joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf6081
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x17b41f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x1b2cf0], 1
push esi
jne 0xf60d4
or dword [0x1b2cf0], 1
mov dword [0x1ad784], 0xf6feeef4
mov dword [0x1ad788], 0xf6feb4f6
mov word [0x1ad78c], 0x9af6
xor eax, eax
mov cl, byte [eax + 0x1ad784]
xor cl, 0x9a
mov byte [eax + 0x1ad984], cl
inc eax
cmp eax, 0xa
jb 0xf60d6
push 0x1ad984
call dword [0x1820cc]
mov esi, eax
test esi, esi
jne 0xf6148
call dword [0x1820a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.000f628f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
push eax
call fcn.0015da05
call fcn.000f62f5
push eax
push esi
call dword [0x1820c8]
test eax, eax
jne 0xf61a5
call dword [0x1820a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.000f6367
push eax
lea eax, [esp + 0x44]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
jmp 0xf6142
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0xf622d
cmp dword [esp + 4], 0x18
jne 0xf622d
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x1820c4]
test eax, eax
jne 0xf627c
call dword [0x1820a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.000f64d8
push eax
lea eax, [esp + 0x94]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
jmp 0xf6142
call dword [0x1820a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.000f644b
push eax
lea eax, [esp + 0x44]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
jmp 0xf6142
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xf628f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cec], 1
jne 0xf62d8
or dword [0x1b2cec], 1
mov dword [0x1ad790], 0xfefbf5d6
mov dword [0x1ad794], 0xe8f8f3d6
mov dword [0x1ad798], 0xbae3e8fb
mov dword [0x1ad79c], 0xf6f3fbfc
mov dword [0x1ad7a0], 0xbaa0feff
mov byte [0x1ad7a4], 0x9a
xor eax, eax
mov cl, byte [eax + 0x1ad790]
xor cl, 0x9a
mov byte [eax + 0x1ad990], cl
inc eax
cmp eax, 0x15
jb 0xf62da
mov eax, 0x1ad990
ret
Function at 0xf62f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2ce8], 1
jne 0xf634a
or dword [0x1b2ce8], 1
mov dword [0x1ad7a8], 0xefcbeed4
mov dword [0x1ad7ac], 0xd3e3e8ff
mov dword [0x1ad7b0], 0xe8f5fcf4
mov dword [0x1ad7b4], 0xf3eefbf7
mov dword [0x1ad7b8], 0xe8caf4f5
mov dword [0x1ad7bc], 0xe9fff9f5
mov word [0x1ad7c0], 0x9ae9
xor eax, eax
mov cl, byte [eax + 0x1ad7a8]
xor cl, 0x9a
mov byte [eax + 0x1ad9a8], cl
inc eax
cmp eax, 0x1a
jb 0xf634c
mov eax, 0x1ad9a8
ret

Function at 0xf6367
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2ce4], 1
jne 0xf642e
or dword [0x1b2ce4], 1
or al, 0xff
mov byte [0x1ad7c4], 0xdd
mov byte [0x1ad7c5], al
mov dword [0x1ad7c6], 0xf5e8caee
mov dword [0x1ad7ca], 0xfefedbf9
mov byte [0x1ad7ce], 0xe8
mov byte [0x1ad7cf], al
mov dword [0x1ad7d0], 0xfcbae9e9
mov word [0x1ad7d4], 0xf3fb
mov byte [0x1ad7d6], 0xf6
mov byte [0x1ad7d7], al
mov dword [0x1ad7d8], 0xd4b2bafe
mov word [0x1ad7dc], 0xcbee
mov byte [0x1ad7de], 0xef
mov byte [0x1ad7df], al
mov dword [0x1ad7e0], 0xf4d3e3e8
mov dword [0x1ad7e4], 0xf7e8f5fc
mov dword [0x1ad7e8], 0xf5f3eefb
mov dword [0x1ad7ec], 0xf5e8caf4
mov byte [0x1ad7f0], 0xf9
mov byte [0x1ad7f1], al
mov dword [0x1ad7f2], 0xa0b3e9e9
mov word [0x1ad7f6], 0x9aba
xor eax, eax
mov cl, byte [eax + 0x1ad7c4]
xor cl, 0x9a
mov byte [eax + 0x1ad9c4], cl
inc eax
cmp eax, 0x34
jb 0xf6430
mov eax, 0x1ad9c4
ret

Function at 0xf644b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2ce0], 1
jne 0xf64bb
or dword [0x1b2ce0], 1
mov dword [0x1ad7f8], 0xefcbeed4
mov dword [0x1ad7fc], 0xd3e3e8ff
mov dword [0x1ad800], 0xe8f5fcf4
mov dword [0x1ad804], 0xf3eefbf7
mov dword [0x1ad808], 0xe8caf4f5
mov dword [0x1ad80c], 0xe9fff9f5
mov dword [0x1ad810], 0xfbfcbae9
mov dword [0x1ad814], 0xfefff6f3
mov word [0x1ad818], 0xbaa0
mov byte [0x1ad81a], 0x9a
xor eax, eax
mov cl, byte [eax + 0x1ad7f8]
xor cl, 0x9a
mov byte [eax + 0x1ad9f8], cl
inc eax
cmp eax, 0x23
jb 0xf64bd
mov eax, 0x1ad9f8
ret

Function at 0xf64d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cdc], 1
jne 0xf6521
or dword [0x1b2cdc], 1
mov dword [0x1ad81c], 0xf4ffead5
mov dword [0x1ad820], 0xf9f5e8ca
mov dword [0x1ad824], 0xbae9e9ff
mov dword [0x1ad828], 0xf6f3fbfc
mov dword [0x1ad82c], 0xbaa0feff
mov byte [0x1ad830], 0x9a
xor eax, eax
mov cl, byte [eax + 0x1ad81c]
xor cl, 0x9a
mov byte [eax + 0x1ada1c], cl
inc eax
cmp eax, 0x15
jb 0xf6523
mov eax, 0x1ada1c
ret
Function at 0xf653e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x17b3cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x1b2cd8], 1
push esi
push edi
jne 0xf659b
or dword [0x1b2cd8], 1
mov dword [0x1ad834], 0xf4e8fff1
mov dword [0x1ad838], 0xa8a9f6ff
mov dword [0x1ad83c], 0xf6f6feb4
mov byte [0x1ad840], 0x9a
xor eax, eax
mov cl, byte [eax + 0x1ad834]
xor cl, 0x9a
mov byte [eax + 0x1ada34], cl
inc eax
cmp eax, 0xd
jb 0xf659d
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x1ada34
call edi
mov esi, eax
test esi, esi
jne 0xf6611
call dword [0x1820a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.000f6773
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
push eax
call fcn.0015da05
call fcn.000f67f0
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0xf66de
call fcn.000f688f
push eax
call edi
mov edi, eax
test edi, edi
jne 0xf6682
call dword [0x1820a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.000f68d9
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
jmp 0xf660b
call fcn.000f6953
push eax
push edi
call esi
test eax, eax
jne 0xf66de
call dword [0x1820a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.000f69ef
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
jmp 0xf660b
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0xf6740
call dword [0x1820a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0011aa2a
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.000f6ae5
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000f6bd9
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.000f5bc9
push 0x19ec28
mov eax, esi
jmp 0xf660b
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.000f4cc4
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xf6773
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cd4], 1
jne 0xf67d3
or dword [0x1b2cd4], 1
mov dword [0x1ad844], 0xfefbf5d6
mov dword [0x1ad848], 0xe8f8f3d6
mov dword [0x1ad84c], 0xbae3e8fb
mov dword [0x1ad850], 0xf6f3fbfc
mov dword [0x1ad854], 0xb2bafeff
mov dword [0x1ad858], 0xf4e8fff1
mov dword [0x1ad85c], 0xa8a9f6ff
mov dword [0x1ad860], 0x9abaa0b3
xor eax, eax
mov cl, byte [eax + 0x1ad844]
xor cl, 0x9a
mov byte [eax + 0x1ada44], cl
inc eax
cmp eax, 0x20
jb 0xf67d5
mov eax, 0x1ada44
ret
Function at 0xf67f0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cd0], 1
jne 0xf6872
or dword [0x1b2cd0], 1
or al, 0xff
mov dword [0x1ad864], 0xdda8a9d1
mov byte [0x1ad868], al
mov dword [0x1ad869], 0xf5e8caee
mov byte [0x1ad86d], 0xf9
mov byte [0x1ad86e], al
mov dword [0x1ad86f], 0xf7d3e9e9
mov word [0x1ad873], 0xfdfb
mov byte [0x1ad875], al
mov word [0x1ad876], 0xf3dc
mov byte [0x1ad878], 0xf6
mov byte [0x1ad879], al
mov word [0x1ad87a], 0xfbd4
mov byte [0x1ad87c], 0xf7
mov byte [0x1ad87d], al
mov word [0x1ad87e], 0x9adb
xor eax, eax
mov cl, byte [eax + 0x1ad864]
xor cl, 0x9a
mov byte [eax + 0x1ada64], cl
inc eax
cmp eax, 0x1c
jb 0xf6874
mov eax, 0x1ada64
ret

Function at 0xf688f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2ccc], 1
jne 0xf68bc
or dword [0x1b2ccc], 1
mov dword [0x1ad880], 0xeafbe9ea
mov dword [0x1ad884], 0xf6feb4f3
mov word [0x1ad888], 0x9af6
xor eax, eax
mov cl, byte [eax + 0x1ad880]
xor cl, 0x9a
mov byte [eax + 0x1ada80], cl
inc eax
cmp eax, 0xa
jb 0xf68be
mov eax, 0x1ada80
ret

Function at 0xf68d9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cc8], 1
jne 0xf6936
or dword [0x1b2cc8], 1
mov dword [0x1ad88c], 0xfefbf5d6
mov dword [0x1ad890], 0xe8f8f3d6
mov dword [0x1ad894], 0xbae3e8fb
mov dword [0x1ad898], 0xf6f3fbfc
mov dword [0x1ad89c], 0xb2bafeff
mov dword [0x1ad8a0], 0xeafbe9ea
mov dword [0x1ad8a4], 0xbaa0b3f3
mov byte [0x1ad8a8], 0x9a
xor eax, eax
mov cl, byte [eax + 0x1ad88c]
xor cl, 0x9a
mov byte [eax + 0x1ada8c], cl
inc eax
cmp eax, 0x1d
jb 0xf6938
mov eax, 0x1ada8c
ret

Function at 0xf6953
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cc4], 1
jne 0xf69d2
or dword [0x1b2cc4], 1
or al, 0xff
mov byte [0x1ad8ac], 0xdd
mov byte [0x1ad8ad], al
mov dword [0x1ad8ae], 0xf5e8caee
mov byte [0x1ad8b2], 0xf9
mov byte [0x1ad8b3], al
mov dword [0x1ad8b4], 0xf7d3e9e9
mov word [0x1ad8b8], 0xfdfb
mov byte [0x1ad8ba], al
mov word [0x1ad8bb], 0xf3dc
mov byte [0x1ad8bd], 0xf6
mov byte [0x1ad8be], al
mov word [0x1ad8bf], 0xfbd4
mov byte [0x1ad8c1], 0xf7
mov byte [0x1ad8c2], al
mov word [0x1ad8c3], 0x9adb
xor eax, eax
mov cl, byte [eax + 0x1ad8ac]
xor cl, 0x9a
mov byte [eax + 0x1adaac], cl
inc eax
cmp eax, 0x19
jb 0xf69d4
mov eax, 0x1adaac
ret
Function at 0xf69ef
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cc0], 1
jne 0xf6ac8
or dword [0x1b2cc0], 1
or al, 0xff
mov byte [0x1ad8c8], 0xdd
mov byte [0x1ad8c9], al
mov dword [0x1ad8ca], 0xf5e8caee
mov dword [0x1ad8ce], 0xfefedbf9
mov byte [0x1ad8d2], 0xe8
mov byte [0x1ad8d3], al
mov dword [0x1ad8d4], 0xfcbae9e9
mov word [0x1ad8d8], 0xf3fb
mov byte [0x1ad8da], 0xf6
mov byte [0x1ad8db], al
mov dword [0x1ad8dc], 0xddb2bafe
mov byte [0x1ad8e0], al
mov dword [0x1ad8e1], 0xf5e8caee
mov byte [0x1ad8e5], 0xf9
mov byte [0x1ad8e6], al
mov dword [0x1ad8e7], 0xf7d3e9e9
mov word [0x1ad8eb], 0xfdfb
mov byte [0x1ad8ed], al
mov word [0x1ad8ee], 0xf3dc
mov byte [0x1ad8f0], 0xf6
mov byte [0x1ad8f1], al
mov word [0x1ad8f2], 0xfbd4
mov byte [0x1ad8f4], 0xf7
mov byte [0x1ad8f5], al
mov dword [0x1ad8f6], 0xbaa0b3db
mov byte [0x1ad8fa], 0x9a
xor eax, eax
mov cl, byte [eax + 0x1ad8c8]
xor cl, 0x9a
mov byte [eax + 0x1adac8], cl
inc eax
cmp eax, 0x33
jb 0xf6aca
mov eax, 0x1adac8
ret

Function at 0xf6ae5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cbc], 1
jne 0xf6b7f
or dword [0x1b2cbc], 1
or al, 0xff
mov byte [0x1ad8fc], 0xdd
mov byte [0x1ad8fd], al
mov dword [0x1ad8fe], 0xf5e8caee
mov byte [0x1ad902], 0xf9
mov byte [0x1ad903], al
mov dword [0x1ad904], 0xf7d3e9e9
mov word [0x1ad908], 0xfdfb
mov byte [0x1ad90a], al
mov word [0x1ad90b], 0xf3dc
mov byte [0x1ad90d], 0xf6
mov byte [0x1ad90e], al
mov word [0x1ad90f], 0xfbf4
mov byte [0x1ad911], 0xf7
mov byte [0x1ad912], al
mov dword [0x1ad913], 0xf3fbfcba
mov byte [0x1ad917], 0xf6
mov byte [0x1ad918], al
mov dword [0x1ad919], 0x9abaa0fe
xor eax, eax
mov cl, byte [eax + 0x1ad8fc]
xor cl, 0x9a
mov byte [eax + 0x1adafc], cl
inc eax
cmp eax, 0x21
jb 0xf6b81
mov eax, 0x1adafc
ret
Function at 0xf7759
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cb8], 1
jne 0xf7974
or dword [0x1b2cb8], 1
or al, 0xff
mov dword [0x1adb28], 0xefb2f3f5
mov dword [0x1adb2c], 0xe9f3f8e8
mov dword [0x1adb30], 0xf9efa6e8
mov dword [0x1adb34], 0xe9feeae8
mov dword [0x1adb38], 0xf2bbb4fa
mov dword [0x1adb3c], 0x96b5bbf3
mov word [0x1adb40], 0xfdec
mov byte [0x1adb42], al
mov dword [0x1adb43], 0xf9fbfdf7
mov dword [0x1adb47], 0xe8fdecb2
mov dword [0x1adb4b], 0xbca1bcf4
mov dword [0x1adb4f], 0xee96bbbb
mov dword [0x1adb53], 0xf5e9edf9
mov dword [0x1adb57], 0xbbb4f9ee
mov dword [0x1adb5b], 0xf5eee8ef
mov byte [0x1adb5f], al
mov dword [0x1adb60], 0x96b5bbe8
mov word [0x1adb64], 0xf3f0
mov byte [0x1adb66], al
mov dword [0x1adb67], 0xefbcf0fd
mov dword [0x1adb6b], 0xbceebcb0
mov dword [0x1adb6f], 0xece4bca1
mov byte [0x1adb73], al
mov dword [0x1adb74], 0xb4f0f0fd
mov word [0x1adb78], 0xe9fa
mov byte [0x1adb7a], 0xf2
mov byte [0x1adb7b], al
mov dword [0x1adb7c], 0xf2f3f5e8
mov dword [0x1adb80], 0xeebcb5b4
mov dword [0x1adb84], 0xeee9e8f9
mov dword [0x1adb88], 0xf9eebcf2
mov dword [0x1adb8c], 0xeef5e9ed
mov dword [0x1adb90], 0xb9bbb4f9
mov dword [0x1adb94], 0xb2b5bbd1
mov dword [0x1adb98], 0xf2f5fdf1
mov dword [0x1adb9c], 0xfdc3c3b4
mov dword [0x1adba0], 0xb5effbee
mov dword [0x1adba4], 0xf8f2f9bc
mov dword [0x1adba8], 0xf9f8bcb0
mov dword [0x1adbac], 0xb2fbe9fe
mov word [0x1adbb0], 0xeee8
mov byte [0x1adbb2], 0xfd
mov byte [0x1adbb3], al
mov word [0x1adbb4], 0xfef9
mov byte [0x1adbb6], 0xfd
mov byte [0x1adbb7], al
mov dword [0x1adbb8], 0xf596b5f7
mov dword [0x1adbbc], 0xf3f2bcfa
mov dword [0x1adbc0], 0xbcefbce8
mov dword [0x1adbc4], 0xf2f9f4e8
mov dword [0x1adbc8], 0xeeeef9bc
mov dword [0x1adbcc], 0xeeb4eef3
mov dword [0x1adbd0], 0xf2f9bcb5
mov dword [0x1adbd4], 0xf9ee96f8
mov dword [0x1adbd8], 0xf2eee9e8
mov word [0x1adbdc], 0xeebc
mov byte [0x1adbde], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adb28]
xor cl, 0x9c
mov byte [eax + 0x1ae120], cl
inc eax
cmp eax, 0xb7
jb 0xf7976
mov eax, 0x1ae120
ret
Function at 0xf7993
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2cb4], 1
jne 0xf7c51
or dword [0x1b2cb4], 1
or al, 0xff
mov dword [0x1adbe0], 0xefb2f3f5
mov dword [0x1adbe4], 0xe9f3f8e8
mov dword [0x1adbe8], 0xf9efa6e8
mov dword [0x1adbec], 0xe9feeae8
mov dword [0x1adbf0], 0xf2bbb4fa
mov dword [0x1adbf4], 0x96b5bbf3
mov word [0x1adbf8], 0xfdec
mov byte [0x1adbfa], al
mov dword [0x1adbfb], 0xf9fbfdf7
mov dword [0x1adbff], 0xe8fdecb2
mov dword [0x1adc03], 0xbbbba1f4
mov dword [0x1adc07], 0xedf9ee96
mov dword [0x1adc0b], 0xf9eef5e9
mov dword [0x1adc0f], 0xe8efbbb4
mov word [0x1adc13], 0xf5ee
mov byte [0x1adc15], al
mov dword [0x1adc16], 0x96b5bbe8
mov word [0x1adc1a], 0xf3f0
mov byte [0x1adc1c], al
mov dword [0x1adc1d], 0xf1bcf0fd
mov dword [0x1adc21], 0xbca1bcf0
mov dword [0x1adc25], 0xe9edf9ee
mov dword [0x1adc29], 0xb4f9eef5
mov dword [0x1adc2d], 0xbbf0f1bb
mov dword [0x1adc31], 0xf3f096b5
mov byte [0x1adc35], al
mov dword [0x1adc36], 0xefbcf0fd
mov dword [0x1adc3a], 0xf9b0eeb0
mov dword [0x1adc3e], 0xe4bca1bc
mov byte [0x1adc42], 0xec
mov byte [0x1adc43], al
mov dword [0x1adc44], 0xb4f0f0fd
mov word [0x1adc48], 0xe9fa
mov byte [0x1adc4a], 0xf2
mov byte [0x1adc4b], al
mov dword [0x1adc4c], 0xf2f3f5e8
mov dword [0x1adc50], 0xeebcb5b4
mov dword [0x1adc54], 0xeee9e8f9
mov dword [0x1adc58], 0xf9eebcf2
mov dword [0x1adc5c], 0xeef5e9ed
mov dword [0x1adc60], 0xb9bbb4f9
mov dword [0x1adc64], 0xb2b5bbd1
mov dword [0x1adc68], 0xb9b4dab9
mov dword [0x1adc6c], 0xf9bcb5dd
mov dword [0x1adc70], 0xbcb0f8f2
mov dword [0x1adc74], 0xe9fef9f8
mov dword [0x1adc78], 0xeee8b2fb
mov byte [0x1adc7c], 0xfd
mov byte [0x1adc7d], al
mov word [0x1adc7e], 0xfef9
mov byte [0x1adc80], 0xfd
mov byte [0x1adc81], al
mov dword [0x1adc82], 0xf596b5f7
mov dword [0x1adc86], 0xf3f2bcfa
mov dword [0x1adc8a], 0xbcefbce8
mov dword [0x1adc8e], 0xf2f9f4e8
mov dword [0x1adc92], 0xe8f9eebc
mov dword [0x1adc96], 0xbcf2eee9
mov dword [0x1adc9a], 0xb0f0f5f2
mov dword [0x1adc9e], 0xf9bceebc
mov dword [0x1adca2], 0xf596f8f2
mov dword [0x1adca6], 0xbceebcfa
mov dword [0x1adcaa], 0xf2bca1e2
mov dword [0x1adcae], 0xe8bcf0f5
mov dword [0x1adcb2], 0xbcf2f9f4
mov dword [0x1adcb6], 0xbca1bcee
mov dword [0x1adcba], 0xe8b2f0f1
mov dword [0x1adcbe], 0xf5eee8ef
mov dword [0x1adcc2], 0xeeb4fbf2
mov dword [0x1adcc6], 0xf2f9bcb5
mov dword [0x1adcca], 0xf9ee96f8
mov dword [0x1adcce], 0xf2eee9e8
mov dword [0x1adcd2], 0xf9b0eebc
mov byte [0x1adcd6], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adbe0]
xor cl, 0x9c
mov byte [eax + 0x1ae1d8], cl
inc eax
cmp eax, 0xf7
jb 0xf7c53
mov eax, 0x1ae1d8
ret
Function at 0xf7c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x1b2c74], 1
jne 0xf7c97
or dword [0x1b2c74], 1
mov dword [0x1addcc], 0xf7fffdec
mov dword [0x1addd0], 0x9cf9fbfd
xor eax, eax
mov cl, byte [eax + 0x1addcc]
xor cl, 0x9c
mov byte [eax + 0x1ae3c4], cl
inc eax
cmp eax, 8
jb 0xf7c99
push 0x1ae3c4
push dword [ebp + 8]
call fcn.00140d25
test byte [0x1b2c70], 1
pop ecx
pop ecx
jne 0xf7ce1
or dword [0x1b2c70], 1
mov dword [0x1addd4], 0xf0f9eeec
mov dword [0x1addd8], 0x9cf8fdf3
xor eax, eax
mov cl, byte [eax + 0x1addd4]
xor cl, 0x9c
mov byte [eax + 0x1ae3cc], cl
inc eax
cmp eax, 8
jb 0xf7ce3
push esi
push 0x1ae3cc
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00140d99
add esp, 0xc
cmp dword [0x1a8be0], 0
mov esi, 0x1a8be0
je 0xf7d43
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00140c45
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00140fc6
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0xf7d1c
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0014049a
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0xf7fbd
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x17ae08
call fcn.00179dc8
sub esp, 0x64
test byte [0x1b2c5c], 1
jne 0xf7fea
or dword [0x1b2c5c], 1
mov word [0x1ade04], 0xd1b9
mov byte [0x1ade06], 0x9c
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x1ade04]
xor cl, 0x9c
mov byte [eax + 0x1ae3fc], cl
inc eax
cmp eax, 3
jb 0xf7ff1
mov esi, 0x1ae3fc
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xf801d
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.000f4c4f
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.000fd1ac
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.000f4ce5
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0xf8064
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.0013f898
pop ecx
pop ecx
cmp eax, ebx
je 0xf80b5
cmp eax, 3
jne 0xf80a2
call fcn.000f81bc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00153ae5
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x19ec28
lea eax, [ebp - 0x1c]
push eax
call fcn.0015da05
cmp eax, 4
jne 0xf80ae
call fcn.000f826f
jmp 0xf807e
call fcn.000f8322
jmp 0xf807e
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.001412ce
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0xf816c
push ebx
call fcn.000f83a6
push eax
push 0xffffffffffffffff
push esi
call fcn.0014002f
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.000f4cc4
mov byte [ebp - 4], 3
cmp edi, 2
jne 0xf8124
call fcn.000f83ed
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.000fd21d
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.000f5bc9
jmp 0xf8094
cmp edi, 4
jne 0xf8143
call fcn.000f844c
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.000fd21d
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0xf8117
cmp edi, 6
jne 0xf8162
call fcn.000f84b1
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.000fd21d
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0xf8117
call fcn.000f8535
jmp 0xf807e
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.0014068a
pop ecx
pop ecx
test eax, eax
je 0xf818d
push ebx
push edi
push esi
call fcn.0014084e
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.00140484
sub edi, eax
push edi
push esi
call fcn.0014049a
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.000f4ce5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xf81bc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c58], 1
jne 0xf8252
or dword [0x1b2c58], 1
mov dword [0x1ade08], 0xf0f5fdda
mov dword [0x1ade0c], 0xe8bcf8f9
mov dword [0x1ade10], 0xeaf9bcf3
mov dword [0x1ade14], 0xfde9f0fd
mov dword [0x1ade18], 0xfebcf9e8
mov dword [0x1ade1c], 0xefe8f3f3
mov dword [0x1ade20], 0xecfdeee8
mov dword [0x1ade24], 0xfdeefabc
mov dword [0x1ade28], 0xf2f9f1fb
mov dword [0x1ade2c], 0xefbcb0e8
mov dword [0x1ade30], 0xfde8f2e5
mov dword [0x1ade34], 0xeef9bce4
mov dword [0x1ade38], 0x9ceef3ee
xor eax, eax
mov cl, byte [eax + 0x1ade08]
xor cl, 0x9c
mov byte [eax + 0x1ae400], cl
inc eax
cmp eax, 0x34
jb 0xf8254
mov eax, 0x1ae400
ret

Function at 0xf826f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c54], 1
jne 0xf8305
or dword [0x1b2c54], 1
mov dword [0x1ade3c], 0xf0f5fdda
mov dword [0x1ade40], 0xe8bcf8f9
mov dword [0x1ade44], 0xeaf9bcf3
mov dword [0x1ade48], 0xfde9f0fd
mov dword [0x1ade4c], 0xfebcf9e8
mov dword [0x1ade50], 0xefe8f3f3
mov dword [0x1ade54], 0xecfdeee8
mov dword [0x1ade58], 0xfdeefabc
mov dword [0x1ade5c], 0xf2f9f1fb
mov dword [0x1ade60], 0xf1bcb0e8
mov dword [0x1ade64], 0xeef3f1f9
mov dword [0x1ade68], 0xeef9bce5
mov dword [0x1ade6c], 0x9ceef3ee
xor eax, eax
mov cl, byte [eax + 0x1ade3c]
xor cl, 0x9c
mov byte [eax + 0x1ae434], cl
inc eax
cmp eax, 0x34
jb 0xf8307
mov eax, 0x1ae434
ret

Function at 0xf8322
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c50], 1
jne 0xf8389
or dword [0x1b2c50], 1
mov dword [0x1ade70], 0xf2f7f2c9
mov dword [0x1ade74], 0xbcf2ebf3
mov dword [0x1ade78], 0xf3eeeef9
mov dword [0x1ade7c], 0xf2f5bcee
mov dword [0x1ade80], 0xfde9f0bc
mov dword [0x1ade84], 0xf3f0c3d0
mov dword [0x1ade88], 0xe8eff8fd
mov dword [0x1ade8c], 0xfbf2f5ee
mov byte [0x1ade90], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1ade70]
xor cl, 0x9c
mov byte [eax + 0x1ae468], cl
inc eax
cmp eax, 0x21
jb 0xf838b
mov eax, 0x1ae468
ret

Function at 0xf83a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c4c], 1
jne 0xf83d0
or dword [0x1b2c4c], 1
mov dword [0x1ade94], 0xf2f3f2a0
mov word [0x1ade98], 0xa2f9
mov byte [0x1ade9a], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1ade94]
xor cl, 0x9c
mov byte [eax + 0x1ae48c], cl
inc eax
cmp eax, 7
jb 0xf83d2
mov eax, 0x1ae48c
ret

Function at 0xf83ed
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c48], 1
jne 0xf842f
or dword [0x1b2c48], 1
mov dword [0x1ade9c], 0xbcfde9d0
mov dword [0x1adea0], 0xe8f2e9ee
mov dword [0x1adea4], 0xbcf9f1f5
mov dword [0x1adea8], 0xf3eeeef9
mov dword [0x1adeac], 0x9cbca6ee
xor eax, eax
mov cl, byte [eax + 0x1ade9c]
xor cl, 0x9c
mov byte [eax + 0x1ae494], cl
inc eax
cmp eax, 0x14
jb 0xf8431
mov eax, 0x1ae494
ret