joyce8/EMBER2024-capa huggingface dataset:
Function at 0x32d5e5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2674], 1
jne 0x32d692
or dword [0x3c2674], 1
mov eax, 0x836e
mov word [0x3c1a90], ax
dec eax
mov word [0x3c1a92], ax
mov ecx, 0x8363
push ebx
mov eax, ecx
mov word [0x3c1a94], ax
add eax, 0x1c
push esi
mov word [0x3c1a96], ax
lea esi, [ecx + 0x16]
mov eax, esi
mov word [0x3c1a98], ax
add eax, 0xffffffec
mov word [0x3c1a9a], ax
lea edx, [ecx + 0x10]
mov eax, edx
mov word [0x3c1a9c], ax
inc eax
mov ebx, eax
mov word [0x3c1a9e], bx
mov word [0x3c1aa0], bx
mov ebx, ecx
mov word [0x3c1aa2], bx
add ebx, 5
mov word [0x3c1ab0], ax
lea eax, [ecx - 0x3d]
pop esi
mov word [0x3c1aa4], bx
mov dword [0x3c1aa6], 0x83798372
mov word [0x3c1aaa], dx
mov dword [0x3c1aac], 0x83638375
mov word [0x3c1ab2], ax
pop ebx
xor eax, eax
mov ecx, 0x8326
xor cx, word [eax + 0x3c1a90]
add eax, 2
mov word [eax + 0x3c2256], cx
cmp eax, 0x24
jb 0x32d694
mov eax, 0x3c2258
ret

Function at 0x32d6b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2670], 1
mov edx, 0x8326
jne 0x32d727
or dword [0x3c2670], 1
lea eax, [edx + 0x48]
mov word [0x3c1ab4], ax
dec eax
mov word [0x3c1ab6], ax
lea ecx, [edx + 0x3d]
mov eax, ecx
mov word [0x3c1ab8], ax
add eax, 0x1c
mov word [0x3c1aba], ax
lea eax, [edx + 0x53]
mov word [0x3c1abc], ax
add eax, 0xfffffffa
mov word [0x3c1abe], ax
lea eax, [edx + 0x4f]
push esi
mov esi, eax
mov eax, edx
mov word [0x3c1ac0], si
mov word [0x3c1ac2], cx
mov dword [0x3c1ac4], 0x83758374
mov word [0x3c1ac8], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x3c1ab4]
add eax, 2
mov word [eax + 0x3c227a], cx
cmp eax, 0x16
jb 0x32d729
mov eax, 0x3c227c
ret

Function at 0x32d747
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c266c], 1
jne 0x32d807
or dword [0x3c266c], 1
push ebx
mov eax, 0x836e
mov word [0x3c1acc], ax
dec eax
mov word [0x3c1ace], ax
push esi
mov esi, 0x8363
mov eax, esi
mov word [0x3c1ad0], ax
add eax, 0x1c
mov word [0x3c1ad2], ax
lea edx, [esi + 0x16]
lea ecx, [esi + 2]
mov eax, edx
mov word [0x3c1ad4], ax
mov eax, ecx
mov word [0x3c1ad6], ax
add eax, 0xe
mov word [0x3c1ad8], ax
lea eax, [esi + 0x11]
mov ebx, eax
add eax, 0xfffffff4
mov esi, eax
lea eax, [edx - 0x19]
mov word [0x3c1aec], ax
add eax, 0xf
mov word [0x3c1aee], ax
lea eax, [edx - 0x18]
mov word [0x3c1ae0], si
mov word [0x3c1af0], ax
add eax, 0xffffffc5
pop esi
mov word [0x3c1ada], bx
mov dword [0x3c1adc], 0x83638374
mov dword [0x3c1ae2], 0x83798372
mov word [0x3c1ae6], cx
mov dword [0x3c1ae8], 0x83688369
mov word [0x3c1af2], ax
pop ebx
xor eax, eax
mov ecx, 0x8326
xor cx, word [eax + 0x3c1acc]
add eax, 2
mov word [eax + 0x3c2292], cx
cmp eax, 0x28
jb 0x32d809
mov eax, 0x3c2294
ret
Function at 0x32d82a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2668], 1
jne 0x32d8d9
or dword [0x3c2668], 1
mov eax, 0x836e
mov word [0x3c1af4], ax
dec eax
mov word [0x3c1af6], ax
mov edx, 0x8363
mov eax, edx
mov word [0x3c1af8], ax
add eax, 0x1c
mov word [0x3c1afa], ax
lea ecx, [edx + 0x16]
mov eax, ecx
mov word [0x3c1afc], ax
add eax, 0xffffffec
mov word [0x3c1afe], ax
lea eax, [edx + 7]
mov word [0x3c1b00], ax
add eax, 0xfffffffd
mov word [0x3c1b02], ax
lea eax, [edx + 0x12]
push edi
mov edi, eax
add eax, 0xfffffff4
mov ecx, eax
mov word [0x3c1b12], ax
lea eax, [edx + 0xf]
mov word [0x3c1b14], ax
add eax, 0xffffffb4
mov word [0x3c1b04], di
mov word [0x3c1b06], di
mov dword [0x3c1b08], 0x83758363
mov dword [0x3c1b0c], 0x83748379
mov word [0x3c1b10], cx
mov word [0x3c1b16], ax
pop edi
xor eax, eax
mov ecx, 0x8326
xor cx, word [eax + 0x3c1af4]
add eax, 2
mov word [eax + 0x3c22ba], cx
cmp eax, 0x24
jb 0x32d8db
mov eax, 0x3c22bc
ret

Function at 0x32dca7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2650], 1
jne 0x32dcfc
or dword [0x3c2650], 1
mov dword [0x3c1ba0], 0x65414374
mov dword [0x3c1ba4], 0x52474354
mov dword [0x3c1ba8], 0x5f436d43
mov dword [0x3c1bac], 0xf0e5e63
mov dword [0x3c1bb0], 0x4f474006
mov dword [0x3c1bb4], 0x1c42434a
mov word [0x3c1bb8], 0x2606
xor eax, eax
mov cl, byte [eax + 0x3c1ba0]
xor cl, 0x26
mov byte [eax + 0x3c2318], cl
inc eax
cmp eax, 0x1a
jb 0x32dcfe
mov eax, 0x3c2318
ret

Function at 0x32ddde
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c264c], 1
jne 0x32de44
or dword [0x3c264c], 1
mov dword [0x3c1bbc], 0x4b534863
mov dword [0x3c1bc0], 0x52475443
mov dword [0x3c1bc4], 0x648494f
mov dword [0x3c1bc8], 0x4342484f
mov dword [0x3c1bcc], 0x5349065e
mov dword [0x3c1bd0], 0x40490652
mov dword [0x3c1bd4], 0x48475406
mov word [0x3c1bd8], 0x4341
mov byte [0x3c1bda], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1bbc]
xor cl, 0x26
mov byte [eax + 0x3c2334], cl
inc eax
cmp eax, 0x1f
jb 0x32de46
mov eax, 0x3c2334
ret

Function at 0x32de61
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2648], 1
jne 0x32dead
or dword [0x3c2648], 1
mov dword [0x3c1bdc], 0x63414374
mov dword [0x3c1be0], 0x6d4b5348
mov dword [0x3c1be4], 0x5e635f43
mov dword [0x3c1be8], 0x40060f0e
mov dword [0x3c1bec], 0x434a4f47
mov dword [0x3c1bf0], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1bdc]
xor cl, 0x26
mov byte [eax + 0x3c2354], cl
inc eax
cmp eax, 0x18
jb 0x32deaf
mov eax, 0x3c2354
ret

Function at 0x32e012
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2644], 1
jne 0x32e047
or dword [0x3c2644], 1
mov dword [0x3c1bf4], 0x4a4a5368
mov dword [0x3c1bf8], 0x48494506
mov dword [0x3c1bfc], 0x525e4352
mov byte [0x3c1c00], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1bf4]
xor cl, 0x26
mov byte [eax + 0x3c236c], cl
inc eax
cmp eax, 0xd
jb 0x32e049
mov eax, 0x3c236c
ret
Function at 0x32e064
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2640], 1
jne 0x32e0b0
or dword [0x3c2640], 1
mov dword [0x3c1c04], 0x69414374
mov dword [0x3c1c08], 0x6d484356
mov dword [0x3c1c0c], 0x5e635f43
mov dword [0x3c1c10], 0x40060f0e
mov dword [0x3c1c14], 0x434a4f47
mov dword [0x3c1c18], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1c04]
xor cl, 0x26
mov byte [eax + 0x3c237c], cl
inc eax
cmp eax, 0x18
jb 0x32e0b2
mov eax, 0x3c237c
ret

Function at 0x32e0cd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c263c], 1
jne 0x32e129
or dword [0x3c263c], 1
mov dword [0x3c1c1c], 0x77414374
mov dword [0x3c1c20], 0x5f544353
mov dword [0x3c1c24], 0x4940486f
mov dword [0x3c1c28], 0xe5f436d
mov dword [0x3c1c2c], 0x4740060f
mov dword [0x3c1c30], 0x42434a4f
mov word [0x3c1c34], 0x61c
mov byte [0x3c1c36], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1c1c]
xor cl, 0x26
mov byte [eax + 0x3c2394], cl
inc eax
cmp eax, 0x1b
jb 0x32e12b
mov eax, 0x3c2394
ret

Function at 0x32e21c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2638], 1
jne 0x32e282
or dword [0x3c2638], 1
mov dword [0x3c1c38], 0x4b534863
mov dword [0x3c1c3c], 0x52475443
mov dword [0x3c1c40], 0x648494f
mov dword [0x3c1c44], 0x4342484f
mov dword [0x3c1c48], 0x5349065e
mov dword [0x3c1c4c], 0x40490652
mov dword [0x3c1c50], 0x48475406
mov word [0x3c1c54], 0x4341
mov byte [0x3c1c56], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1c38]
xor cl, 0x26
mov byte [eax + 0x3c23b0], cl
inc eax
cmp eax, 0x1f
jb 0x32e284
mov eax, 0x3c23b0
ret

Function at 0x32e29f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2634], 1
jne 0x32e2fb
or dword [0x3c2634], 1
mov dword [0x3c1c58], 0x77414374
mov dword [0x3c1c5c], 0x5f544353
mov dword [0x3c1c60], 0x4940486f
mov dword [0x3c1c64], 0xe5f436d
mov dword [0x3c1c68], 0x4740060f
mov dword [0x3c1c6c], 0x42434a4f
mov word [0x3c1c70], 0x61c
mov byte [0x3c1c72], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1c58]
xor cl, 0x26
mov byte [eax + 0x3c23d0], cl
inc eax
cmp eax, 0x1b
jb 0x32e2fd
mov eax, 0x3c23d0
ret

Function at 0x32e45d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2630], 1
jne 0x32e492
or dword [0x3c2630], 1
mov dword [0x3c1c74], 0x4a4a5368
mov dword [0x3c1c78], 0x48494506
mov dword [0x3c1c7c], 0x525e4352
mov byte [0x3c1c80], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1c74]
xor cl, 0x26
mov byte [eax + 0x3c23ec], cl
inc eax
cmp eax, 0xd
jb 0x32e494
mov eax, 0x3c23ec
ret

Function at 0x32e4af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c262c], 1
jne 0x32e4fb
or dword [0x3c262c], 1
mov dword [0x3c1c84], 0x69414374
mov dword [0x3c1c88], 0x6d484356
mov dword [0x3c1c8c], 0x5e635f43
mov dword [0x3c1c90], 0x40060f0e
mov dword [0x3c1c94], 0x434a4f47
mov dword [0x3c1c98], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1c84]
xor cl, 0x26
mov byte [eax + 0x3c23fc], cl
inc eax
cmp eax, 0x18
jb 0x32e4fd
mov eax, 0x3c23fc
ret
Function at 0x32e518
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2628], 1
jne 0x32e574
or dword [0x3c2628], 1
mov dword [0x3c1c9c], 0x77414374
mov dword [0x3c1ca0], 0x5f544353
mov dword [0x3c1ca4], 0x4940486f
mov dword [0x3c1ca8], 0xe5f436d
mov dword [0x3c1cac], 0x4740060f
mov dword [0x3c1cb0], 0x42434a4f
mov word [0x3c1cb4], 0x61c
mov byte [0x3c1cb6], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1c9c]
xor cl, 0x26
mov byte [eax + 0x3c2414], cl
inc eax
cmp eax, 0x1b
jb 0x32e576
mov eax, 0x3c2414
ret

Function at 0x32e822
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2624], 1
mov ecx, 0x8326
jne 0x32e890
or dword [0x3c2624], 1
lea eax, [ecx - 0x18]
mov word [0x3c1cb8], ax
add eax, 0x54
mov word [0x3c1cba], ax
lea eax, [ecx + 0x1d]
mov word [0x3c1cbc], ax
add eax, 0xfffffffd
mov word [0x3c1cbe], ax
lea eax, [ecx + 0x21]
mov word [0x3c1cc0], ax
add eax, 0xc
mov word [0x3c1cc2], ax
lea eax, [ecx + 0x24]
mov word [0x3c1cc4], ax
add eax, 8
mov word [0x3c1cc6], ax
lea eax, [ecx - 0x17]
mov word [0x3c1cc8], ax
mov eax, ecx
mov word [0x3c1cca], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x3c1cb8]
add eax, 2
mov word [eax + 0x3c242e], dx
cmp eax, 0x14
jb 0x32e892
mov eax, 0x3c2430
ret

Function at 0x32e8b0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2620], 1
mov ecx, 0x8326
jne 0x32e91e
or dword [0x3c2620], 1
lea eax, [ecx - 0x18]
mov word [0x3c1ccc], ax
add eax, 0x34
mov word [0x3c1cce], ax
lea eax, [ecx + 0x1d]
mov word [0x3c1cd0], ax
add eax, 0xfffffffd
mov word [0x3c1cd2], ax
lea eax, [ecx + 0x21]
mov word [0x3c1cd4], ax
add eax, 0xc
mov word [0x3c1cd6], ax
lea eax, [ecx + 0x24]
mov word [0x3c1cd8], ax
add eax, 8
mov word [0x3c1cda], ax
lea eax, [ecx - 0x17]
mov word [0x3c1cdc], ax
mov eax, ecx
mov word [0x3c1cde], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x3c1ccc]
add eax, 2
mov word [eax + 0x3c2442], dx
cmp eax, 0x14
jb 0x32e920
mov eax, 0x3c2444
ret

Function at 0x32e93e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c261c], 1
jne 0x32e98a
or dword [0x3c261c], 1
mov dword [0x3c1ce0], 0x69414374
mov dword [0x3c1ce4], 0x6d484356
mov dword [0x3c1ce8], 0x5e635f43
mov dword [0x3c1cec], 0x40060f0e
mov dword [0x3c1cf0], 0x434a4f47
mov dword [0x3c1cf4], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1ce0]
xor cl, 0x26
mov byte [eax + 0x3c2458], cl
inc eax
cmp eax, 0x18
jb 0x32e98c
mov eax, 0x3c2458
ret

Function at 0x32e9a7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2618], 1
jne 0x32ea03
or dword [0x3c2618], 1
mov dword [0x3c1cf8], 0x77414374
mov dword [0x3c1cfc], 0x5f544353
mov dword [0x3c1d00], 0x534a4770
mov dword [0x3c1d04], 0xe5e6343
mov dword [0x3c1d08], 0x4740060f
mov dword [0x3c1d0c], 0x42434a4f
mov word [0x3c1d10], 0x61c
mov byte [0x3c1d12], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1cf8]
xor cl, 0x26
mov byte [eax + 0x3c2470], cl
inc eax
cmp eax, 0x1b
jb 0x32ea05
mov eax, 0x3c2470
ret
Function at 0x32ea20
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2614], 1
jne 0x32ea7c
or dword [0x3c2614], 1
mov dword [0x3c1d14], 0x77414374
mov dword [0x3c1d18], 0x5f544353
mov dword [0x3c1d1c], 0x534a4770
mov dword [0x3c1d20], 0xe5e6343
mov dword [0x3c1d24], 0x4740060f
mov dword [0x3c1d28], 0x42434a4f
mov word [0x3c1d2c], 0x61c
mov byte [0x3c1d2e], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1d14]
xor cl, 0x26
mov byte [eax + 0x3c248c], cl
inc eax
cmp eax, 0x1b
jb 0x32ea7e
mov eax, 0x3c248c
ret

Function at 0x32ebf8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2610], 1
jne 0x32ec44
or dword [0x3c2610], 1
mov dword [0x3c1d30], 0x69414374
mov dword [0x3c1d34], 0x6d484356
mov dword [0x3c1d38], 0x5e635f43
mov dword [0x3c1d3c], 0x40060f0e
mov dword [0x3c1d40], 0x434a4f47
mov dword [0x3c1d44], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1d30]
xor cl, 0x26
mov byte [eax + 0x3c24a8], cl
inc eax
cmp eax, 0x18
jb 0x32ec46
mov eax, 0x3c24a8
ret

Function at 0x32ec61
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c260c], 1
jne 0x32ecc7
or dword [0x3c260c], 1
mov dword [0x3c1d48], 0x75414374
mov dword [0x3c1d4c], 0x47705243
mov dword [0x3c1d50], 0x6343534a
mov dword [0x3c1d54], 0x52550e5e
mov dword [0x3c1d58], 0x41484f54
mov dword [0x3c1d5c], 0x4740060f
mov dword [0x3c1d60], 0x42434a4f
mov word [0x3c1d64], 0x61c
mov byte [0x3c1d66], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1d48]
xor cl, 0x26
mov byte [eax + 0x3c24c0], cl
inc eax
cmp eax, 0x1f
jb 0x32ecc9
mov eax, 0x3c24c0
ret

Function at 0x32ee33
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2608], 1
jne 0x32ee7f
or dword [0x3c2608], 1
mov dword [0x3c1d68], 0x69414374
mov dword [0x3c1d6c], 0x6d484356
mov dword [0x3c1d70], 0x5e635f43
mov dword [0x3c1d74], 0x40060f0e
mov dword [0x3c1d78], 0x434a4f47
mov dword [0x3c1d7c], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1d68]
xor cl, 0x26
mov byte [eax + 0x3c24e0], cl
inc eax
cmp eax, 0x18
jb 0x32ee81
mov eax, 0x3c24e0
ret

Function at 0x32ee9c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2604], 1
jne 0x32eefb
or dword [0x3c2604], 1
mov dword [0x3c1d80], 0x75414374
mov dword [0x3c1d84], 0x47705243
mov dword [0x3c1d88], 0x6343534a
mov dword [0x3c1d8c], 0x51420e5e
mov dword [0x3c1d90], 0xf425449
mov dword [0x3c1d94], 0x4f474006
mov dword [0x3c1d98], 0x1c42434a
mov word [0x3c1d9c], 0x2606
xor eax, eax
mov cl, byte [eax + 0x3c1d80]
xor cl, 0x26
mov byte [eax + 0x3c24f8], cl
inc eax
cmp eax, 0x1e
jb 0x32eefd
mov eax, 0x3c24f8
ret

Function at 0x32f068
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2600], 1
jne 0x32f0e2
or dword [0x3c2600], 1
mov dword [0x3c1da0], 0x5255536b
mov dword [0x3c1da4], 0x43565506
mov dword [0x3c1da8], 0x5f404f45
mov dword [0x3c1dac], 0x48064706
mov dword [0x3c1db0], 0x430b4849
mov dword [0x3c1db4], 0x5f52564b
mov dword [0x3c1db8], 0x44535506
mov dword [0x3c1dbc], 0x65f434d
mov dword [0x3c1dc0], 0x4f545255
mov word [0x3c1dc4], 0x4148
mov byte [0x3c1dc6], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1da0]
xor cl, 0x26
mov byte [eax + 0x3c2518], cl
inc eax
cmp eax, 0x27
jb 0x32f0e4
mov eax, 0x3c2518
ret
Function at 0x32f0ff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c25fc], 1
jne 0x32f14b
or dword [0x3c25fc], 1
mov dword [0x3c1dc8], 0x69414374
mov dword [0x3c1dcc], 0x6d484356
mov dword [0x3c1dd0], 0x5e635f43
mov dword [0x3c1dd4], 0x40060f0e
mov dword [0x3c1dd8], 0x434a4f47
mov dword [0x3c1ddc], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1dc8]
xor cl, 0x26
mov byte [eax + 0x3c2540], cl
inc eax
cmp eax, 0x18
jb 0x32f14d
mov eax, 0x3c2540
ret

Function at 0x32f168
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c25f8], 1
jne 0x32f1ba
or dword [0x3c25f8], 1
mov dword [0x3c1de0], 0x43626e75
mov dword [0x3c1de4], 0x4352434a
mov dword [0x3c1de8], 0xe5f436d
mov dword [0x3c1dec], 0x4740060f
mov dword [0x3c1df0], 0x42434a4f
mov word [0x3c1df4], 0x61c
mov byte [0x3c1df6], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1de0]
xor cl, 0x26
mov byte [eax + 0x3c2558], cl
inc eax
cmp eax, 0x17
jb 0x32f1bc
mov eax, 0x3c2558
ret

Function at 0x32f309
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c25f4], 1
jne 0x32f355
or dword [0x3c25f4], 1
mov dword [0x3c1df8], 0x69414374
mov dword [0x3c1dfc], 0x6d484356
mov dword [0x3c1e00], 0x5e635f43
mov dword [0x3c1e04], 0x40060f0e
mov dword [0x3c1e08], 0x434a4f47
mov dword [0x3c1e0c], 0x26061c42
xor eax, eax
mov cl, byte [eax + 0x3c1df8]
xor cl, 0x26
mov byte [eax + 0x3c2570], cl
inc eax
cmp eax, 0x18
jb 0x32f357
mov eax, 0x3c2570
ret

Function at 0x32f372
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c25f0], 1
jne 0x32f3c5
or dword [0x3c25f0], 1
mov dword [0x3c1e10], 0x43626e75
mov dword [0x3c1e14], 0x4352434a
mov dword [0x3c1e18], 0x534a4770
mov dword [0x3c1e1c], 0x60f0e43
mov dword [0x3c1e20], 0x4a4f4740
mov dword [0x3c1e24], 0x61c4243
mov byte [0x3c1e28], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1e10]
xor cl, 0x26
mov byte [eax + 0x3c2588], cl
inc eax
cmp eax, 0x19
jb 0x32f3c7
mov eax, 0x3c2588
ret

Function at 0x32f69e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c25ec], 1
jne 0x32f759
or dword [0x3c25ec], 1
mov dword [0x3c1e30], 0x62656467
mov dword [0x3c1e34], 0x6e616063
mov dword [0x3c1e38], 0x6a6d6c6f
mov dword [0x3c1e3c], 0x7669686b
mov dword [0x3c1e40], 0x72757477
mov dword [0x3c1e44], 0x7e717073
mov dword [0x3c1e48], 0x44477c7f
mov dword [0x3c1e4c], 0x40434245
mov dword [0x3c1e50], 0x4c4f4e41
mov dword [0x3c1e54], 0x484b4a4d
mov dword [0x3c1e58], 0x54575649
mov dword [0x3c1e5c], 0x50535255
mov dword [0x3c1e60], 0x5c5f5e51
mov dword [0x3c1e64], 0x15141716
mov dword [0x3c1e68], 0x11101312
mov dword [0x3c1e6c], 0x90d1f1e
mov byte [0x3c1e70], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1e30]
xor cl, 0x26
mov byte [eax + 0x3c25a8], cl
inc eax
cmp eax, 0x41
jb 0x32f75b
mov eax, 0x3c25a8
ret
Function at 0x32f806
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0x32f830
mov dword [esi], eax
xor al, al
jmp 0x32f908
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0x3bc9b8]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0x32f8ac
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0x32f85a
cmp edx, dword [ebp + 8]
jae 0x32f8fb
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0x32f8c0
movzx edi, byte [edi + 1]
jmp 0x32f8c2
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0x32f8ef
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0x32f8f1
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x338bc0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
mov eax, dword [eax + 0x1f0]
test cl, cl
je 0x338be2
lea esp, [esp]
imul eax, eax, 0xf4243
movzx ecx, cl
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x338bd0
ret
Function at 0x349550
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x349640
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x349659
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x3496b2
cmp eax, edx
jae 0x34969e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x349690
lea edx, [esi + 0x20]
push esi
call fcn.00349050
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x3496cf
jmp 0x3496c0
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x3496c0
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.00349050
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x349de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x349f34
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x349f34
test eax, eax
js 0x349f34
mov eax, dword [esi + 0x234]
push eax
call fcn.0034dde0
add esp, 4
test eax, eax
jne 0x349f39
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x349e3a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x349e95
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x349e8e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x349e54
push ebx
push esi
call fcn.0034dd50
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x349e52
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x349e98
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x349f2d
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x349f23
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x349ee0
push edi
push esi
call fcn.0034dd50
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x349eb0
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret