joyce8/EMBER2024-capa huggingface dataset:
Function at 0xec44fa
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d40], 1
jne 0xec4570
or dword [0xf82d40], 1
mov dword [0xf7cf0c], 0x535b7c33
mov dword [0xf7cf10], 0x1a5e5f56
mov dword [0xf7cf14], 0x5d1a554e
mov dword [0xf7cf18], 0x491a4e5f
mov dword [0xf7cf1c], 0x5e4e
mov dword [0xf7cf20], 0x5f59425f
mov dword [0xf7cf24], 0x55534e4a
mov dword [0xf7cf28], 0x4d000054
mov dword [0xf7cf2c], 0x124e5b52
mov dword [0xf7cf30], 0x3a303713
mov cl, byte [eax + 0xf7cf0c]
xor cl, 0x3a
mov byte [eax + 0xf7d5b8], cl
inc eax
cmp eax, 0x28
jb 0xec4570
mov eax, 0xf7d5b8
ret

Function at 0xec458b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d3c], 1
jne 0xec45bf
or dword [0xf82d3c], 1
mov dword [0xf7cf34], 0x57555965
mov dword [0xf7cf38], 0x48485f65
mov word [0xf7cf3c], 0x4855
mov byte [0xf7cf3e], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7cf34]
xor cl, 0x3a
mov byte [eax + 0xf7d5e0], cl
inc eax
cmp eax, 0xb
jb 0xec45c1
mov eax, 0xf7d5e0
ret

Function at 0xec45dc
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d38], 1
jne 0xec4647
or dword [0xf82d38], 1
mov dword [0xf7cf40], 0x55596533
mov dword [0xf7cf44], 0x485f6557
mov dword [0xf7cf48], 0x485548
mov dword [0xf7cf4c], 0x48487f00
mov dword [0xf7cf50], 0x5f774855
mov dword [0xf7cf54], 0x5d5b4949
mov dword [0xf7cf58], 0x13125f
mov dword [0xf7cf5c], 0x37491f1a
mov word [0xf7cf60], 0x3a30
mov cl, byte [eax + 0xf7cf40]
xor cl, 0x3a
mov byte [eax + 0xf7d5ec], cl
inc eax
cmp eax, 0x22
jb 0xec4647
mov eax, 0xf7d5ec
ret

Function at 0xec4662
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d34], 1
jne 0xec46e2
or dword [0xf82d34], 1
mov dword [0xf7cf64], 0x535b7c33
mov dword [0xf7cf68], 0x1a5e5f56
mov dword [0xf7cf6c], 0x5d1a554e
mov dword [0xf7cf70], 0x651a4e5f
mov dword [0xf7cf74], 0x65575559
mov dword [0xf7cf78], 0x5548485f
mov dword [0xf7cf7c], 0x7f000048
mov dword [0xf7cf80], 0x48554848
mov dword [0xf7cf84], 0x49495f77
mov dword [0xf7cf88], 0x125f5d5b
mov dword [0xf7cf8c], 0x3a303713
mov cl, byte [eax + 0xf7cf64]
xor cl, 0x3a
mov byte [eax + 0xf7d610], cl
inc eax
cmp eax, 0x2c
jb 0xec46e2
mov eax, 0xf7d610
ret

Function at 0xec46fd
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d30], 1
jne 0xec477a
or dword [0xf82d30], 1
mov dword [0xf7cf90], 0x595b4e69
mov dword [0xf7cf94], 0x4f5e1a51
mov dword [0xf7cf98], 0x5f1a4a57
mov dword [0xf7cf9c], 0x48554848
mov dword [0xf7cfa0], 0x55791a00
mov dword [0xf7cfa4], 0x425f4e54
mov dword [0xf7cfa8], 0x595f684e
mov dword [0xf7cfac], 0x1a5e4855
mov dword [0xf7cfb0], 0x1a495b4d
mov dword [0xf7cfb4], 0x56564f54
mov byte [0xf7cfb8], 0x3a
mov cl, byte [eax + 0xf7cf90]
xor cl, 0x3a
mov byte [eax + 0xf7d63c], cl
inc eax
cmp eax, 0x29
jb 0xec477a
mov eax, 0xf7d63c
ret
Function at 0xec4795
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d2c], 1
jne 0xec4811
or dword [0xf82d2c], 1
mov dword [0xf7cfbc], 0x595b4e69
mov dword [0xf7cfc0], 0x4f5e1a51
mov dword [0xf7cfc4], 0x5f1a4a57
mov dword [0xf7cfc8], 0x48554848
mov dword [0xf7cfcc], 0x43691a00
mov dword [0xf7cfd0], 0x53547357
mov dword [0xf7cfd4], 0x565b534e
mov dword [0xf7cfd8], 0x1a5f4053
mov dword [0xf7cfdc], 0x56535b5c
mov word [0xf7cfe0], 0x5e5f
mov byte [0xf7cfe2], 0x3a
mov cl, byte [eax + 0xf7cfbc]
xor cl, 0x3a
mov byte [eax + 0xf7d668], cl
inc eax
cmp eax, 0x27
jb 0xec4811
mov eax, 0xf7d668
ret

Function at 0xec482c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d28], 1
jne 0xec4892
or dword [0xf82d28], 1
mov dword [0xf7cfe4], 0x53514906
mov dword [0xf7cfe8], 0x5e5f4a4a
mov dword [0xf7cfec], 0x5b485c1a
mov dword [0xf7cff0], 0x1a165f57
mov dword [0xf7cff4], 0x4d1a796a
mov dword [0xf7cff8], 0x541a495b
mov dword [0xf7cffc], 0x456564f
mov word [0xf7d000], 0x3037
mov byte [0xf7d002], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7cfe4]
xor cl, 0x3a
mov byte [eax + 0xf7d690], cl
inc eax
cmp eax, 0x1f
jb 0xec4894
mov eax, 0xf7d690
ret

Function at 0xec48af
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d24], 1
jne 0xec4942
or dword [0xf82d24], 1
mov dword [0xf7d004], 0x53514906
mov dword [0xf7d008], 0x5e5f4a4a
mov dword [0xf7d00c], 0x5b485c1a
mov dword [0xf7d010], 0x1a165f57
mov dword [0xf7d014], 0x4d1a796a
mov dword [0xf7d018], 0x491a495b
mov dword [0xf7d01c], 0x1a5f575b
mov dword [0xf7d020], 0x481a495b
mov dword [0xf7d024], 0x484f4e5f
mov dword [0xf7d028], 0x5e5b1a54
mov dword [0xf7d02c], 0x495f485e
mov dword [0xf7d030], 0x30370449
mov byte [0xf7d034], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7d004]
xor cl, 0x3a
mov byte [eax + 0xf7d6b0], cl
inc eax
cmp eax, 0x31
jb 0xec4944
mov eax, 0xf7d6b0
ret
Function at 0xec495f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.00f36a50
push ebx
push esi
push edi
call dword [0xf52094]
test byte [0xf82d20], 1
mov dword [ebp - 4], eax
jne 0xec49a6
or dword [0xf82d20], 1
mov dword [0xf7d038], 0x5e555706
mov dword [0xf7d03c], 0x55f564f
mov dword [0xf7d040], 0x3a040505
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0xf7d038]
xor cl, 0x3a
mov byte [eax + 0xf7d6e4], cl
inc eax
cmp eax, 0xc
jb 0xec49aa
test byte [0xf82d1c], 1
mov dword [ebp - 8], 0xf7d6e4
jne 0xec49f4
or dword [0xf82d1c], 1
mov dword [0xf7d044], 0x57434906
mov dword [0xf7d048], 0x5565558
mov dword [0xf7d04c], 0x3a040505
xor eax, eax
mov cl, byte [eax + 0xf7d044]
xor cl, 0x3a
mov byte [eax + 0xf7d6f0], cl
inc eax
cmp eax, 0xc
jb 0xec49f6
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0xf7d6f0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00f26f10
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0xf523b0]
test eax, eax
je 0xec4a5b
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.00f26f10
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0xf523bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0xec4aa7
mov ecx, dword [ebp - 0x1c]
test byte [0xf82d18], 1
jne 0xec4ade
or dword [0xf82d18], 1
mov dword [0xf7d050], 0x1f1a4a1f
mov dword [0xf7d054], 0x491f1b49
mov dword [0xf7d058], 0x1f420a11
mov word [0xf7d05c], 0x3a42
xor eax, eax
mov dl, byte [eax + 0xf7d050]
xor dl, 0x3a
mov byte [eax + 0xf7d6fc], dl
inc eax
cmp eax, 0xe
jb 0xec4ae0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0xf7d6fc
push dword [ebp + 0xc]
call fcn.00f2413d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0xf523a4]
test eax, eax
je 0xec4b57
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00ec4ba4
push eax
push dword [ebp + 0xc]
call fcn.00f2413d
add esp, 0x14
test byte [0xf82d10], 1
jne 0xec4b77
or dword [0xf82d10], 1
mov word [0xf7d070], 0x3037
mov byte [0xf7d072], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7d070]
xor cl, 0x3a
mov byte [eax + 0xf7d71c], cl
inc eax
cmp eax, 3
jb 0xec4b79
push dword [ebp + 0xc]
push 0xf7d71c
call fcn.00f23db1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xec4ba4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d14], 1
jne 0xec4bde
or dword [0xf82d14], 1
mov dword [0xf7d060], 0x491f121a
mov dword [0xf7d064], 0x1a5e1f00
mov dword [0xf7d068], 0x420a1a11
mov dword [0xf7d06c], 0x3a13421f
mov cl, byte [eax + 0xf7d060]
xor cl, 0x3a
mov byte [eax + 0xf7d70c], cl
inc eax
cmp eax, 0x10
jb 0xec4bde
mov eax, 0xf7d70c
ret

Function at 0xec5e21
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d04], 1
jne 0xec5e76
or dword [0xf82d04], 1
mov dword [0xf7d740], 0x7f697a73
mov dword [0xf7d744], 0x7e697a6c
mov dword [0xf7d748], 0x6b787a67
mov dword [0xf7d74c], 0x687f6772
mov dword [0xf7d750], 0x6d676f7f
mov dword [0xf7d754], 0x64637479
mov word [0xf7d758], 0x3b64
xor eax, eax
mov cl, byte [eax + 0xf7d740]
xor cl, 0x3b
mov byte [eax + 0xf7d940], cl
inc eax
cmp eax, 0x1a
jb 0xec5e78
mov eax, 0xf7d940
ret

Function at 0xec5f87
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d00], 1
jne 0xec5fb1
or dword [0xf82d00], 1
mov dword [0xf7d75c], 0x5a6c766d
mov word [0xf7d760], 0x5e49
mov byte [0xf7d762], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d75c]
xor cl, 0x3b
mov byte [eax + 0xf7d95c], cl
inc eax
cmp eax, 7
jb 0xec5fb3
mov eax, 0xf7d95c
ret

Function at 0xec5fcf
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cfc], 1
jne 0xec5ffc
or dword [0xf82cfc], 1
mov dword [0xf7d764], 0x4f49526d
mov dword [0xf7d768], 0x6b575a4e
mov word [0xf7d76c], 0x3b78
xor eax, eax
mov cl, byte [eax + 0xf7d764]
xor cl, 0x3b
mov byte [eax + 0xf7d964], cl
inc eax
cmp eax, 0xa
jb 0xec5ffe
mov eax, 0xf7d964
ret

Function at 0xec6019
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cf8], 1
jne 0xec604d
or dword [0xf82cf8], 1
mov dword [0xf7d770], 0x4f49526d
mov dword [0xf7d774], 0x79575a4e
mov word [0xf7d778], 0x4354
mov byte [0xf7d77a], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d770]
xor cl, 0x3b
mov byte [eax + 0xf7d970], cl
inc eax
cmp eax, 0xb
jb 0xec604f
mov eax, 0xf7d970
ret

Function at 0xec606a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cf4], 1
jne 0xec608e
or dword [0xf82cf4], 1
mov dword [0xf7d77c], 0x5e555e7c
mov dword [0xf7d780], 0x3b585249
xor eax, eax
mov cl, byte [eax + 0xf7d77c]
xor cl, 0x3b
mov byte [eax + 0xf7d97c], cl
inc eax
cmp eax, 8
jb 0xec6090
mov eax, 0xf7d97c
ret
Function at 0xec60ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xf4b27f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0xf82cf0], 1
push esi
jne 0xec60fe
or dword [0xf82cf0], 1
mov dword [0xf7d784], 0x575f4f55
mov dword [0xf7d788], 0x575f1557
mov word [0xf7d78c], 0x3b57
xor eax, eax
mov cl, byte [eax + 0xf7d784]
xor cl, 0x3b
mov byte [eax + 0xf7d984], cl
inc eax
cmp eax, 0xa
jb 0xec6100
push 0xf7d984
call dword [0xf520cc]
mov esi, eax
test esi, esi
jne 0xec6172
call dword [0xf520a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.00ec62b9
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
push eax
call fcn.00f2d865
call fcn.00ec631f
push eax
push esi
call dword [0xf520c8]
test eax, eax
jne 0xec61cf
call dword [0xf520a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00ec6391
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
jmp 0xec616c
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0xec6257
cmp dword [esp + 4], 0x18
jne 0xec6257
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0xf520c4]
test eax, eax
jne 0xec62a6
call dword [0xf520a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.00ec64d1
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
jmp 0xec616c
call dword [0xf520a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00ec6444
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
jmp 0xec616c
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xec62b9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cec], 1
jne 0xec6302
or dword [0xf82cec], 1
mov dword [0xf7d790], 0x5f5a5477
mov dword [0xf7d794], 0x49595277
mov dword [0xf7d798], 0x1b42495a
mov dword [0xf7d79c], 0x57525a5d
mov dword [0xf7d7a0], 0x1b015f5e
mov byte [0xf7d7a4], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d790]
xor cl, 0x3b
mov byte [eax + 0xf7d990], cl
inc eax
cmp eax, 0x15
jb 0xec6304
mov eax, 0xf7d990
ret
Function at 0xec631f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82ce8], 1
jne 0xec6374
or dword [0xf82ce8], 1
mov dword [0xf7d7a8], 0x4e6a4f75
mov dword [0xf7d7ac], 0x7242495e
mov dword [0xf7d7b0], 0x49545d55
mov dword [0xf7d7b4], 0x524f5a56
mov dword [0xf7d7b8], 0x496b5554
mov dword [0xf7d7bc], 0x485e5854
mov word [0xf7d7c0], 0x3b48
xor eax, eax
mov cl, byte [eax + 0xf7d7a8]
xor cl, 0x3b
mov byte [eax + 0xf7d9a8], cl
inc eax
cmp eax, 0x1a
jb 0xec6376
mov eax, 0xf7d9a8
ret

Function at 0xec6391
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82ce4], 1
jne 0xec6427
or dword [0xf82ce4], 1
mov dword [0xf7d7c4], 0x6b4f5e7c
mov dword [0xf7d7c8], 0x7a585449
mov dword [0xf7d7cc], 0x5e495f5f
mov dword [0xf7d7d0], 0x5d1b4848
mov dword [0xf7d7d4], 0x5e57525a
mov dword [0xf7d7d8], 0x75131b5f
mov dword [0xf7d7dc], 0x5e4e6a4f
mov dword [0xf7d7e0], 0x55724249
mov dword [0xf7d7e4], 0x5649545d
mov dword [0xf7d7e8], 0x54524f5a
mov dword [0xf7d7ec], 0x54496b55
mov dword [0xf7d7f0], 0x48485e58
mov dword [0xf7d7f4], 0x3b1b0112
xor eax, eax
mov cl, byte [eax + 0xf7d7c4]
xor cl, 0x3b
mov byte [eax + 0xf7d9c4], cl
inc eax
cmp eax, 0x34
jb 0xec6429
mov eax, 0xf7d9c4
ret

Function at 0xec6444
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82ce0], 1
jne 0xec64b4
or dword [0xf82ce0], 1
mov dword [0xf7d7f8], 0x4e6a4f75
mov dword [0xf7d7fc], 0x7242495e
mov dword [0xf7d800], 0x49545d55
mov dword [0xf7d804], 0x524f5a56
mov dword [0xf7d808], 0x496b5554
mov dword [0xf7d80c], 0x485e5854
mov dword [0xf7d810], 0x5a5d1b48
mov dword [0xf7d814], 0x5f5e5752
mov word [0xf7d818], 0x1b01
mov byte [0xf7d81a], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d7f8]
xor cl, 0x3b
mov byte [eax + 0xf7d9f8], cl
inc eax
cmp eax, 0x23
jb 0xec64b6
mov eax, 0xf7d9f8
ret

Function at 0xec64d1
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cdc], 1
jne 0xec651a
or dword [0xf82cdc], 1
mov dword [0xf7d81c], 0x555e4b74
mov dword [0xf7d820], 0x5854496b
mov dword [0xf7d824], 0x1b48485e
mov dword [0xf7d828], 0x57525a5d
mov dword [0xf7d82c], 0x1b015f5e
mov byte [0xf7d830], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d81c]
xor cl, 0x3b
mov byte [eax + 0xf7da1c], cl
inc eax
cmp eax, 0x15
jb 0xec651c
mov eax, 0xf7da1c
ret
Function at 0xec6537
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xf4b22c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0xf82cd8], 1
push esi
push edi
jne 0xec6594
or dword [0xf82cd8], 1
mov dword [0xf7d834], 0x55495e50
mov dword [0xf7d838], 0x908575e
mov dword [0xf7d83c], 0x57575f15
mov byte [0xf7d840], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d834]
xor cl, 0x3b
mov byte [eax + 0xf7da34], cl
inc eax
cmp eax, 0xd
jb 0xec6596
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0xf7da34
call edi
mov esi, eax
test esi, esi
jne 0xec660a
call dword [0xf520a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00ec676c
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
push eax
call fcn.00f2d865
call fcn.00ec67e9
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0xec66d7
call fcn.00ec685c
push eax
call edi
mov edi, eax
test edi, edi
jne 0xec667b
call dword [0xf520a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.00ec68a6
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
jmp 0xec6604
call fcn.00ec6920
push eax
push edi
call esi
test eax, eax
jne 0xec66d7
call dword [0xf520a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00ec6990
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
jmp 0xec6604
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0xec6739
call dword [0xf520a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00eea8dc
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00ec6a49
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00ec6b0a
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00ec5bd3
push 0xf6ec28
mov eax, esi
jmp 0xec6604
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00ec4cce
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xec676c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cd4], 1
jne 0xec67cc
or dword [0xf82cd4], 1
mov dword [0xf7d844], 0x5f5a5477
mov dword [0xf7d848], 0x49595277
mov dword [0xf7d84c], 0x1b42495a
mov dword [0xf7d850], 0x57525a5d
mov dword [0xf7d854], 0x131b5f5e
mov dword [0xf7d858], 0x55495e50
mov dword [0xf7d85c], 0x908575e
mov dword [0xf7d860], 0x3b1b0112
xor eax, eax
mov cl, byte [eax + 0xf7d844]
xor cl, 0x3b
mov byte [eax + 0xf7da44], cl
inc eax
cmp eax, 0x20
jb 0xec67ce
mov eax, 0xf7da44
ret
Function at 0xec67e9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cd0], 1
jne 0xec683f
or dword [0xf82cd0], 1
mov dword [0xf7d864], 0x7c090870
mov dword [0xf7d868], 0x496b4f5e
mov dword [0xf7d86c], 0x485e5854
mov dword [0xf7d870], 0x5a567248
mov dword [0xf7d874], 0x527d5e5c
mov dword [0xf7d878], 0x5a755e57
mov dword [0xf7d87c], 0x3b7a5e56
xor eax, eax
mov cl, byte [eax + 0xf7d864]
xor cl, 0x3b
mov byte [eax + 0xf7da64], cl
inc eax
cmp eax, 0x1c
jb 0xec6841
mov eax, 0xf7da64
ret

Function at 0xec685c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82ccc], 1
jne 0xec6889
or dword [0xf82ccc], 1
mov dword [0xf7d880], 0x4b5a484b
mov dword [0xf7d884], 0x575f1552
mov word [0xf7d888], 0x3b57
xor eax, eax
mov cl, byte [eax + 0xf7d880]
xor cl, 0x3b
mov byte [eax + 0xf7da80], cl
inc eax
cmp eax, 0xa
jb 0xec688b
mov eax, 0xf7da80
ret

Function at 0xec68a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cc8], 1
jne 0xec6903
or dword [0xf82cc8], 1
mov dword [0xf7d88c], 0x5f5a5477
mov dword [0xf7d890], 0x49595277
mov dword [0xf7d894], 0x1b42495a
mov dword [0xf7d898], 0x57525a5d
mov dword [0xf7d89c], 0x131b5f5e
mov dword [0xf7d8a0], 0x4b5a484b
mov dword [0xf7d8a4], 0x1b011252
mov byte [0xf7d8a8], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d88c]
xor cl, 0x3b
mov byte [eax + 0xf7da8c], cl
inc eax
cmp eax, 0x1d
jb 0xec6905
mov eax, 0xf7da8c
ret

Function at 0xec6920
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cc4], 1
jne 0xec6973
or dword [0xf82cc4], 1
mov dword [0xf7d8ac], 0x6b4f5e7c
mov dword [0xf7d8b0], 0x5e585449
mov dword [0xf7d8b4], 0x56724848
mov dword [0xf7d8b8], 0x7d5e5c5a
mov dword [0xf7d8bc], 0x755e5752
mov dword [0xf7d8c0], 0x7a5e565a
mov byte [0xf7d8c4], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d8ac]
xor cl, 0x3b
mov byte [eax + 0xf7daac], cl
inc eax
cmp eax, 0x19
jb 0xec6975
mov eax, 0xf7daac
ret

Function at 0xec6990
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cc0], 1
jne 0xec6a2c
or dword [0xf82cc0], 1
mov dword [0xf7d8c8], 0x6b4f5e7c
mov dword [0xf7d8cc], 0x7a585449
mov dword [0xf7d8d0], 0x5e495f5f
mov dword [0xf7d8d4], 0x5d1b4848
mov dword [0xf7d8d8], 0x5e57525a
mov dword [0xf7d8dc], 0x7c131b5f
mov dword [0xf7d8e0], 0x496b4f5e
mov dword [0xf7d8e4], 0x485e5854
mov dword [0xf7d8e8], 0x5a567248
mov dword [0xf7d8ec], 0x527d5e5c
mov dword [0xf7d8f0], 0x5a755e57
mov dword [0xf7d8f4], 0x127a5e56
mov word [0xf7d8f8], 0x1b01
mov byte [0xf7d8fa], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d8c8]
xor cl, 0x3b
mov byte [eax + 0xf7dac8], cl
inc eax
cmp eax, 0x33
jb 0xec6a2e
mov eax, 0xf7dac8
ret

Function at 0xec6a49
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cbc], 1
jne 0xec6ab0
or dword [0xf82cbc], 1
mov dword [0xf7d8fc], 0x6b4f5e7c
mov dword [0xf7d900], 0x5e585449
mov dword [0xf7d904], 0x56724848
mov dword [0xf7d908], 0x7d5e5c5a
mov dword [0xf7d90c], 0x555e5752
mov dword [0xf7d910], 0x1b5e565a
mov dword [0xf7d914], 0x57525a5d
mov dword [0xf7d918], 0x1b015f5e
mov byte [0xf7d91c], 0x3b
xor eax, eax
mov cl, byte [eax + 0xf7d8fc]
xor cl, 0x3b
mov byte [eax + 0xf7dafc], cl
inc eax
cmp eax, 0x21
jb 0xec6ab2
mov eax, 0xf7dafc
ret
Function at 0xec7629
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82cb8], 1
jne 0xec780f
or dword [0xf82cb8], 1
mov dword [0xf7db28], 0x4f125355
mov dword [0xf7db2c], 0x49535848
mov dword [0xf7db30], 0x594f0648
mov dword [0xf7db34], 0x495e4a48
mov dword [0xf7db38], 0x521b145a
mov dword [0xf7db3c], 0x36151b53
mov dword [0xf7db40], 0x575f5d4c
mov dword [0xf7db44], 0x12595b5d
mov dword [0xf7db48], 0x54485d4c
mov dword [0xf7db4c], 0x1b1c011c
mov dword [0xf7db50], 0x594e361b
mov dword [0xf7db54], 0x4e55494d
mov dword [0xf7db58], 0x4f1b1459
mov dword [0xf7db5c], 0x5f554e48
mov dword [0xf7db60], 0x36151b48
mov dword [0xf7db64], 0x5d5f5350
mov dword [0xf7db68], 0x104f1c50
mov dword [0xf7db6c], 0x11c4e1c
mov dword [0xf7db70], 0x5f4c441c
mov dword [0xf7db74], 0x1450505d
mov dword [0xf7db78], 0x5f52495a
mov dword [0xf7db7c], 0x52535548
mov dword [0xf7db80], 0x4e1c1514
mov dword [0xf7db84], 0x4e494859
mov dword [0xf7db88], 0x594e1c52
mov dword [0xf7db8c], 0x4e55494d
mov dword [0xf7db90], 0x191b1459
mov dword [0xf7db94], 0x12151b71
mov dword [0xf7db98], 0x52555d51
mov dword [0xf7db9c], 0x5d636314
mov dword [0xf7dba0], 0x154f5b4e
mov dword [0xf7dba4], 0x5852591c
mov dword [0xf7dba8], 0x59581c10
mov dword [0xf7dbac], 0x125b495e
mov dword [0xf7dbb0], 0x5f5d4e48
mov dword [0xf7dbb4], 0x5f5d5e59
mov dword [0xf7dbb8], 0x55361557
mov dword [0xf7dbbc], 0x53521c5a
mov dword [0xf7dbc0], 0x1c4f1c48
mov dword [0xf7dbc4], 0x52595448
mov dword [0xf7dbc8], 0x4e4e591c
mov dword [0xf7dbcc], 0x4e144e53
mov dword [0xf7dbd0], 0x52591c15
mov dword [0xf7dbd4], 0x594e3658
mov dword [0xf7dbd8], 0x524e4948
mov word [0xf7dbdc], 0x4e1c
mov byte [0xf7dbde], 0x3c
xor eax, eax
mov cl, byte [eax + 0xf7db28]
xor cl, 0x3c
mov byte [eax + 0xf7e120], cl
inc eax
cmp eax, 0xb7
jb 0xec7811
mov eax, 0xf7e120
ret