joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8e60f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x95337f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x988cdc], 1
push esi
jne 0x8e614a
or dword [0x988cdc], 1
mov dword [0x983784], 0x8d85958f
mov dword [0x983788], 0x8d85cf8d
mov word [0x98378c], 0xe18d
xor eax, eax
mov cl, byte [eax + 0x983784]
xor cl, 0xe1
mov byte [eax + 0x983984], cl
inc eax
cmp eax, 0xa
jb 0x8e614c
push 0x983984
call dword [0x95a0cc]
mov esi, eax
test esi, esi
jne 0x8e61be
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0090a8be
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.008e6305
push eax
lea eax, [esp + 0x28]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
push eax
call fcn.00935956
call fcn.008e636b
push eax
push esi
call dword [0x95a0c8]
test eax, eax
jne 0x8e621b
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0090a8be
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.008e63dd
push eax
lea eax, [esp + 0x44]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
jmp 0x8e61b8
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x8e62a3
cmp dword [esp + 4], 0x18
jne 0x8e62a3
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x95a0c4]
test eax, eax
jne 0x8e62f2
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0090a8be
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.008e651d
push eax
lea eax, [esp + 0x94]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
jmp 0x8e61b8
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0090a8be
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.008e6490
push eax
lea eax, [esp + 0x44]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
jmp 0x8e61b8
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x8e6305
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cd8], 1
jne 0x8e634e
or dword [0x988cd8], 1
mov dword [0x983790], 0x85808ead
mov dword [0x983794], 0x938388ad
mov dword [0x983798], 0xc1989380
mov dword [0x98379c], 0x8d888087
mov dword [0x9837a0], 0xc1db8584
mov byte [0x9837a4], 0xe1
xor eax, eax
mov cl, byte [eax + 0x983790]
xor cl, 0xe1
mov byte [eax + 0x983990], cl
inc eax
cmp eax, 0x15
jb 0x8e6350
mov eax, 0x983990
ret
Function at 0x8e636b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cd4], 1
jne 0x8e63c0
or dword [0x988cd4], 1
mov dword [0x9837a8], 0x94b095af
mov dword [0x9837ac], 0xa8989384
mov dword [0x9837b0], 0x938e878f
mov dword [0x9837b4], 0x8895808c
mov dword [0x9837b8], 0x93b18f8e
mov dword [0x9837bc], 0x9284828e
mov word [0x9837c0], 0xe192
xor eax, eax
mov cl, byte [eax + 0x9837a8]
xor cl, 0xe1
mov byte [eax + 0x9839a8], cl
inc eax
cmp eax, 0x1a
jb 0x8e63c2
mov eax, 0x9839a8
ret

Function at 0x8e63dd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cd0], 1
jne 0x8e6473
or dword [0x988cd0], 1
mov dword [0x9837c4], 0xb19584a6
mov dword [0x9837c8], 0xa0828e93
mov dword [0x9837cc], 0x84938585
mov dword [0x9837d0], 0x87c19292
mov dword [0x9837d4], 0x848d8880
mov dword [0x9837d8], 0xafc9c185
mov dword [0x9837dc], 0x8494b095
mov dword [0x9837e0], 0x8fa89893
mov dword [0x9837e4], 0x8c938e87
mov dword [0x9837e8], 0x8e889580
mov dword [0x9837ec], 0x8e93b18f
mov dword [0x9837f0], 0x92928482
mov dword [0x9837f4], 0xe1c1dbc8
xor eax, eax
mov cl, byte [eax + 0x9837c4]
xor cl, 0xe1
mov byte [eax + 0x9839c4], cl
inc eax
cmp eax, 0x34
jb 0x8e6475
mov eax, 0x9839c4
ret

Function at 0x8e6490
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ccc], 1
jne 0x8e6500
or dword [0x988ccc], 1
mov dword [0x9837f8], 0x94b095af
mov dword [0x9837fc], 0xa8989384
mov dword [0x983800], 0x938e878f
mov dword [0x983804], 0x8895808c
mov dword [0x983808], 0x93b18f8e
mov dword [0x98380c], 0x9284828e
mov dword [0x983810], 0x8087c192
mov dword [0x983814], 0x85848d88
mov word [0x983818], 0xc1db
mov byte [0x98381a], 0xe1
xor eax, eax
mov cl, byte [eax + 0x9837f8]
xor cl, 0xe1
mov byte [eax + 0x9839f8], cl
inc eax
cmp eax, 0x23
jb 0x8e6502
mov eax, 0x9839f8
ret

Function at 0x8e651d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cc8], 1
jne 0x8e6566
or dword [0x988cc8], 1
mov dword [0x98381c], 0x8f8491ae
mov dword [0x983820], 0x828e93b1
mov dword [0x983824], 0xc1929284
mov dword [0x983828], 0x8d888087
mov dword [0x98382c], 0xc1db8584
mov byte [0x983830], 0xe1
xor eax, eax
mov cl, byte [eax + 0x98381c]
xor cl, 0xe1
mov byte [eax + 0x983a1c], cl
inc eax
cmp eax, 0x15
jb 0x8e6568
mov eax, 0x983a1c
ret
Function at 0x8e6583
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x95332c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x988cc4], 1
push esi
push edi
jne 0x8e65e0
or dword [0x988cc4], 1
mov dword [0x983834], 0x8f93848a
mov dword [0x983838], 0xd3d28d84
mov dword [0x98383c], 0x8d8d85cf
mov byte [0x983840], 0xe1
xor eax, eax
mov cl, byte [eax + 0x983834]
xor cl, 0xe1
mov byte [eax + 0x983a34], cl
inc eax
cmp eax, 0xd
jb 0x8e65e2
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x983a34
call edi
mov esi, eax
test esi, esi
jne 0x8e6656
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0090a8be
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.008e67b8
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
push eax
call fcn.00935956
call fcn.008e6835
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x8e6723
call fcn.008e68a8
push eax
call edi
mov edi, eax
test edi, edi
jne 0x8e66c7
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0090a8be
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.008e68f2
push eax
lea eax, [esp + 0x20]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
jmp 0x8e6650
call fcn.008e696c
push eax
push edi
call esi
test eax, eax
jne 0x8e6723
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0090a8be
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.008e69dc
push eax
lea eax, [esp + 0x20]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
jmp 0x8e6650
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x8e6785
call dword [0x95a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0090a8be
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.008e6a95
push eax
lea eax, [esp + 0x20]
push eax
call fcn.008e6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.008e5c3f
push 0x9744a8
mov eax, esi
jmp 0x8e6650
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.008e4cc5
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x8e67b8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cc0], 1
jne 0x8e6818
or dword [0x988cc0], 1
mov dword [0x983844], 0x85808ead
mov dword [0x983848], 0x938388ad
mov dword [0x98384c], 0xc1989380
mov dword [0x983850], 0x8d888087
mov dword [0x983854], 0xc9c18584
mov dword [0x983858], 0x8f93848a
mov dword [0x98385c], 0xd3d28d84
mov dword [0x983860], 0xe1c1dbc8
xor eax, eax
mov cl, byte [eax + 0x983844]
xor cl, 0xe1
mov byte [eax + 0x983a44], cl
inc eax
cmp eax, 0x20
jb 0x8e681a
mov eax, 0x983a44
ret
Function at 0x8e6835
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cbc], 1
jne 0x8e688b
or dword [0x988cbc], 1
mov dword [0x983864], 0xa6d3d2aa
mov dword [0x983868], 0x93b19584
mov dword [0x98386c], 0x9284828e
mov dword [0x983870], 0x808ca892
mov dword [0x983874], 0x88a78486
mov dword [0x983878], 0x80af848d
mov dword [0x98387c], 0xe1a0848c
xor eax, eax
mov cl, byte [eax + 0x983864]
xor cl, 0xe1
mov byte [eax + 0x983a64], cl
inc eax
cmp eax, 0x1c
jb 0x8e688d
mov eax, 0x983a64
ret

Function at 0x8e68a8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cb8], 1
jne 0x8e68d5
or dword [0x988cb8], 1
mov dword [0x983880], 0x91809291
mov dword [0x983884], 0x8d85cf88
mov word [0x983888], 0xe18d
xor eax, eax
mov cl, byte [eax + 0x983880]
xor cl, 0xe1
mov byte [eax + 0x983a80], cl
inc eax
cmp eax, 0xa
jb 0x8e68d7
mov eax, 0x983a80
ret

Function at 0x8e68f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cb4], 1
jne 0x8e694f
or dword [0x988cb4], 1
mov dword [0x98388c], 0x85808ead
mov dword [0x983890], 0x938388ad
mov dword [0x983894], 0xc1989380
mov dword [0x983898], 0x8d888087
mov dword [0x98389c], 0xc9c18584
mov dword [0x9838a0], 0x91809291
mov dword [0x9838a4], 0xc1dbc888
mov byte [0x9838a8], 0xe1
xor eax, eax
mov cl, byte [eax + 0x98388c]
xor cl, 0xe1
mov byte [eax + 0x983a8c], cl
inc eax
cmp eax, 0x1d
jb 0x8e6951
mov eax, 0x983a8c
ret

Function at 0x8e696c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cb0], 1
jne 0x8e69bf
or dword [0x988cb0], 1
mov dword [0x9838ac], 0xb19584a6
mov dword [0x9838b0], 0x84828e93
mov dword [0x9838b4], 0x8ca89292
mov dword [0x9838b8], 0xa7848680
mov dword [0x9838bc], 0xaf848d88
mov dword [0x9838c0], 0xa0848c80
mov byte [0x9838c4], 0xe1
xor eax, eax
mov cl, byte [eax + 0x9838ac]
xor cl, 0xe1
mov byte [eax + 0x983aac], cl
inc eax
cmp eax, 0x19
jb 0x8e69c1
mov eax, 0x983aac
ret

Function at 0x8e69dc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988cac], 1
jne 0x8e6a78
or dword [0x988cac], 1
mov dword [0x9838c8], 0xb19584a6
mov dword [0x9838cc], 0xa0828e93
mov dword [0x9838d0], 0x84938585
mov dword [0x9838d4], 0x87c19292
mov dword [0x9838d8], 0x848d8880
mov dword [0x9838dc], 0xa6c9c185
mov dword [0x9838e0], 0x93b19584
mov dword [0x9838e4], 0x9284828e
mov dword [0x9838e8], 0x808ca892
mov dword [0x9838ec], 0x88a78486
mov dword [0x9838f0], 0x80af848d
mov dword [0x9838f4], 0xc8a0848c
mov word [0x9838f8], 0xc1db
mov byte [0x9838fa], 0xe1
xor eax, eax
mov cl, byte [eax + 0x9838c8]
xor cl, 0xe1
mov byte [eax + 0x983ac8], cl
inc eax
cmp eax, 0x33
jb 0x8e6a7a
mov eax, 0x983ac8
ret

Function at 0x8e6a95
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ca8], 1
jne 0x8e6afc
or dword [0x988ca8], 1
mov dword [0x9838fc], 0xb19584a6
mov dword [0x983900], 0x84828e93
mov dword [0x983904], 0x8ca89292
mov dword [0x983908], 0xa7848680
mov dword [0x98390c], 0x8f848d88
mov dword [0x983910], 0xc1848c80
mov dword [0x983914], 0x8d888087
mov dword [0x983918], 0xc1db8584
mov byte [0x98391c], 0xe1
xor eax, eax
mov cl, byte [eax + 0x9838fc]
xor cl, 0xe1
mov byte [eax + 0x983afc], cl
inc eax
cmp eax, 0x21
jb 0x8e6afe
mov eax, 0x983afc
ret
Function at 0x8e76ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ca4], 1
jne 0x8e78b0
or dword [0x988ca4], 1
mov dword [0x983b28], 0x91cc8d8b
mov dword [0x983b2c], 0x978d8696
mov dword [0x983b30], 0x8791d896
mov dword [0x983b34], 0x97809496
mov dword [0x983b38], 0x8cc5ca84
mov dword [0x983b3c], 0xe8cbc58d
mov dword [0x983b40], 0x89818392
mov dword [0x983b44], 0xcc878583
mov dword [0x983b48], 0x8a968392
mov dword [0x983b4c], 0xc5c2dfc2
mov dword [0x983b50], 0x8790e8c5
mov dword [0x983b54], 0x908b9793
mov dword [0x983b58], 0x91c5ca87
mov dword [0x983b5c], 0x818b9096
mov dword [0x983b60], 0xe8cbc596
mov dword [0x983b64], 0x83818d8e
mov dword [0x983b68], 0xce91c28e
mov dword [0x983b6c], 0xdfc290c2
mov dword [0x983b70], 0x81929ac2
mov dword [0x983b74], 0xca8e8e83
mov dword [0x983b78], 0x818c9784
mov dword [0x983b7c], 0x8c8d8b96
mov dword [0x983b80], 0x90c2cbca
mov dword [0x983b84], 0x90979687
mov dword [0x983b88], 0x8790c28c
mov dword [0x983b8c], 0x908b9793
mov dword [0x983b90], 0xc7c5ca87
mov dword [0x983b94], 0xcccbc5af
mov dword [0x983b98], 0x8c8b838f
mov dword [0x983b9c], 0x83bdbdca
mov dword [0x983ba0], 0xcb918590
mov dword [0x983ba4], 0x868c87c2
mov dword [0x983ba8], 0x8786c2ce
mov dword [0x983bac], 0xcc859780
mov dword [0x983bb0], 0x81839096
mov dword [0x983bb4], 0x81838087
mov dword [0x983bb8], 0x8be8cb89
mov dword [0x983bbc], 0x8d8cc284
mov dword [0x983bc0], 0xc291c296
mov dword [0x983bc4], 0x8c878a96
mov dword [0x983bc8], 0x909087c2
mov dword [0x983bcc], 0x90ca908d
mov dword [0x983bd0], 0x8c87c2cb
mov dword [0x983bd4], 0x8790e886
mov dword [0x983bd8], 0x8c909796
mov word [0x983bdc], 0x90c2
mov byte [0x983bde], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983b28]
xor cl, 0xe2
mov byte [eax + 0x984118], cl
inc eax
cmp eax, 0xb7
jb 0x8e78b2
mov eax, 0x984118
ret
Function at 0x8e78cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ca0], 1
jne 0x8e7b55
or dword [0x988ca0], 1
mov dword [0x983be0], 0x91cc8d8b
mov dword [0x983be4], 0x978d8696
mov dword [0x983be8], 0x8791d896
mov dword [0x983bec], 0x97809496
mov dword [0x983bf0], 0x8cc5ca84
mov dword [0x983bf4], 0xe8cbc58d
mov dword [0x983bf8], 0x89818392
mov dword [0x983bfc], 0xcc878583
mov dword [0x983c00], 0x8a968392
mov dword [0x983c04], 0xe8c5c5df
mov dword [0x983c08], 0x97938790
mov dword [0x983c0c], 0xca87908b
mov dword [0x983c10], 0x909691c5
mov dword [0x983c14], 0xc596818b
mov dword [0x983c18], 0x8d8ee8cb
mov dword [0x983c1c], 0xc28e8381
mov dword [0x983c20], 0xdfc28e8f
mov dword [0x983c24], 0x938790c2
mov dword [0x983c28], 0x87908b97
mov dword [0x983c2c], 0x8e8fc5ca
mov dword [0x983c30], 0x8ee8cbc5
mov dword [0x983c34], 0x8e83818d
mov dword [0x983c38], 0x90ce91c2
mov dword [0x983c3c], 0xdfc287ce
mov dword [0x983c40], 0x81929ac2
mov dword [0x983c44], 0xca8e8e83
mov dword [0x983c48], 0x818c9784
mov dword [0x983c4c], 0x8c8d8b96
mov dword [0x983c50], 0x90c2cbca
mov dword [0x983c54], 0x90979687
mov dword [0x983c58], 0x8790c28c
mov dword [0x983c5c], 0x908b9793
mov dword [0x983c60], 0xc7c5ca87
mov dword [0x983c64], 0xcccbc5af
mov dword [0x983c68], 0xc7caa4c7
mov dword [0x983c6c], 0x87c2cba3
mov dword [0x983c70], 0xc2ce868c
mov dword [0x983c74], 0x97808786
mov dword [0x983c78], 0x9096cc85
mov dword [0x983c7c], 0x80878183
mov dword [0x983c80], 0xcb898183
mov dword [0x983c84], 0xc2848be8
mov dword [0x983c88], 0xc2968d8c
mov dword [0x983c8c], 0x8a96c291
mov dword [0x983c90], 0x90c28c87
mov dword [0x983c94], 0x90979687
mov dword [0x983c98], 0x8b8cc28c
mov dword [0x983c9c], 0x90c2ce8e
mov dword [0x983ca0], 0x868c87c2
mov dword [0x983ca4], 0xc2848be8
mov dword [0x983ca8], 0xdf9cc290
mov dword [0x983cac], 0x8e8b8cc2
mov dword [0x983cb0], 0x878a96c2
mov dword [0x983cb4], 0xc290c28c
mov dword [0x983cb8], 0x8e8fc2df
mov dword [0x983cbc], 0x969196cc
mov dword [0x983cc0], 0x858c8b90
mov dword [0x983cc4], 0xc2cb90ca
mov dword [0x983cc8], 0xe8868c87
mov dword [0x983ccc], 0x97968790
mov dword [0x983cd0], 0x90c28c90
mov word [0x983cd4], 0x87ce
mov byte [0x983cd6], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983be0]
xor cl, 0xe2
mov byte [eax + 0x9841d0], cl
inc eax
cmp eax, 0xf7
jb 0x8e7b57
mov eax, 0x9841d0
ret
Function at 0x8e7b74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x988c64], 1
jne 0x8e7b9b
or dword [0x988c64], 1
mov dword [0x983dc8], 0x89818392
mov dword [0x983dcc], 0xe2878583
xor eax, eax
mov cl, byte [eax + 0x983dc8]
xor cl, 0xe2
mov byte [eax + 0x9843b8], cl
inc eax
cmp eax, 8
jb 0x8e7b9d
push 0x9843b8
push dword [ebp + 8]
call fcn.00918c96
test byte [0x988c60], 1
pop ecx
pop ecx
jne 0x8e7be5
or dword [0x988c60], 1
mov dword [0x983dd0], 0x8e879092
mov dword [0x983dd4], 0xe286838d
xor eax, eax
mov cl, byte [eax + 0x983dd0]
xor cl, 0xe2
mov byte [eax + 0x9843c0], cl
inc eax
cmp eax, 8
jb 0x8e7be7
push esi
push 0x9843c0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00918d0a
add esp, 0xc
cmp dword [0x97ebe0], 0
mov esi, 0x97ebe0
je 0x8e7c47
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00918bb6
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00918f37
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x8e7c20
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0091840b
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x8e7ec1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x952d66
call fcn.00951d38
sub esp, 0x64
test byte [0x988c4c], 1
jne 0x8e7eee
or dword [0x988c4c], 1
mov word [0x983e00], 0xafc7
mov byte [0x983e02], 0xe2
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x983e00]
xor cl, 0xe2
mov byte [eax + 0x9843f0], cl
inc eax
cmp eax, 3
jb 0x8e7ef5
mov esi, 0x9843f0
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x8e7f21
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.008e4c50
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.008ed0cb
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.008e4ce6
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x8e7f68
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.00917809
pop ecx
pop ecx
cmp eax, ebx
je 0x8e7fb9
cmp eax, 3
jne 0x8e7fa6
call fcn.008e80c0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0092ba55
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x9744a8
lea eax, [ebp - 0x1c]
push eax
call fcn.00935956
cmp eax, 4
jne 0x8e7fb2
call fcn.008e8173
jmp 0x8e7f82
call fcn.008e8226
jmp 0x8e7f82
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0091923f
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x8e8070
push ebx
call fcn.008e82aa
push eax
push 0xffffffffffffffff
push esi
call fcn.00917fa0
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.008e4cc5
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x8e8028
call fcn.008e82f1
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.008ed13c
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.008e5c3f
jmp 0x8e7f98
cmp edi, 4
jne 0x8e8047
call fcn.008e8350
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.008ed13c
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x8e801b
cmp edi, 6
jne 0x8e8066
call fcn.008e83b5
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.008ed13c
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x8e801b
call fcn.008e8439
jmp 0x8e7f82
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.009185fb
pop ecx
pop ecx
test eax, eax
je 0x8e8091
push ebx
push edi
push esi
call fcn.009187bf
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.009183f5
sub edi, eax
push edi
push esi
call fcn.0091840b
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.008e4ce6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x8e80c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c48], 1
jne 0x8e8156
or dword [0x988c48], 1
mov dword [0x983e04], 0x8e8b83a4
mov dword [0x983e08], 0x96c28687
mov dword [0x983e0c], 0x9487c28d
mov dword [0x983e10], 0x83978e83
mov dword [0x983e14], 0x80c28796
mov dword [0x983e18], 0x91968d8d
mov dword [0x983e1c], 0x92839096
mov dword [0x983e20], 0x839084c2
mov dword [0x983e24], 0x8c878f85
mov dword [0x983e28], 0x91c2ce96
mov dword [0x983e2c], 0x83968c9b
mov dword [0x983e30], 0x9087c29a
mov dword [0x983e34], 0xe2908d90
xor eax, eax
mov cl, byte [eax + 0x983e04]
xor cl, 0xe2
mov byte [eax + 0x9843f4], cl
inc eax
cmp eax, 0x34
jb 0x8e8158
mov eax, 0x9843f4
ret

