joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fc3d0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.005fc4b0
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fc462
push 0x10000
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5fc44d
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.advapi32.dll_DeleteService]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov byte [ebp - 1], 1
jmp 0x5fc456
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
jmp 0x5fc46b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call fcn.005fc310
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x5fc48d
mov eax, 0xfffffffb
jmp 0x5fc4a8
movzx edx, byte [ebp - 1]
test edx, edx
je 0x5fc49e
mov dword [ebp - 0x14], 0
jmp 0x5fc4a5
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x5fc7a0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0xc]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetServicesTcpip6Parameters
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fc7ce
xor al, al
jmp 0x5fc869
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x7b351c
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5fc801
cmp dword [ebp - 0x10], 0
jne 0x5fc808
mov dword [ebp - 4], 0
movzx edx, byte [ebp + 8]
test edx, edx
je 0x5fc81b
mov eax, dword [ebp - 4]
or eax, 8
mov dword [ebp - 0x14], eax
jmp 0x5fc824
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff7
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.DisabledComponents
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x5fc85f
mov dword [ebp - 0x18], 1
jmp 0x5fc866
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x5fc870
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0xc]
push eax
push 2
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5fc89b
xor al, al
jmp 0x5fc8f8
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x5fc8ac
mov dword [ebp - 8], 1
jmp 0x5fc8b3
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.DisableTaskOffload
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x5fc8ee
mov dword [ebp - 0x10], 1
jmp 0x5fc8f5
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x5fc900
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x7f325c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push 0x7b3464
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.005fd030
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
push 3
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x5fc963
xor al, al
jmp 0x5fc9f7
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x5fc9a3
mov dword [ebp - 0x118], 4
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push 0x7b348c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
jmp 0x5fc9c5
push 4
mov eax, dword [ebp + 0x10]
push eax
push 4
push 0
push 0x7b3490
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x10c], 0
jne 0x5fc9e7
mov dword [ebp - 0x114], 1
jmp 0x5fc9f1
mov dword [ebp - 0x114], 0
mov al, byte [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00615a5d
mov esp, ebp
pop ebp
ret
Function at 0x5fccd0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x7f325c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.NDIS]
mov dword [ebp - 0xc], eax
mov cl, byte [0x7b3614]
mov byte [ebp - 8], cl
mov edx, dword [str.tcpip]
mov dword [ebp - 0x14], edx
mov ax, word [0x7b361c]
mov word [ebp - 0x10], ax
mov cl, byte [0x7b361e]
mov byte [ebp - 0xe], cl
mov edx, dword [str.PNP_TDI]
mov dword [ebp - 0x1c], edx
mov eax, dword [0x7b3624]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
push ecx
push str.SYSTEMCurrentControlSetServices_s
push 0x104
lea edx, [ebp - 0x120]
push edx
call fcn.005fd030
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
push 3
push 0
lea ecx, [ebp - 0x120]
push ecx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x5fcd71
xor al, al
jmp 0x5fce13
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x5fcdbf
push 5
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x7b3650
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 0x124], eax
push 7
lea edx, [ebp - 0x14]
push edx
push 7
push 0
push str.DependOnService
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 0x124], eax
jmp 0x5fcde1
push 8
lea ecx, [ebp - 0x1c]
push ecx
push 1
push 0
push str.Group
mov edx, dword [ebp - 0x128]
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x124], 0
jne 0x5fce03
mov dword [ebp - 0x12c], 1
jmp 0x5fce0d
mov dword [ebp - 0x12c], 0
mov al, byte [ebp - 0x12c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00615a5d
mov esp, ebp
pop ebp
ret
Function at 0x5fce30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fce5e
xor al, al
jmp 0x5fcf9a
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x5fcf1d
mov edx, dword [ebp + 0x10]
push edx
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x7b34c4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fce9f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor al, al
jmp 0x5fcf9a
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 4
push ecx
call fcn.0061a742
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x5fcece
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor al, al
jmp 0x5fcf9a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0x7b34cc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fcf1b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0061a725
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
xor al, al
jmp 0x5fcf9a
jmp 0x5fcf77
mov edx, dword [ebp + 0x10]
cmp dword [edx], 4
jbe 0x5fcf35
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
shr ecx, 2
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x5fcf3c
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 0x18]
mov dword [ecx + eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 3
push 0
push 0x7b34d4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x5fcf90
mov dword [ebp - 0x10], 1
jmp 0x5fcf97
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5fd7c7
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov edx, ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, esi
push edi
push 8
sub edx, esi
pop edi
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x5fd7dd
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp edi, 1
jbe 0x5fd830
lea eax, [edi - 1]
add ebp, 0x20
mov edi, eax
push esi
call fcn.005fdee9
push esi
call fcn.005fde2a
push esi
call fcn.005fd952
add esp, 0xc
mov ecx, ebx
mov eax, dword [ebp]
add ebp, 4
xor dword [esi + ecx*4], eax
inc ecx
cmp ecx, 8
jb 0x5fd814
sub edi, 1
jne 0x5fd7fd
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
push esi
call fcn.005fdee9
push esi
call fcn.005fde2a
pop ecx
shl edi, 5
pop ecx
add edi, ebp
mov eax, dword [edi]
lea edi, [edi + 4]
xor dword [esi + ebx*4], eax
inc ebx
cmp ebx, 8
jb 0x5fd843
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x5fdbe4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x7f325c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0xf0], 0xa
call fcn.005fd695
push 0x10
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00616830
xor edi, edi
lea ebx, [esi + 0x10]
add esp, 0x14
mov dword [esp + 0x10], ebx
inc edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005fde6c
movzx ebp, byte [edi + 0x7b366f]
xor ebx, ebx
pop ecx
pop ecx
mov edx, dword [esp + ebx*4 + 0x24]
mov cl, bl
mov eax, edx
add cl, cl
and eax, 0x3000000
shr edx, 8
or eax, edx
mov esi, ebp
shr eax, 0x12
shr esi, cl
and esi, 3
xor esi, eax
xor esi, dword [esp + ebx*4 + 0x14]
mov eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
cmp ebx, 4
jb 0x5fdc47
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0x10
push eax
push ebx
call fcn.00616830
add esp, 0xc
add ebx, 0x10
inc edi
mov dword [esp + 0x10], ebx
cmp edi, 0xa
jbe 0x5fdc2d
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00615a5d
add esp, 0x28
ret
Function at 0x5fdcba
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x7f325c]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x4c]
push esi
push eax
mov dword [edi + 0xf0], 0xe
call fcn.005fd695
push 0x10
pop ebx
push ebx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00616830
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.005fd695
push ebx
lea eax, [esp + 0x44]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00616830
add esp, 0x28
add edi, 0x20
mov dword [esp + 0x10], edi
push 2
pop ebp
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.005fde6c
mov eax, ebp
shr eax, 1
xor ebx, ebx
pop ecx
pop ecx
mov al, byte [eax + 0x7b366f]
movzx edi, al
mov edx, dword [esp + ebx*4 + 0x34]
mov cl, bl
mov eax, edx
add cl, cl
and eax, 0x3000000
shr edx, 8
or eax, edx
mov esi, edi
shr eax, 0x12
shr esi, cl
and esi, 3
xor esi, eax
xor esi, dword [esp + ebx*4 + 0x14]
mov eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
cmp ebx, 4
jb 0x5fdd42
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0x10
pop ebx
push ebx
push eax
push edi
call fcn.00616830
add esp, 0xc
cmp ebp, 0xe
je 0x5fde17
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.005fde6c
movups xmm3, xmmword [esp + 0x3c]
push 0x18
movups xmm0, xmmword [esp + 0x30]
