joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470777
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x498224
je 0x470833
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47081b
mov esi, dword [ebx + 4]
jmp 0x470815
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x470805
cmp dword [ebp - 0xc], 4
jne 0x470805
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4707fd
or dword [eax + 0x9c], ecx
jmp 0x470805
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x4707c9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x4707ac
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x470bed
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x475d03
call fcn.0043c964
sub esp, 0x11c
mov eax, dword [0x498f70]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x470ce6
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x470cba
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00409040
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00470bed
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00406a30
test bl, bl
jne 0x470cba
or dword [ebp - 4], 0xffffffff
jmp 0x470c2b
cmp esi, 0x103
je 0x470cca
cmp esi, 0x3f2
jne 0x470cda
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0043cb5e
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x471193
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4711c8
cmp edi, dword [esi + 0xc]
jge 0x4711c8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4711c8
cmp edi, dword [eax + 8]
jge 0x4711c8
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4711ca
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4712ce
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x471302
jmp fcn.0045ff69
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x471373
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x47146c
cmp eax, dword [edi + 0xc]
jge 0x47146c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4713c4
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x471455
cmp dword [ebp + 0xc], ebx
je 0x471455
jmp 0x4713ee
push 0x10
call fcn.0047105f
cmp eax, ebx
je 0x4713da
mov ecx, eax
call fcn.004712c5
mov esi, eax
jmp 0x4713dc
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x471405
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x471415
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x471427
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0045ff69
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0043a000
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x471467
cmp ecx, dword [esi + 8]
jge 0x471467
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x47146d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47152b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x471559
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471577
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00471495
jmp 0x471577
mov eax, dword [esi + 0x14]
test eax, eax
je 0x471577
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00471495
test edi, edi
mov eax, edi
jne 0x471561
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x49e87c]
test ecx, ecx
je 0x47162a
jmp 0x47152a
ret 8
Function at 0x4011d0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
lea eax, [esp + 0x24]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push esi
lea ecx, [esp + 8]
call fcn.004018e0
cmp dword [esp + 0x18], 8
lea eax, [esp + 4]
push 0
cmovae eax, dword [esp + 8]
push 0x80
push 3
push 0
push 0
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [esp + 0x18]
mov esi, eax
cmp ecx, 8
jb 0x401273
mov edx, dword [esp + 4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401269
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401269
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402354
add esp, 8
xor eax, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 7
mov word [esp + 4], ax
cmp esi, 0xffffffff
je 0x4012a4
lea eax, [esp + 0x1c]
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
call fcn.00402316
mov esp, ebp
pop ebp
ret
Function at 0x402bbc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402bfb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402bfb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402bfb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402bfb
cmp dword [ecx + 0x74], 0xe
jbe 0x402bfb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407485
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x695718
cmp edx, dword [eax]
je 0x4074a7
add eax, 8
inc ecx
cmp eax, 0x6957a8
jl 0x407498
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x695718]
jne 0x4075d5
mov eax, dword [0x46a81bc]
cmp eax, 1
je 0x4075af
test eax, eax
jne 0x4074d8
cmp dword [0x6953bc], 1
je 0x4075af
cmp edx, 0xfc
je 0x4075d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40750f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004093a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004063d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x407552
lea eax, [ebp - 0x1a4]
push eax
call fcn.004063d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b4c4
push edi
call fcn.004047a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004093a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004093b0
lea eax, [ebp - 0xa0]
push 0x40b4a4
push eax
call fcn.004093b0
push dword [esi + 0x69571c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004093b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409ab3
add esp, 0x2c
pop edi
jmp 0x4075d5
lea eax, [ebp + 8]
lea esi, [esi + 0x69571c]
push 0
push eax
push dword [esi]
call fcn.004063d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x23110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x2311b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x231160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x2311a8
mov esi, dword [ebp - 4]
jns 0x231187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x231197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x231169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x231140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x2311d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x231024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0x231254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0x231214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x23253b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2e20], 1
mov ecx, 0xcfce
jne 0x2325c2
or dword [0x2f2e20], 1
lea eax, [ecx + 0x1d]
mov edx, eax
add eax, 0xffffffa7
mov word [0x2ec9d4], ax
mov word [0x2ec9c8], dx
add edx, 0xffffffaf
lea eax, [ecx - 0x24]
mov word [0x2ec9d6], ax
add eax, 0x11
mov word [0x2ec9d8], ax
mov word [0x2ec9ca], dx
lea edx, [ecx - 0x43]
lea eax, [ecx - 0x2b]
mov word [0x2ec9da], ax
mov word [0x2ec9cc], dx
add edx, 0xfffffff8
add eax, 0x1b
mov word [0x2ec9dc], ax
lea eax, [ecx - 0x3d]
mov word [0x2ec9de], ax
mov eax, ecx
mov word [0x2ec9ce], dx
mov dword [0x2ec9d0], 0xcfebcf9e
mov word [0x2ec9e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2ec9c8]
add eax, 2
mov word [eax + 0x2ed072], dx
cmp eax, 0x1a
jb 0x2325c4
mov eax, 0x2ed074
ret

Function at 0x2325e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2e18], 1
jne 0x232610
or dword [0x2f2e18], 1
mov dword [0x2ec9f0], 0xaaa1a3f2
mov dword [0x2ec9f4], 0xf1aba2bb
mov dword [0x2ec9f8], 0xcef0f1f1
xor eax, eax
mov cl, byte [eax + 0x2ec9f0]
xor cl, 0xce
mov byte [eax + 0x2ed09c], cl
inc eax
cmp eax, 0xc
jb 0x232612
mov eax, 0x2ed09c
ret

Function at 0x23262d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2e14], 1
mov edx, 0xcfce
jne 0x2326ed
push esi
lea ecx, [edx + 0x1e]
mov eax, ecx
mov word [0x2ec9fc], ax
add eax, 2
or dword [0x2f2e14], 1
mov word [0x2ec9fe], ax
lea eax, [edx + 0x15]
mov esi, eax
mov word [0x2eca00], si
mov word [0x2eca02], ax
add eax, 0xffffffca
mov word [0x2eca04], ax
lea eax, [edx - 0x12]
mov esi, eax
mov word [0x2eca06], si
add esi, 0xfffffff3
mov word [0x2eca08], si
lea esi, [edx - 0x11]
mov word [0x2eca0a], si
add esi, 0xffffffe9
mov word [0x2eca0c], si
lea esi, [edx - 0x3d]
mov word [0x2eca0e], si
mov esi, eax
mov word [0x2eca10], si
add esi, 0xffffffef
add eax, 0xfffffffe
mov word [0x2eca12], si
lea esi, [edx - 0x10]
mov word [0x2eca1a], ax
mov eax, edx
mov word [0x2eca14], si
mov dword [0x2eca16], 0xcfbccfa1
mov dword [0x2eca1c], 0xcfeccff3
mov word [0x2eca20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x2ec9fc]
add eax, 2
mov word [eax + 0x2ed0a6], cx
cmp eax, 0x26
jb 0x2326ef
mov eax, 0x2ed0a8
ret
Function at 0x2327d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0x2f2e10], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xcfce
jne 0x23280e
or dword [0x2f2e10], 1
lea eax, [ecx - 0x15]
mov word [0x2eca24], ax
add eax, 0xfffffff3
mov word [0x2eca26], ax
mov eax, ecx
mov word [0x2eca28], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2eca24]
add eax, 2
mov word [eax + 0x2ed0ce], dx
cmp eax, 6
jb 0x232812
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x232835
mov eax, dword [eax]
push 0x2ed0d0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.002938b7
add esp, 0xc
test eax, eax
jne 0x232900
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00233563
push dword [esp + 0x10]
call fcn.00232909
push eax
call fcn.00293e11
push dword [esp + 0x18]
call fcn.0029439c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00296f70
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x2c208c]
test eax, eax
jne 0x2328ee
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0025a918
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x2328d2
mov eax, dword [eax]
push eax
call fcn.00232949
push eax
call fcn.002940e0
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.00234ce5
jmp 0x232900
push dword [esp + 0x18]
mov esi, dword [0x2c20bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x232909
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2e0c], 1
jne 0x23292c
or dword [0x2f2e0c], 1
mov dword [0x2eca2c], 0x808bc4c3
mov word [0x2eca30], 0xce8a
xor eax, eax
mov cl, byte [eax + 0x2eca2c]
xor cl, 0xce
mov byte [eax + 0x2ed0d8], cl
inc eax
cmp eax, 6
jb 0x23292e
mov eax, 0x2ed0d8
ret

Function at 0x232949
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2e08], 1
jne 0x2329ce
or dword [0x2f2e08], 1
mov dword [0x2eca34], 0xa2a7af88
mov dword [0x2eca38], 0xbaeeaaab
mov dword [0x2eca3c], 0xbcadeea1
mov dword [0x2eca40], 0xabbaafab
mov dword [0x2eca44], 0xafbcadee
mov dword [0x2eca48], 0xbceea6bd
mov dword [0x2eca4c], 0xbca1beab
mov dword [0x2eca50], 0xeebcabba
mov dword [0x2eca54], 0xada1bcbe
mov dword [0x2eca58], 0xf4bdbdab
mov dword [0x2eca5c], 0xc4bdebee
mov byte [0x2eca60], 0xce
xor eax, eax
mov cl, byte [eax + 0x2eca34]
xor cl, 0xce
mov byte [eax + 0x2ed0e0], cl
inc eax
cmp eax, 0x2d
jb 0x2329d0
mov eax, 0x2ed0e0
ret
Function at 0x233a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2da8], 1
jne 0x233acd
or dword [0x2f2da8], 1
mov dword [0x2ecce0], 0xbbaaa183
mov dword [0x2ecce4], 0xeef4aba2
mov dword [0x2ecce8], 0xc4c3bdeb
mov byte [0x2eccec], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecce0]
xor cl, 0xce
mov byte [eax + 0x2ed38c], cl
inc eax
cmp eax, 0xd
jb 0x233acf
mov eax, 0x2ed38c
ret

Function at 0x233aea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2da4], 1
jne 0x233b29
or dword [0x2f2da4], 1
mov dword [0x2eccf0], 0xabbca69a
mov dword [0x2eccf4], 0xeef4aaaf
mov dword [0x2eccf8], 0xb6ebb6fe
mov dword [0x2eccfc], 0xc4c3c4c3
mov byte [0x2ecd00], 0xce
xor eax, eax
mov cl, byte [eax + 0x2eccf0]
xor cl, 0xce
mov byte [eax + 0x2ed39c], cl
inc eax
cmp eax, 0x11
jb 0x233b2b
mov eax, 0x2ed39c
ret

Function at 0x233b46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2da0], 1
jne 0x233b84
or dword [0x2f2da0], 1
mov dword [0x2ecd04], 0xabadb68b
mov dword [0x2ecd08], 0xa1a7babe
mov dword [0x2ecd0c], 0xaaebeea0
mov word [0x2ecd10], 0xc4c3
mov byte [0x2ecd12], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecd04]
xor cl, 0xce
mov byte [eax + 0x2ed3b0], cl
inc eax
cmp eax, 0xf
jb 0x233b86
mov eax, 0x2ed3b0
ret

Function at 0x233ba1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d9c], 1
jne 0x233bdf
or dword [0x2f2d9c], 1
mov dword [0x2ecd14], 0xafada182
mov dword [0x2ecd18], 0xa0a1a7ba
mov dword [0x2ecd1c], 0xbeebeef4
mov word [0x2ecd20], 0xc4c3
mov byte [0x2ecd22], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecd14]
xor cl, 0xce
mov byte [eax + 0x2ed3c0], cl
inc eax
cmp eax, 0xf
jb 0x233be1
mov eax, 0x2ed3c0
ret

Function at 0x233bfc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d98], 1
jne 0x233c3d
or dword [0x2f2d98], 1
mov dword [0x2ecd24], 0xabbeb79a
mov dword [0x2ecd28], 0xbdebeef4
mov dword [0x2ecd2c], 0xb6fee6ee
mov dword [0x2ecd30], 0xc3e7b6eb
mov word [0x2ecd34], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x2ecd24]
xor cl, 0xce
mov byte [eax + 0x2ed3d0], cl
inc eax
cmp eax, 0x12
jb 0x233c3f
mov eax, 0x2ed3d0
ret

Function at 0x233c5a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d94], 1
jne 0x233ce2
or dword [0x2f2d94], 1
mov dword [0x2ecd38], 0xafbaab8a
mov dword [0x2ecd3c], 0xf4bda2a7
mov dword [0x2ecd40], 0xa7bc9aee
mov dword [0x2ecd44], 0xbaeeaaab
mov dword [0x2ecd48], 0xabbceea1
mov dword [0x2ecd4c], 0xa8eeaaaf
mov dword [0x2ecd50], 0xeea3a1bc
mov dword [0x2ecd54], 0xa1a3aba3
mov dword [0x2ecd58], 0xafeeb7bc
mov dword [0x2ecd5c], 0xabbcaaaa
mov dword [0x2ecd60], 0xebeebdbd
mov dword [0x2ecd64], 0xcec4c3be
xor eax, eax
mov cl, byte [eax + 0x2ecd38]
xor cl, 0xce
mov byte [eax + 0x2ed3e4], cl
inc eax
cmp eax, 0x30
jb 0x233ce4
mov eax, 0x2ed3e4
ret
Function at 0x233cff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d90], 1
jne 0x233d91
or dword [0x2f2d90], 1
mov dword [0x2ecd68], 0xafbaab8a
mov dword [0x2ecd6c], 0xf4bda2a7
mov dword [0x2ecd70], 0xa7bc9aee
mov dword [0x2ecd74], 0xbaeeaaab
mov dword [0x2ecd78], 0xbcb9eea1
mov dword [0x2ecd7c], 0xeeabbaa7
mov dword [0x2ecd80], 0xa3eea1ba
mov dword [0x2ecd84], 0xbca1a3ab
mov dword [0x2ecd88], 0xaaafeeb7
mov dword [0x2ecd8c], 0xbdabbcaa
mov dword [0x2ecd90], 0xbeebeebd
mov word [0x2ecd94], 0xc4c3
mov byte [0x2ecd96], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecd68]
xor cl, 0xce
mov byte [eax + 0x2ed414], cl
inc eax
cmp eax, 0x2f
jb 0x233d93
mov eax, 0x2ed414
ret

Function at 0x233dae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d8c], 1
jne 0x233e41
or dword [0x2f2d8c], 1
mov dword [0x2ecd98], 0xafbaab8a
mov dword [0x2ecd9c], 0xf4bda2a7
mov dword [0x2ecda0], 0xa7bc9aee
mov dword [0x2ecda4], 0xbaeeaaab
mov dword [0x2ecda8], 0xb6abeea1
mov dword [0x2ecdac], 0xbabbadab
mov dword [0x2ecdb0], 0xaba3eeab
mov dword [0x2ecdb4], 0xb7bca1a3
mov dword [0x2ecdb8], 0xeebaafee
mov dword [0x2ecdbc], 0xbcaaaaaf
mov dword [0x2ecdc0], 0xeebdbdab
mov dword [0x2ecdc4], 0xc4c3beeb
mov byte [0x2ecdc8], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecd98]
xor cl, 0xce
mov byte [eax + 0x2ed444], cl
inc eax
cmp eax, 0x31
jb 0x233e43
mov eax, 0x2ed444
ret

Function at 0x233e5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d88], 1
jne 0x233e95
or dword [0x2f2d88], 1
mov dword [0x2ecdcc], 0xa9afa288
mov dword [0x2ecdd0], 0xfeeef4bd
mov dword [0x2ecdd4], 0xc3b6ebb6
mov word [0x2ecdd8], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x2ecdcc]
xor cl, 0xce
mov byte [eax + 0x2ed478], cl
inc eax
cmp eax, 0xe
jb 0x233e97
mov eax, 0x2ed478
ret

Function at 0x233eb2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d84], 1
jne 0x233ee9
or dword [0x2f2d84], 1
mov dword [0x2ecddc], 0xafbcaf9e
mov dword [0x2ecde0], 0xabbaaba3
mov dword [0x2ecde4], 0xc3f4bdbc
mov word [0x2ecde8], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x2ecddc]
xor cl, 0xce
mov byte [eax + 0x2ed488], cl
inc eax
cmp eax, 0xe
jb 0x233eeb
mov eax, 0x2ed488
ret

Function at 0x233f06
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d80], 1
jne 0x233f4f
or dword [0x2f2d80], 1
mov dword [0x2ecdec], 0xbcaf9ec7
mov dword [0x2ecdf0], 0xbaaba3af
mov dword [0x2ecdf4], 0xeb95bcab
mov dword [0x2ecdf8], 0xeef493aa
mov dword [0x2ecdfc], 0xc4c3beeb
mov byte [0x2ece00], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecdec]
xor cl, 0xce
mov byte [eax + 0x2ed498], cl
inc eax
cmp eax, 0x15
jb 0x233f51
mov eax, 0x2ed498
ret

Function at 0x233f6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d7c], 1
jne 0x233fa4
or dword [0x2f2d7c], 1
mov dword [0x2ece04], 0xee868b9d
mov dword [0x2ece08], 0xa2afa08f
mov dword [0x2ece0c], 0xbda7bdb7
mov dword [0x2ece10], 0xcec4c3f4
xor eax, eax
mov cl, byte [eax + 0x2ece04]
xor cl, 0xce
mov byte [eax + 0x2ed4b0], cl
inc eax
cmp eax, 0x10
jb 0x233fa6
mov eax, 0x2ed4b0
ret