Function at 0x8e8173
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c44], 1
jne 0x8e8209
or dword [0x988c44], 1
mov dword [0x983e38], 0x8e8b83a4
mov dword [0x983e3c], 0x96c28687
mov dword [0x983e40], 0x9487c28d
mov dword [0x983e44], 0x83978e83
mov dword [0x983e48], 0x80c28796
mov dword [0x983e4c], 0x91968d8d
mov dword [0x983e50], 0x92839096
mov dword [0x983e54], 0x839084c2
mov dword [0x983e58], 0x8c878f85
mov dword [0x983e5c], 0x8fc2ce96
mov dword [0x983e60], 0x908d8f87
mov dword [0x983e64], 0x9087c29b
mov dword [0x983e68], 0xe2908d90
xor eax, eax
mov cl, byte [eax + 0x983e38]
xor cl, 0xe2
mov byte [eax + 0x984428], cl
inc eax
cmp eax, 0x34
jb 0x8e820b
mov eax, 0x984428
ret

Function at 0x8e8226
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c40], 1
jne 0x8e828d
or dword [0x988c40], 1
mov dword [0x983e6c], 0x8c898cb7
mov dword [0x983e70], 0xc28c958d
mov dword [0x983e74], 0x8d909087
mov dword [0x983e78], 0x8c8bc290
mov dword [0x983e7c], 0x83978ec2
mov dword [0x983e80], 0x8d8ebdae
mov dword [0x983e84], 0x96918683
mov dword [0x983e88], 0x858c8b90
mov byte [0x983e8c], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983e6c]
xor cl, 0xe2
mov byte [eax + 0x98445c], cl
inc eax
cmp eax, 0x21
jb 0x8e828f
mov eax, 0x98445c
ret

Function at 0x8e82aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c3c], 1
jne 0x8e82d4
or dword [0x988c3c], 1
mov dword [0x983e90], 0x8c8d8cde
mov word [0x983e94], 0xdc87
mov byte [0x983e96], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983e90]
xor cl, 0xe2
mov byte [eax + 0x984480], cl
inc eax
cmp eax, 7
jb 0x8e82d6
mov eax, 0x984480
ret

Function at 0x8e82f1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c38], 1
jne 0x8e8333
or dword [0x988c38], 1
mov dword [0x983e98], 0xc28397ae
mov dword [0x983e9c], 0x968c9790
mov dword [0x983ea0], 0xc2878f8b
mov dword [0x983ea4], 0x8d909087
mov dword [0x983ea8], 0xe2c2d890
xor eax, eax
mov cl, byte [eax + 0x983e98]
xor cl, 0xe2
mov byte [eax + 0x984488], cl
inc eax
cmp eax, 0x14
jb 0x8e8335
mov eax, 0x984488
ret
Function at 0x8e8350
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c34], 1
jne 0x8e8398
or dword [0x988c34], 1
mov dword [0x983eac], 0xc28397ae
mov dword [0x983eb0], 0x8d8f878f
mov dword [0x983eb4], 0x87c29b90
mov dword [0x983eb8], 0x908d9090
mov word [0x983ebc], 0xc2d8
mov byte [0x983ebe], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983eac]
xor cl, 0xe2
mov byte [eax + 0x98449c], cl
inc eax
cmp eax, 0x13
jb 0x8e839a
mov eax, 0x98449c
ret

Function at 0x8e83b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c30], 1
jne 0x8e841c
or dword [0x988c30], 1
mov dword [0x983ec0], 0xc28397ae
mov dword [0x983ec4], 0x8d909087
mov dword [0x983ec8], 0x8c8bc290
mov dword [0x983ecc], 0x87868b91
mov dword [0x983ed0], 0x909087c2
mov dword [0x983ed4], 0x8ac2908d
mov dword [0x983ed8], 0x8e868c83
mov dword [0x983edc], 0xc2d89087
mov byte [0x983ee0], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983ec0]
xor cl, 0xe2
mov byte [eax + 0x9844b0], cl
inc eax
cmp eax, 0x21
jb 0x8e841e
mov eax, 0x9844b0
ret

Function at 0x8e8439
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c2c], 1
jne 0x8e8495
or dword [0x988c2c], 1
mov dword [0x983ee4], 0x8c898cb7
mov dword [0x983ee8], 0xc28c958d
mov dword [0x983eec], 0x8d909087
mov dword [0x983ef0], 0x8c8bc290
mov dword [0x983ef4], 0x83978ec2
mov dword [0x983ef8], 0x838192bd
mov word [0x983efc], 0x8e8e
mov byte [0x983efe], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983ee4]
xor cl, 0xe2
mov byte [eax + 0x9844d4], cl
inc eax
cmp eax, 0x1b
jb 0x8e8497
mov eax, 0x9844d4
ret

Function at 0x8e86d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c28], 1
jne 0x8e871c
or dword [0x988c28], 1
mov dword [0x983f00], 0x879183a0
mov dword [0x983f04], 0x86c2d6d4
mov dword [0x983f08], 0x868d8187
mov dword [0x983f0c], 0x8384c287
mov dword [0x983f10], 0x86878e8b
mov byte [0x983f14], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983f00]
xor cl, 0xe2
mov byte [eax + 0x9844f0], cl
inc eax
cmp eax, 0x15
jb 0x8e871e
mov eax, 0x9844f0
ret