pop eax
push 8
movd xmm4, eax
pop eax
psrld xmm3, xmm4
push ebx
pxor xmm3, xmm0
movd xmm0, eax
movaps xmm2, xmm3
pslld xmm2, xmm0
movaps xmm1, xmm3
movd xmm0, ebx
pxor xmm2, xmm3
lea eax, [esp + 0x30]
pslld xmm1, xmm0
pslld xmm3, xmm4
push eax
pxor xmm2, xmm1
lea eax, [edi + 0x10]
pxor xmm2, xmm3
push eax
movups xmmword [esp + 0x38], xmm2
call fcn.00616830
add ebp, 2
add edi, 0x20
add esp, 0x14
mov dword [esp + 0x10], edi
cmp ebp, 0xe
jbe 0x5fdd22
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00615a5d
add esp, 0x38
ret

Function at 0x5fef67
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
neg edx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0xa
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x5fef7c
pop edi
pop esi
ret

Function at 0x5fef90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
push 0xa
neg edi
sub esi, edx
pop ebx
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, edi
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x5fefa6
pop edi
pop esi
pop ebx
ret
Function at 0x6013ed
Capabilities:
Encrypt data using curve25519

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx + 0x1f]
and byte [ecx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ecx + 0x1f], al
ret

Function at 0x6066ea
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x91c
mov eax, dword [0x7f325c]
xor eax, esp
mov dword [esp + 0x918], eax
push ebx
mov ebx, dword [esp + 0x92c]
push ebp
push esi
mov esi, dword [esp + 0x92c]
push edi
push 0xf
mov dword [esp + 0x18], esi
lea edi, [esp + 0x274]
pop ebp
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.0060039d
lea eax, [ebx + 0x20]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0060039d
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [edi - 0x50]
push eax
call fcn.005feed1
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [edi - 0x28]
push eax
call fcn.0060055e
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.005ff5e2
push 0x7b36f0
push edi
push edi
call fcn.005ff5e2
add esp, 0x40
add ebx, 0x40
add edi, 0x78
sub ebp, 1
jne 0x60671e
push esi
call fcn.005feea6
lea eax, [esi + 0x28]
push eax
call fcn.005feeb7
lea eax, [esi + 0x50]
push eax
call fcn.005feeb7
lea eax, [esi + 0x78]
push eax
call fcn.005feea6
add esp, 0x10
inc ebp
push 0x3f
pop eax
mov dword [esp + 0x10], eax
mov edx, eax
mov bl, al
shr edx, 3
xor bh, bh
xor edi, edi
and bl, 7
add edx, dword [esp + 0x934]
mov al, byte [edx]
mov cl, bl
shr al, cl
lea edx, [edx + 8]
and al, 1
mov ecx, edi
shl al, cl
or bh, al
inc edi
cmp edi, 4
jb 0x6067c8
push 0x28
xor esi, esi
lea eax, [esp + 0x10c]
push esi
push eax
call fcn.00616db0
push 0x28
lea eax, [esp + 0x140]
mov dword [esp + 0x118], ebp
push esi
push eax
call fcn.00616db0
push 0x28
lea eax, [esp + 0x174]
mov dword [esp + 0x14c], ebp
push esi
push eax
call fcn.00616db0
add esp, 0x24
movsx esi, bh
lea edi, [esp + 0x270]
mov ebx, esi
xor ebx, ebp
lea eax, [ebx - 1]
not ebx
shr eax, 0x1f
shr ebx, 0x1f
and bl, al
lea eax, [edi - 0x50]
neg bl
and ebx, 1
push ebx
push eax
lea eax, [esp + 0x110]
push eax
call fcn.005fef67
push ebx
lea eax, [edi - 0x28]
push eax
lea eax, [esp + 0x144]
push eax
call fcn.005fef67
push ebx
lea eax, [esp + 0x174]
push edi
push eax
call fcn.005fef67
add esp, 0x24
add edi, 0x78
inc ebp
cmp ebp, 0x10
jb 0x60682c
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x180]
push esi
push eax
call fcn.00606696
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0x74]
push esi
push eax
call fcn.0060655f
lea eax, [esp + 0x7c]
push eax
push esi
call fcn.0060664d
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x88]
push esi
push eax
call fcn.00600e1b
lea eax, [esp + 0x90]
push eax
push esi
call fcn.0060664d
mov eax, dword [esp + 0x40]
add esp, 0x30
dec eax
mov dword [esp + 0x10], eax
push 1
pop ebp
cmp eax, 0x40
jb 0x6067b3
mov ecx, dword [esp + 0x928]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00615a5d
add esp, 0x91c
ret
Function at 0x6069f4
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
xor bl, bl
test edx, edx
je 0x606a18
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
or bl, al
inc ecx
sub edx, 1
jne 0x606a0a
pop esi
movzx eax, bl
pop ebx
ret
Function at 0x6086fa
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 0x60
push ebx
push edi
call fcn.00616db0
mov ebp, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x14], ebx
jbe 0x608757
lea ecx, [ebp - 1]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
push esi
push edi
mov esi, ecx
push ebp
xor esi, ebx
push esi
push edi
call fcn.00606bff
lea ecx, [edi + 0x20]
push ecx
lea eax, [ebp + 0x20]
push eax
push esi
push ecx
call fcn.00606bff
mov ecx, dword [esp + 0x40]
add esp, 0x20
inc ebx
add ebp, 0x40
cmp ebx, dword [esp + 0x18]
jb 0x608725
mov ebp, dword [esp + 0x14]
pop esi
lea eax, [edi + 0x40]
push 0x7b3e98
push eax
push ebp
push eax
call fcn.00606bff
add esp, 0x10
pop edi
pop ebp
pop ebx
ret
Function at 0x60a1f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
mov eax, dword [0x7f325c]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
mov ebx, dword [esp + 0xd4]
xor eax, eax
push ebp
mov ebp, dword [esp + 0xdc]
push esi
push edi
push 8
pop ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
and dword [esp + 0x38], eax
lea edi, [esp + 0x3c]
push 7
pop ecx
rep stosd dword es:[edi], eax
and dword [esp + 0x58], eax
lea edi, [esp + 0x5c]
push 7
pop ecx
rep stosd dword es:[edi], eax
xor ebx, ebx
mov dword [esp + 0x10], 0x20
inc ebx
mov edi, 0xbf
test ebx, ebx
jne 0x60a27b
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.006085a9
add esp, 0x18
lea eax, [edi + 0x40]
push eax
push ebp
call fcn.00606c50
mov esi, eax
push edi
push ebp
shl esi, 3
call fcn.00606c50
shl eax, 2
or esi, eax
lea eax, [edi - 0x40]
push eax
push ebp
call fcn.00606c50
add eax, eax
or esi, eax
lea eax, [edi - 0x80]
push eax
push ebp
call fcn.00606c50
or esi, eax
lea eax, [esp + 0x98]
push eax
push 0x7b4278
push 0xf
push esi
call fcn.006086fa
add esp, 0x30
test ebx, ebx
jne 0x60a30e
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x80]
push eax
push 1
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00608195
add esp, 0x28
jmp 0x60a346
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00606c20
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00606c20
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00606c20
add esp, 0x18
xor ebx, ebx
lea eax, [edi + 0x20]
push eax
push ebp
call fcn.00606c50
lea ecx, [edi - 0x20]
mov esi, eax
push ecx
push ebp
shl esi, 3
call fcn.00606c50
shl eax, 2
or esi, eax
lea eax, [edi - 0x60]
push eax
push ebp
call fcn.00606c50
add eax, eax
or esi, eax
lea eax, [edi - 0xa0]
push eax
push ebp
call fcn.00606c50
or esi, eax
lea eax, [esp + 0x98]
push eax
push 0x7b3eb8
push 0xf
push esi
call fcn.006086fa
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0xb0]
push eax
push 1
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00608195
add esp, 0x58
dec edi
sub dword [esp + 0x10], 1
jne 0x60a251
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00606c3d
lea eax, [esp + 0x40]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.00606c3d
lea eax, [esp + 0x68]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.00606c3d
mov ecx, dword [esp + 0xf0]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00615a5d
add esp, 0xcc
ret
Function at 0x60a674
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
or eax, 0xffffffff
test edi, edi
je 0x60a6ac
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
sub ebx, esi
mov edx, dword [ebx + esi]
xor edx, dword [esi]
lea esi, [esi + 4]
lea ecx, [edx - 1]
not edx
shr ecx, 0x1f
shr edx, 0x1f
and ecx, edx
neg ecx
and eax, ecx
sub edi, 1
jne 0x60a68c
pop esi
pop ebx
pop edi
ret

Function at 0x60b63d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
xor eax, eax
mov dword [esp + 0x10], 0x40
xorps xmm0, xmm0
inc eax
and dword [esp + 8], 0
movlpd qword [esp + 0x14], xmm0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x14], eax
mov esi, eax
xor edi, edi
and esi, 1
neg esi
adc edi, edi
and esi, dword [esp + 0x28]
neg edi
mov ecx, esi
and esi, dword [esp + 0x14]
xor ecx, eax
mov edx, edi
and edx, dword [esp + 0x2c]
mov eax, edx
and edx, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
shrd ecx, eax, 1
shr eax, 1
add ecx, esi
mov dword [esp + 0x14], ecx
adc eax, edx
and edi, 0x80000000
shrd ebp, ebx, 1
mov dword [esp + 0x10], eax
xor eax, eax
shr ebx, 1
add ebp, eax
mov eax, ecx
adc ebx, edi
sub dword [esp + 0x18], 1
jne 0x60b669
pop edi
pop esi
mov eax, ebp
mov edx, ebx
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x60b9f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
or esi, 0xffffffff
test ebx, ebx
je 0x60ba37
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
sub ebp, edi
nop dword [eax]
mov eax, dword [edi + ebp]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
mov ecx, esi
not ecx
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
neg edx
or edx, ecx
and esi, edx
sub ebx, 1
jne 0x60ba10
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret