi
call fcn.00777b70
add esp, 0xc
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.00980459
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x799c70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, fcn.007b06c0
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbad3ab]
not esi
and esi, 1
mov ecx, esi
add ecx, fcn.007b06c0
sete al
mov ecx, eax
xor ecx, 3
lea eax, [eax + ecx*2]
bt edi, eax
jb 0x799e3d
mov al, byte [0xbad3ab]
mov edi, esi
xor ecx, ecx
mov ah, 1
add edi, fcn.007b06c0
sete cl
mov edi, ecx
not edi
and edi, 3
lea ecx, [ecx + edi*2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbad3ab], ah
jne 0x799ca9
mov ecx, fcn.007b06c0
xor ebx, ebx
movzx eax, al
not ecx
and ecx, 1
mov esi, ecx
add esi, fcn.007b06c0
sete bl
mov esi, ebx
not esi
and esi, 3
lea ebx, [ebx + esi*2]
xor bl, 7
movzx esi, bl
bt eax, esi
jae 0x799d28
mov esi, ecx
xor eax, eax
add esi, fcn.007b06c0
movzx esi, byte [0xbad3ab]
sete al
mov ebx, eax
xor ebx, 3
lea eax, [eax + ebx*2]
bt esi, eax
jae 0x799d02
jmp 0x799e3d
xor eax, eax
add ecx, fcn.007b06c0
movzx esi, byte [0xbad3ab]
sete al
mov ecx, eax
xor ecx, 3
lea eax, [eax + ecx*2]
bt esi, eax
jb 0x799e11
mov ecx, fcn.007b06c0
xor eax, eax
not ecx
and ecx, 1
add ecx, fcn.007b06c0
sete al
mov esi, eax
not esi
and esi, 0x1f3
lea ecx, [eax + esi*2]
lea eax, [eax + esi*2 - 0xe21f400]
xor eax, dword [0xbad390]
mov esi, ecx
and cl, 7
or esi, 0xf1de0c01
mov dword [0xbad390], eax
not eax
imul esi, eax
mov eax, dword [0xbad394]
lea edi, [esi + esi]
xor eax, esi
shr esi, 0x1e
mov dword [0xbad394], eax
or edi, esi
not eax
mov esi, dword [0xbad398]
imul eax, edi
lea edi, [eax*4]
xor esi, eax
shr eax, 0x1d
mov dword [0xbad398], esi
or edi, eax
not esi
mov eax, dword [0xbad39c]
imul esi, edi
lea edi, [esi*8]
xor eax, esi
shr esi, 0x1c
mov dword [0xbad39c], eax
or edi, esi
not eax
mov esi, dword [0xbad3a0]
imul eax, edi
mov edi, eax
shl edi, 4
xor esi, eax
shr eax, 0x1b
mov dword [0xbad3a0], esi
or eax, edi
not esi
imul esi, eax
mov ah, 1
xor dword [0xbad3a4], esi
shl ah, cl
or byte [0xbad3ab], ah
mov ecx, fcn.007b06c0
xor eax, eax
not ecx
and ecx, 1
add ecx, fcn.007b06c0
sete al
mov ecx, eax
not ecx
and ecx, 3
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbad3ab], al
mov ecx, 0xb
push 0xbad390
call fcn.007951c0
add esp, 4
mov eax, 0xb
pop esi
pop edi
pop ebx
ret
Function at 0x79ea80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [ecx + 0x30], 0
jne 0x79ecde
mov ebp, dword [ecx + 0xc]
mov esi, ecx
mov ecx, dword [ebp + 0x48]
mov edi, dword [ebp + 0x38]
call fcn.0077ca90
test eax, eax
jne 0x79ecde
mov edx, fcn.00829fe0
xor eax, eax
movzx ebx, byte [0xbad437]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.00829fe0
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x79ec55
mov al, byte [0xbad437]
mov dword [esp], ebp
mov ebp, edx
xor ebx, ebx
mov ah, 1
xor ebp, fcn.00829fe0
sete bl
mov ecx, ebx
not ecx
lea ecx, [ecx + ebx*2]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbad437], ah
jne 0x79eae3
mov ecx, fcn.00829fe0
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov ebx, ecx
xor ebx, fcn.00829fe0
sete dl
mov ebx, edx
not ebx
lea edx, [ebx + edx*2]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x79eb68
mov ebp, dword [esp]
mov edx, ecx
xor eax, eax
movzx ebx, byte [0xbad437]
xor edx, fcn.00829fe0
sete al
mov edx, eax
not edx
lea eax, [edx + eax*2]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x79eb3e
jmp 0x79ec55
xor eax, eax
xor ecx, fcn.00829fe0
movzx edx, byte [0xbad437]
mov ebp, dword [esp]
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edx, eax
jb 0x79ec2b
mov eax, fcn.00829fe0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00829fe0
sete cl
mov eax, ecx
xor eax, 0x34d3f5f
lea ecx, [eax + ecx*2 + 0x40]
mov eax, dword [0xbad420]
xor eax, ecx
mov dword [0xbad420], eax
not eax
mov edx, dword [0xbad424]
imul eax, ecx
and cl, 7
lea ebx, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbad424], edx
or ebx, eax
not edx
mov eax, dword [0xbad428]
imul edx, ebx
lea ebx, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbad428], eax
or ebx, edx
not eax
mov edx, dword [0xbad42c]
imul eax, ebx
lea ebx, [eax*8]
xor edx, eax
shr eax, 0x1c
mov dword [0xbad42c], edx
or ebx, eax
not edx
mov al, 1
imul edx, ebx
shl al, cl
xor dword [0xbad430], edx
or byte [0xbad437], al
mov eax, fcn.00829fe0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.00829fe0
sete cl
mov eax, ecx
not eax
lea ecx, [eax + ecx*2]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbad437], al
mov eax, dword [0xbad42c]
mov dword [edi + 0xc], eax
mov eax, dword [0xbad428]
mov dword [edi + 8], eax
mov eax, dword [0xbad424]
mov dword [edi + 4], eax
mov eax, dword [0xbad420]
mov dword [edi], eax
mov al, byte [esi + 0x25]
mov byte [edi + 0x10], al
mov al, byte [esi + 0x26]
mov byte [edi + 0x11], al
mov word [edi + 0x12], 0x101
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x28]
mov byte [edi + 0x14], al
lea eax, [edi + 0x18]
mov word [edi + 0x15], 0x2040
mov byte [edi + 0x17], 0x20
push 0x4c
push 0
push eax
call fcn.00980a60
add esp, 0xc
mov ecx, ebp
mov edx, 0xd
call fcn.0079f690
or byte [esi + 0x18], 2
lea ecx, [edi + 0x34]
movzx edx, byte [esi + 0x11]
call fcn.007979e0
movzx edx, byte [esi + 0x12]
lea ecx, [edi + 0x40]
call fcn.007979e0
xor eax, eax
mov dword [esi + 0x30], 1
mov byte [edi + 0x1f], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a3700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x7b7b00
xor esi, esi
mov dword [esp + 0xc], ecx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor eax, eax
cmp dword [esp + 0x10], 2
mov edi, dword [esi*4 + 0xb4d370]
mov ebp, dword [esi*4 + 0xb4d4b0]
mov dword [esp + 0x18], esi
mov ebx, 1
sete al
mov ecx, eax
xor ecx, 0x5b198297
lea edx, [ecx + eax*2 + 0x1050]
xor edx, dword [esi*4 + 0xb4d5f0]
mov esi, 1
mov ecx, edx
and cl, 7
shl esi, cl
movzx eax, cl
xor cl, 7
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
bt ecx, eax
jb 0x7a37fa
mov eax, esi
mov al, byte [edi + ebp - 1]
mov dword [esp], esi
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7a377e
mov ecx, dword [esp]
movzx eax, al
test ebx, eax
je 0x7a379f
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7a3794
jmp 0x7a37fa
mov dword [esp + 8], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7a37f0
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7a37e9
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp + 4], edx
inc eax
shl dword [esp + 4], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp + 4]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7a37bc
mov eax, dword [esp]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x50
jne 0x7a371c
push 1
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [0xbabe20]
cmp eax, 0xc0
mov esi, 0
je 0x7a371c
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7aeda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.00553ca0
mov dword [esp + 8], ecx
mov ecx, fcn.00553ca0
xor edx, edx
xor eax, 2
or ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [edx*4 + 0xb4d790]
mov edi, dword [edx*4 + 0xb4da50]
mov dword [esp + 0x1c], edx
add eax, dword [esp + 0x10]
mov eax, 1
sete bl
or ebx, 0xe263bba
xor ebx, dword [edx*4 + 0xb4dd10]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7aeea1
mov dword [esp + 4], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x7aee26
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x7aee48
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x7aee3d
jmp 0x7aeea1
mov dword [esp + 0xc], edx
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x7aee97
lea ecx, [edi - 4]
shr ecx, 2
je 0x7aee8f
xor eax, eax
mov edx, ebp
mov dword [esp + 0x18], ecx
mov esi, dword [edx]
mov ecx, eax
mov dword [esp], ebx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, ebx
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp]
mov dword [edx], esi
not esi
add edx, 4
imul ebx, esi
cmp eax, ecx
jne 0x7aee65
mov eax, dword [esp + 4]
or byte [ebp + edi - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [ebp + edi - 1], al
mov edx, dword [esp + 0x1c]
inc edx
cmp edx, 0xb0
jne 0x7aedc5
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0xb43f30]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7b5630
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ecx, 6
je 0x7b575b
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, fcn.007be410
mov dword [esp + 8], ecx
not edx
and edx, 1
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
xor edx, edx
mov edi, dword [eax*4 + 0xb4e090]
mov ebp, dword [eax*4 + 0xb4e0b0]
mov dword [esp + 0x18], eax
add ecx, fcn.007be410
sete dl
mov ecx, edx
xor ecx, 0xa8ab6453
lea edx, [ecx + edx*2 + 0x1218]
xor edx, dword [eax*4 + 0xb4e0d0]
mov eax, 1
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x7b573b
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x7b56c0
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x7b56e2
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x7b56d7
jmp 0x7b573b
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x7b5731
lea ecx, [ebp - 4]
shr ecx, 2
je 0x7b5729
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x7b56ff
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 6
jne 0x7b5654
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0xb442d0]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7b7dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [ecx + 0x32], 0
and byte [ecx + 1], 0xf9
movsx edx, byte [ecx + 0x44]
movzx eax, word [ecx + edx*2 + 0x46]
dec dl
mov word [ecx + 0x46], ax
mov eax, dword [ecx + 0x74]
mov byte [ecx + 0x44], dl
movsx edx, dl
mov edx, dword [ecx + edx*4 + 0x78]
mov dword [ecx + 0x74], edx
mov ecx, eax
jmp fcn.007a0ba0
Function at 0x7ba7d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [0xbcbae0]
xor eax, esp
mov dword [esp + 0x58], eax
cmp word [edx + 0x18], 0
jne 0x7ba7fd
mov ecx, 0x1c6a
call fcn.00799c70
mov esi, 0xb
jmp 0x7ba99d
mov ebx, dword [edx + 0x34]
mov edi, edx
mov ebp, ecx
lea eax, [esp + 0xc]
lea edx, [esp + 0x14]
mov ecx, ebx
push 0
push 0
push eax
call fcn.007a0bb0
add esp, 0xc
mov esi, eax
test eax, eax
mov dword [esp + 0x10], eax
jne 0x7ba99d
mov eax, dword [edi + 0x24]
mov dword [esp], ebp
mov dword [esp + 8], eax
push eax
push edi
call dword [edi + 0x4c]
add esp, 8
mov ebp, dword [esp + 0x14]
mov edx, 0xd
mov word [esp + 6], ax
mov ecx, ebp
call fcn.0079f690
lea eax, [esp + 8]
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x18]
xor edx, edx
mov dword [esp + 0x20], eax
lea eax, [esp + 6]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], 2
push ebp
push 1
call fcn.007bbc40
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jne 0x7ba994
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebp + 0x12]
movzx edx, word [esp + 6]
add eax, 0xfffffffe
sub eax, ecx
sub eax, edx
mov dword [ebp + 0x14], eax
cmp byte [ebx + 0x11], 0
je 0x7ba8ec
mov edx, dword [esp + 0xc]
lea esi, [esp + 0x10]
mov ecx, ebx
push esi
mov eax, dword [esp + 4]
push dword [eax + 4]
push 5
call fcn.007a1650
add esp, 0xc
movzx eax, word [esp + 6]
cmp ax, word [ebp + 0x10]
jbe 0x7ba8ec
mov ecx, ebp
mov edx, ebp
push esi
push dword [esp + 0xc]
call fcn.007a19d0
add esp, 8
mov edx, dword [edi + 0x40]
movzx esi, word [edi + 0x18]
movzx ecx, word [edi + 0x1a]
mov ebp, dword [esp + 0x70]
movzx ebx, byte [edx + esi*2 - 2]
movzx edx, byte [edx + esi*2 - 1]
lea eax, [ebp + 4]
shl ebx, 8
or edx, ebx
and edx, ecx
xor ecx, ecx
add edx, dword [edi + 0x38]
mov dword [esp + 8], edx
mov esi, ecx
inc ecx
lea ebx, [edx + esi + 1]
cmp ecx, 8
mov dword [esp + 8], ebx
ja 0x7ba930
movzx ebx, byte [edx + esi]
test bl, bl
js 0x7ba918
mov ebx, dword [esp]
add ecx, edx
lea edx, [edx + esi + 0xa]
lea esi, [ecx + 1]
mov dword [esp + 8], esi
movzx ecx, byte [ecx]
mov byte [eax], cl
inc eax
test cl, cl
jns 0x7ba952
mov ecx, dword [esp + 8]
cmp ecx, edx
jb 0x7ba939
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x7ba97a
movzx edx, word [ebx + 0x18]
lea esi, [esp + 0x10]
sub eax, ebp
mov ecx, ebx
push esi
push dword [edi + 4]
push 0
push eax
push ebp
call fcn.007b9a60
add esp, 0x14
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x38]
movzx ecx, byte [ebx + 9]
mov edx, dword [esp + 0xc]
lea ecx, [eax + ecx + 8]
call fcn.007979e0
mov ecx, dword [esp + 0x14]
jmp 0x7ba998
mov esi, eax
mov ecx, ebp
call fcn.007a0b90
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret