joyce8/EMBER2024-capa huggingface dataset:
Function at 0x252432
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f27a0], 1
jne 0x252487
or dword [0x2f27a0], 1
mov dword [0x2f0d10], 0x90b7d9d1
mov dword [0x2f0d14], 0x95949d98
mov dword [0x2f0d18], 0xd19e85d1
mov dword [0x2f0d1c], 0x9c839e97
mov dword [0x2f0d20], 0x94d18590
mov dword [0x2f0d24], 0x839e8383
mov word [0x2f0d28], 0xf1d8
xor eax, eax
mov cl, byte [eax + 0x2f0d10]
xor cl, 0xf1
mov byte [eax + 0x2f0fc8], cl
inc eax
cmp eax, 0x1a
jb 0x252489
mov eax, 0x2f0fc8
ret

Function at 0x2525f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2798], 1
jne 0x25263b
or dword [0x2f2798], 1
mov dword [0x2f0d30], 0xb99f98a6
mov dword [0x2f0d34], 0xbe818585
mov dword [0x2f0d38], 0xd99f9481
mov dword [0x2f0d3c], 0x9097d1d8
mov dword [0x2f0d40], 0x95949d98
mov byte [0x2f0d44], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0d30]
xor cl, 0xf1
mov byte [eax + 0x2f0fe8], cl
inc eax
cmp eax, 0x15
jb 0x25263d
mov eax, 0x2f0fe8
ret

Function at 0x252902
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2794], 1
jne 0x252955
or dword [0x2f2794], 1
mov dword [0x2f0d48], 0xb99f98a6
mov dword [0x2f0d4c], 0xb2818585
mov dword [0x2f0d50], 0x9a929083
mov dword [0x2f0d54], 0xd99d83a4
mov dword [0x2f0d58], 0x9097d1d8
mov dword [0x2f0d5c], 0x95949d98
mov byte [0x2f0d60], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0d48]
xor cl, 0xf1
mov byte [eax + 0x2f1000], cl
inc eax
cmp eax, 0x19
jb 0x252957
mov eax, 0x2f1000
ret

Function at 0x252972
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2790], 1
jne 0x2529be
or dword [0x2f2790], 1
mov dword [0x2f0d64], 0xb99f98a6
mov dword [0x2f0d68], 0xb2818585
mov dword [0x2f0d6c], 0x949f9f9e
mov dword [0x2f0d70], 0xd8d98592
mov dword [0x2f0d74], 0x989097d1
mov dword [0x2f0d78], 0xf195949d
xor eax, eax
mov cl, byte [eax + 0x2f0d64]
xor cl, 0xf1
mov byte [eax + 0x2f101c], cl
inc eax
cmp eax, 0x18
jb 0x2529c0
mov eax, 0x2f101c
ret

Function at 0x253317
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f278c], 1
jne 0x2533f0
or dword [0x2f278c], 1
mov dword [0x2f0d80], 0x848094a3
mov dword [0x2f0d84], 0xd1858294
mov dword [0x2f0d88], 0xd19d8384
mov dword [0x2f0d8c], 0x95948284
mov dword [0x2f0d90], 0x95d190d1
mov dword [0x2f0d94], 0x94979798
mov dword [0x2f0d98], 0x859f9483
mov dword [0x2f0d9c], 0x999282d1
mov dword [0x2f0da0], 0xd1949c94
mov dword [0x2f0da4], 0x9f909985
mov dword [0x2f0da8], 0x949985d1
mov dword [0x2f0dac], 0x9f9e92d1
mov dword [0x2f0db0], 0x8592949f
mov dword [0x2f0db4], 0xd19f9e98
mov dword [0x2f0db8], 0xd1829086
mov dword [0x2f0dbc], 0x85989f98
mov dword [0x2f0dc0], 0x989d9098
mov dword [0x2f0dc4], 0xd195948b
mov dword [0x2f0dc8], 0x99859886
mov byte [0x2f0dcc], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0d80]
xor cl, 0xf1
mov byte [eax + 0x2f1038], cl
inc eax
cmp eax, 0x4d
jb 0x2533f2
mov eax, 0x2f1038
ret
Function at 0x25340d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2788], 1
jne 0x2534e9
or dword [0x2f2788], 1
mov dword [0x2f0dd0], 0x848094a3
mov dword [0x2f0dd4], 0xd1858294
mov dword [0x2f0dd8], 0xd19d8384
mov dword [0x2f0ddc], 0x95948284
mov dword [0x2f0de0], 0x95d190d1
mov dword [0x2f0de4], 0x94979798
mov dword [0x2f0de8], 0x859f9483
mov dword [0x2f0dec], 0x829e99d1
mov dword [0x2f0df0], 0x909fd185
mov dword [0x2f0df4], 0x85d1949c
mov dword [0x2f0df8], 0xd19f9099
mov dword [0x2f0dfc], 0xd1949985
mov dword [0x2f0e00], 0x9f9f9e92
mov dword [0x2f0e04], 0x98859294
mov dword [0x2f0e08], 0x86d19f9e
mov dword [0x2f0e0c], 0x98d18290
mov dword [0x2f0e10], 0x9885989f
mov dword [0x2f0e14], 0x8b989d90
mov dword [0x2f0e18], 0x86d19594
mov dword [0x2f0e1c], 0xf1998598
xor eax, eax
mov cl, byte [eax + 0x2f0dd0]
xor cl, 0xf1
mov byte [eax + 0x2f1088], cl
inc eax
cmp eax, 0x50
jb 0x2534eb
mov eax, 0x2f1088
ret

Function at 0x253506
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2784], 1
jne 0x2535de
or dword [0x2f2784], 1
mov dword [0x2f0e20], 0x848094a3
mov dword [0x2f0e24], 0xd1858294
mov dword [0x2f0e28], 0xd19d8384
mov dword [0x2f0e2c], 0x95948284
mov dword [0x2f0e30], 0x95d190d1
mov dword [0x2f0e34], 0x94979798
mov dword [0x2f0e38], 0x859f9483
mov dword [0x2f0e3c], 0x839e81d1
mov dword [0x2f0e40], 0x9985d185
mov dword [0x2f0e44], 0x85d19f90
mov dword [0x2f0e48], 0x92d19499
mov dword [0x2f0e4c], 0x949f9f9e
mov dword [0x2f0e50], 0x9e988592
mov dword [0x2f0e54], 0x9086d19f
mov dword [0x2f0e58], 0x9f98d182
mov dword [0x2f0e5c], 0x90988598
mov dword [0x2f0e60], 0x948b989d
mov dword [0x2f0e64], 0x9886d195
mov word [0x2f0e68], 0x9985
mov byte [0x2f0e6a], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0e20]
xor cl, 0xf1
mov byte [eax + 0x2f10d8], cl
inc eax
cmp eax, 0x4b
jb 0x2535e0
mov eax, 0x2f10d8
ret

Function at 0x2535fb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2780], 1
jne 0x253651
or dword [0x2f2780], 1
mov dword [0x2f0e6c], 0xb99f98a6
mov dword [0x2f0e70], 0xbe818585
mov dword [0x2f0e74], 0xa39f9481
mov dword [0x2f0e78], 0x94848094
mov dword [0x2f0e7c], 0xd8d98582
mov dword [0x2f0e80], 0x989097d1
mov dword [0x2f0e84], 0xf195949d
xor eax, eax
mov cl, byte [eax + 0x2f0e6c]
xor cl, 0xf1
mov byte [eax + 0x2f1124], cl
inc eax
cmp eax, 0x1c
jb 0x253653
mov eax, 0x2f1124
ret
Function at 0x25366e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f277c], 1
jne 0x25373d
or dword [0x2f277c], 1
mov dword [0x2f0e88], 0xb99f98a6
mov dword [0x2f0e8c], 0xa2818585
mov dword [0x2f0e90], 0x81be8594
mov dword [0x2f0e94], 0x9f9e9885
mov dword [0x2f0e98], 0xbfb8a6d9
mov dword [0x2f0e9c], 0xa1a5a5b9
mov dword [0x2f0ea0], 0xa5a1beae
mov dword [0x2f0ea4], 0xaebfbeb8
mov dword [0x2f0ea8], 0xa4b2b4a2
mov dword [0x2f0eac], 0xa8a5b8a3
mov dword [0x2f0eb0], 0xb0bdb7ae
mov dword [0x2f0eb4], 0xd1d8a2b6
mov dword [0x2f0eb8], 0x83d19f9e
mov dword [0x2f0ebc], 0x94848094
mov dword [0x2f0ec0], 0x99d18582
mov dword [0x2f0ec4], 0x9d959f90
mov dword [0x2f0ec8], 0x9097d194
mov dword [0x2f0ecc], 0x95949d98
mov byte [0x2f0ed0], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0e88]
xor cl, 0xf1
mov byte [eax + 0x2f1140], cl
inc eax
cmp eax, 0x49
jb 0x25373f
mov eax, 0x2f1140
ret

Function at 0x25375a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2778], 1
jne 0x253828
or dword [0x2f2778], 1
mov dword [0x2f0ed8], 0xb99f98a6
mov dword [0x2f0edc], 0xa2818585
mov dword [0x2f0ee0], 0x81be8594
mov dword [0x2f0ee4], 0x9f9e9885
mov dword [0x2f0ee8], 0xbfb8a6d9
mov dword [0x2f0eec], 0xa1a5a5b9
mov dword [0x2f0ef0], 0xa5a1beae
mov dword [0x2f0ef4], 0xaebfbeb8
mov dword [0x2f0ef8], 0xb5bfb4a2
mov dword [0x2f0efc], 0xbcb8a5ae
mov dword [0x2f0f00], 0xa5a4beb4
mov dword [0x2f0f04], 0x9f9ed1d8
mov dword [0x2f0f08], 0x809483d1
mov dword [0x2f0f0c], 0x85829484
mov dword [0x2f0f10], 0x9f9099d1
mov dword [0x2f0f14], 0xd1949d95
mov dword [0x2f0f18], 0x9d989097
mov word [0x2f0f1c], 0x9594
mov byte [0x2f0f1e], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0ed8]
xor cl, 0xf1
mov byte [eax + 0x2f1190], cl
inc eax
cmp eax, 0x47
jb 0x25382a
mov eax, 0x2f1190
ret

Function at 0x253845
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2774], 1
jne 0x2538ae
or dword [0x2f2774], 1
mov dword [0x2f0f20], 0xb99f98a6
mov dword [0x2f0f24], 0xb0818585
mov dword [0x2f0f28], 0x94a39595
mov dword [0x2f0f2c], 0x82948480
mov dword [0x2f0f30], 0x9094b985
mov dword [0x2f0f34], 0x82839495
mov dword [0x2f0f38], 0x97d1d8d9
mov dword [0x2f0f3c], 0x949d9890
mov word [0x2f0f40], 0xf195
xor eax, eax
mov cl, byte [eax + 0x2f0f20]
xor cl, 0xf1
mov byte [eax + 0x2f11d8], cl
inc eax
cmp eax, 0x22
jb 0x2538b0
mov eax, 0x2f11d8
ret

Function at 0x2538cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2770], 1
jne 0x25391e
or dword [0x2f2770], 1
mov dword [0x2f0f44], 0x818585b9
mov dword [0x2f0f48], 0x959f94a2
mov dword [0x2f0f4c], 0x848094a3
mov dword [0x2f0f50], 0xd9858294
mov dword [0x2f0f54], 0x9097d1d8
mov dword [0x2f0f58], 0x95949d98
mov byte [0x2f0f5c], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0f44]
xor cl, 0xf1
mov byte [eax + 0x2f11fc], cl
inc eax
cmp eax, 0x19
jb 0x253920
mov eax, 0x2f11fc
ret
Function at 0x25393b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f276c], 1
jne 0x25398d
or dword [0x2f276c], 1
mov dword [0x2f0f60], 0x818585b9
mov dword [0x2f0f64], 0x839484a0
mov dword [0x2f0f68], 0x979fb888
mov dword [0x2f0f6c], 0xd1d8d99e
mov dword [0x2f0f70], 0x9d989097
mov word [0x2f0f74], 0x9594
mov byte [0x2f0f76], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0f60]
xor cl, 0xf1
mov byte [eax + 0x2f1218], cl
inc eax
cmp eax, 0x17
jb 0x25398f
mov eax, 0x2f1218
ret
Function at 0x25416d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2764], 1
jne 0x2541dd
or dword [0x2f2764], 1
mov dword [0x2f0f7c], 0xb99f98a6
mov dword [0x2f0f80], 0xa0818585
mov dword [0x2f0f84], 0x88839484
mov dword [0x2f0f88], 0x908590b5
mov dword [0x2f0f8c], 0x989087b0
mov dword [0x2f0f90], 0x9d93909d
mov dword [0x2f0f94], 0xd1d8d994
mov dword [0x2f0f98], 0x9d989097
mov word [0x2f0f9c], 0x9594
mov byte [0x2f0f9e], 0xf1
xor eax, eax
mov cl, byte [eax + 0x2f0f7c]
xor cl, 0xf1
mov byte [eax + 0x2f1234], cl
inc eax
cmp eax, 0x23
jb 0x2541df
mov eax, 0x2f1234
ret

Function at 0x2541fa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2760], 1
jne 0x25424f
or dword [0x2f2760], 1
mov dword [0x2f0fa0], 0x94859fb8
mov dword [0x2f0fa4], 0x85949f83
mov dword [0x2f0fa8], 0x959094a3
mov dword [0x2f0fac], 0x949d98b7
mov dword [0x2f0fb0], 0x97d1d8d9
mov dword [0x2f0fb4], 0x949d9890
mov word [0x2f0fb8], 0xf195
xor eax, eax
mov cl, byte [eax + 0x2f0fa0]
xor cl, 0xf1
mov byte [eax + 0x2f1258], cl
inc eax
cmp eax, 0x1a
jb 0x254251
mov eax, 0x2f1258
ret

Function at 0x255037
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2744], 1
jne 0x2550be
or dword [0x2f2744], 1
mov dword [0x2f1290], 0x87d29cb3
mov dword [0x2f1294], 0x9197809c
mov dword [0x2f1298], 0x9b9c959d
mov dword [0x2f129c], 0xd2969788
mov dword [0x2f12a0], 0x97999d86
mov dword [0x2f12a4], 0x9385d29c
mov dword [0x2f12a8], 0x9d94d281
mov dword [0x2f12ac], 0xd2969c87
mov dword [0x2f12b0], 0x91d28693
mov dword [0x2f12b4], 0x9380939a
mov dword [0x2f12b8], 0x80978691
mov word [0x2f12bc], 0xf2d2
xor eax, eax
mov cl, byte [eax + 0x2f1290]
xor cl, 0xf2
mov byte [eax + 0x2f13e0], cl
inc eax
cmp eax, 0x2e
jb 0x2550c0
mov eax, 0x2f13e0
ret
Function at 0x255504
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2740], 1
jne 0x255560
or dword [0x2f2740], 1
mov dword [0x2f12c0], 0x81819bbf
mov dword [0x2f12c4], 0xd2959c9b
mov dword [0x2f12c8], 0x979ed293
mov dword [0x2f12cc], 0x82d28694
mov dword [0x2f12d0], 0x9c978093
mov dword [0x2f12d4], 0x81979a86
mov word [0x2f12d8], 0x819b
mov byte [0x2f12da], 0xf2
xor eax, eax
mov cl, byte [eax + 0x2f12c0]
xor cl, 0xf2
mov byte [eax + 0x2f1410], cl
inc eax
cmp eax, 0x1b
jb 0x255562
mov eax, 0x2f1410
ret

Function at 0x25557d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f273c], 1
jne 0x2555e6
or dword [0x2f273c], 1
mov dword [0x2f12dc], 0xd2869dbc
mov dword [0x2f12e0], 0x879d9c97
mov dword [0x2f12e4], 0x9dd29a95
mov dword [0x2f12e8], 0x93809782
mov dword [0x2f12ec], 0xd281969c
mov dword [0x2f12f0], 0x97d29c9b
mov dword [0x2f12f4], 0x9780828a
mov dword [0x2f12f8], 0x9d9b8181
mov word [0x2f12fc], 0xf29c
xor eax, eax
mov cl, byte [eax + 0x2f12dc]
xor cl, 0xf2
mov byte [eax + 0x2f142c], cl
inc eax
cmp eax, 0x22
jb 0x2555e8
mov eax, 0x2f142c
ret

Function at 0x255603
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2738], 1
jne 0x255663
or dword [0x2f2738], 1
mov dword [0x2f1300], 0xd29d9da6
mov dword [0x2f1304], 0x8b9c939f
mov dword [0x2f1308], 0x97829dd2
mov dword [0x2f130c], 0x969c9380
mov dword [0x2f1310], 0x9c9bd281
mov dword [0x2f1314], 0x828a97d2
mov dword [0x2f1318], 0x81819780
mov dword [0x2f131c], 0xf29c9d9b
xor eax, eax
mov cl, byte [eax + 0x2f1300]
xor cl, 0xf2
mov byte [eax + 0x2f1450], cl
inc eax
cmp eax, 0x20
jb 0x255665
mov eax, 0x2f1450
ret

Function at 0x255680
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2734], 1
jne 0x2556d6
or dword [0x2f2734], 1
mov dword [0x2f1320], 0x81819bbf
mov dword [0x2f1324], 0xd2959c9b
mov dword [0x2f1328], 0x9b80d293
mov dword [0x2f132c], 0xd2869a95
mov dword [0x2f1330], 0x97809382
mov dword [0x2f1334], 0x979a869c
mov dword [0x2f1338], 0xf2819b81
xor eax, eax
mov cl, byte [eax + 0x2f1320]
xor cl, 0xf2
mov byte [eax + 0x2f1470], cl
inc eax
cmp eax, 0x1c
jb 0x2556d8
mov eax, 0x2f1470
ret

Function at 0x2556f3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2730], 1
jne 0x255764
or dword [0x2f2730], 1
mov dword [0x2f133c], 0x80939ca7
mov dword [0x2f1340], 0x829dd28b
mov dword [0x2f1344], 0x86938097
mov dword [0x2f1348], 0x9fd2809d
mov dword [0x2f134c], 0xd2868187
mov dword [0x2f1350], 0x9784939a
mov dword [0x2f1354], 0x979c9dd2
mov dword [0x2f1358], 0x97829dd2
mov dword [0x2f135c], 0x969c9380
mov byte [0x2f1360], 0xf2
xor eax, eax
mov cl, byte [eax + 0x2f133c]
xor cl, 0xf2
mov byte [eax + 0x2f148c], cl
inc eax
cmp eax, 0x25
jb 0x255766
mov eax, 0x2f148c
ret
Function at 0x255781
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f272c], 1
jne 0x2557fb
or dword [0x2f272c], 1
mov dword [0x2f1364], 0x939c9bb0
mov dword [0x2f1368], 0x9dd28b80
mov dword [0x2f136c], 0x93809782
mov dword [0x2f1370], 0xd2809d86
mov dword [0x2f1374], 0x8681879f
mov dword [0x2f1378], 0x84939ad2
mov dword [0x2f137c], 0x8586d297
mov dword [0x2f1380], 0x829dd29d
mov dword [0x2f1384], 0x9c938097
mov word [0x2f1388], 0x8196
mov byte [0x2f138a], 0xf2
xor eax, eax
mov cl, byte [eax + 0x2f1364]
xor cl, 0xf2
mov byte [eax + 0x2f14b4], cl
inc eax
cmp eax, 0x27
jb 0x2557fd
mov eax, 0x2f14b4
ret

Function at 0x255818
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2728], 1
jne 0x255881
or dword [0x2f2728], 1
mov dword [0x2f138c], 0x939c9bb0
mov dword [0x2f1390], 0x9dd28b80
mov dword [0x2f1394], 0x93809782
mov dword [0x2f1398], 0xd2809d86
mov dword [0x2f139c], 0xd2869d9c
mov dword [0x2f13a0], 0x9e829f9b
mov dword [0x2f13a4], 0x9c979f97
mov dword [0x2f13a8], 0xc8969786
mov word [0x2f13ac], 0xf2d2
xor eax, eax
mov cl, byte [eax + 0x2f138c]
xor cl, 0xf2
mov byte [eax + 0x2f14dc], cl
inc eax
cmp eax, 0x22
jb 0x255883
mov eax, 0x2f14dc
ret
Function at 0x257233
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x257275
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x2dbe18]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x2dbe18]
inc edx
cmp dword [ebp + 8], 0
jne 0x257240
pop esi
not eax
pop ebp
ret

Function at 0x258ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x258ee5
cmp dword [ecx + 0x38], ebx
je 0x258ee5
cmp eax, dword [ecx + 0x10]
jae 0x258ee5
cmp dword [ecx + 0x14], 1
jne 0x258ee5
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x258ee7
xor edi, edi
cmp edi, ebx
je 0x258fca
cmp esi, ebx
je 0x258fca
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00258669
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x258f76
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00297030
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x258f9b
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00297030
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x258fcc
xor eax, eax
pop edi
pop ebx
ret

Function at 0x2599fc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f271c], 1
jne 0x259a81
or dword [0x2f271c], 1
mov dword [0x2f1518], 0x989d95b2
mov dword [0x2f151c], 0x80d49091
mov dword [0x2f1520], 0x8697d49b
mov dword [0x2f1524], 0x91809591
mov dword [0x2f1528], 0x958198d4
mov dword [0x2f152c], 0x958087d4
mov dword [0x2f1530], 0xdcd49180
mov dword [0x2f1534], 0x9f869b83
mov dword [0x2f1538], 0x80d48691
mov dword [0x2f153c], 0x9591869c
mov dword [0x2f1540], 0xd4cedd90
mov byte [0x2f1544], 0xf4
xor eax, eax
mov cl, byte [eax + 0x2f1518]
xor cl, 0xf4
mov byte [eax + 0x2f15e0], cl
inc eax
cmp eax, 0x2d
jb 0x259a83
mov eax, 0x2f15e0
ret
Function at 0x259a9e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f270c], 1
jne 0x259b05
or dword [0x2f270c], 1
mov dword [0x2f1554], 0x91d49bba
mov dword [0x2f1558], 0x869b8686
mov dword [0x2f155c], 0x879199d4
mov dword [0x2f1560], 0x91939587
mov dword [0x2f1564], 0x809186d4
mov dword [0x2f1568], 0x919a8681
mov dword [0x2f156c], 0x8d96d490
mov dword [0x2f1570], 0x969b9ed4
mov byte [0x2f1574], 0xf4
xor eax, eax
mov cl, byte [eax + 0x2f1554]
xor cl, 0xf4
mov byte [eax + 0x2f161c], cl
inc eax
cmp eax, 0x21
jb 0x259b07
mov eax, 0x2f161c
ret

Function at 0x259b22
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2700], 1
jne 0x259b8b
or dword [0x2f2700], 1
mov dword [0x2f15a0], 0xd49581b8
mov dword [0x2f15a4], 0x9b868691
mov dword [0x2f15a8], 0x8186d486
mov dword [0x2f15ac], 0x9a9d9a9a
mov dword [0x2f15b0], 0x8691d493
mov dword [0x2f15b4], 0xd4869b86
mov dword [0x2f15b8], 0x909a959c
mov dword [0x2f15bc], 0xce869198
mov word [0x2f15c0], 0xf4d4
xor eax, eax
mov cl, byte [eax + 0x2f15a0]
xor cl, 0xf4
mov byte [eax + 0x2f1668], cl
inc eax
cmp eax, 0x22
jb 0x259b8d
mov eax, 0x2f1668
ret

Function at 0x259ba8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f26fc], 1
jne 0x259bfa
or dword [0x2f26fc], 1
mov dword [0x2f15c4], 0xb8958198
mov dword [0x2f15c8], 0x959b98ab
mov dword [0x2f15cc], 0x86808790
mov dword [0x2f15d0], 0xd4939a9d
mov dword [0x2f15d4], 0x989d9592
mov word [0x2f15d8], 0x9091
mov byte [0x2f15da], 0xf4
xor eax, eax
mov cl, byte [eax + 0x2f15c4]
xor cl, 0xf4
mov byte [eax + 0x2f168c], cl
inc eax
cmp eax, 0x17
jb 0x259bfc
mov eax, 0x2f168c
ret
Function at 0x25a918
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2badac
call fcn.002b9c88
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x2c212c]
test eax, eax
jne 0x25a960
call fcn.0025aab9
mov ecx, dword [ebp + 8]
push eax
call fcn.00236aa3
mov eax, dword [ebp + 8]
jmp 0x25aaaa
test byte [0x2f26f0], 1
jne 0x25a981
or dword [0x2f26f0], 1
mov dword [0x2f16c8], 0xd6fcfbff
mov byte [0x2f16cc], 0xf6
xor eax, eax
mov cl, byte [eax + 0x2f16c8]
xor cl, 0xf6
mov byte [eax + 0x2f1e9c], cl
inc eax
cmp eax, 5
jb 0x25a983
push 0xf
mov esi, 0x2f1e9c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x25a9ae
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00234c4f
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00234cc4
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0025fdd2
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00234ce5
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00234ce5
push dword [ebp - 0x10]
call dword [0x2c20e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0025ae04
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0025ab22
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00236ae0
add esp, 0xc
push 0x2dd290
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0023d6c1
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0023b5e6
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00234ce5
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00234ce5
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00234ce5
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00234c05
push ebx
push 1
mov ecx, esi
call fcn.00234ce5
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x25aab9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f26f4], 1
jne 0x25ab05
or dword [0x2f26f4], 1
mov dword [0x2f16b0], 0x938498a3
mov dword [0x2f16b4], 0x98919995
mov dword [0x2f16b8], 0x92938c9f
mov dword [0x2f16bc], 0x848493d6
mov dword [0x2f16c0], 0x95d68499
mov dword [0x2f16c4], 0xf6939299
xor eax, eax
mov cl, byte [eax + 0x2f16b0]
xor cl, 0xf6
mov byte [eax + 0x2f1e84], cl
inc eax
cmp eax, 0x18
jb 0x25ab07
mov eax, 0x2f1e84
ret

Function at 0x25ab22
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f26ec], 1
jne 0x25ab60
or dword [0x2f26ec], 1
mov dword [0x2f16d0], 0x8493ded6
mov dword [0x2f16d4], 0xd6849984
mov dword [0x2f16d8], 0x93929995
mov word [0x2f16dc], 0xd6cc
mov byte [0x2f16de], 0xf6
xor eax, eax
mov cl, byte [eax + 0x2f16d0]
xor cl, 0xf6
mov byte [eax + 0x2f1ea4], cl
inc eax
cmp eax, 0xf
jb 0x25ab62
mov eax, 0x2f1ea4
ret
Function at 0x25ae04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x2f26e8], 1
jne 0x25ae2f
or dword [0x2f26e8], 1
mov dword [0x2f16e0], 0x929a9ad3
mov byte [0x2f16e4], 0xf6
xor eax, eax
mov cl, byte [eax + 0x2f16e0]
xor cl, 0xf6
mov byte [eax + 0x2f1eb4], cl
inc eax
cmp eax, 5
jb 0x25ae31
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x2f1eb4
push eax
call fcn.0025fe2b
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00234cc4
mov eax, esi
leave
ret

Function at 0x25afd3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f26e4], 1
jne 0x25b02f
or dword [0x2f26e4], 1
mov dword [0x2f16e8], 0xbb8293b1
mov dword [0x2f16ec], 0x9a839299
mov dword [0x2f16f0], 0x9a9fb093
mov dword [0x2f16f4], 0x9b97b893
mov dword [0x2f16f8], 0x9790d693
mov dword [0x2f16fc], 0x92939a9f
mov word [0x2f1700], 0xd6cc
mov byte [0x2f1702], 0xf6
xor eax, eax
mov cl, byte [eax + 0x2f16e8]
xor cl, 0xf6
mov byte [eax + 0x2f1ebc], cl
inc eax
cmp eax, 0x1b
jb 0x25b031
mov eax, 0x2f1ebc
ret

Function at 0x25b04c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f26e0], 1
jne 0x25b0a9
or dword [0x2f26e0], 1
mov dword [0x2f1704], 0xb58293a5
mov dword [0x2f1708], 0x93848483
mov dword [0x2f170c], 0x9fb28298
mov dword [0x2f1710], 0x82959384
mov dword [0x2f1714], 0xd68f8499
mov dword [0x2f1718], 0x9a9f9790
mov dword [0x2f171c], 0xd6cc9293
mov byte [0x2f1720], 0xf6
xor eax, eax
mov cl, byte [eax + 0x2f1704]
xor cl, 0xf6
mov byte [eax + 0x2f1ed8], cl
inc eax
cmp eax, 0x1d
jb 0x25b0ab
mov eax, 0x2f1ed8
ret

Function at 0x25b1bd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f26dc], 1
jne 0x25b21a
or dword [0x2f26dc], 1
mov dword [0x2f1724], 0xb58293b1
mov dword [0x2f1728], 0x93848483
mov dword [0x2f172c], 0x9fb28298
mov dword [0x2f1730], 0x82959384
mov dword [0x2f1734], 0xd68f8499
mov dword [0x2f1738], 0x9a9f9790
mov dword [0x2f173c], 0xd6cc9293
mov byte [0x2f1740], 0xf6
xor eax, eax
mov cl, byte [eax + 0x2f1724]
xor cl, 0xf6
mov byte [eax + 0x2f1ef8], cl
inc eax
cmp eax, 0x1d
jb 0x25b21c
mov eax, 0x2f1ef8
ret