joyce8/EMBER2024-capa huggingface dataset:
Function at 0x901c66
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887d0], 1
jne 0x901ccc
or dword [0x9887d0], 1
mov dword [0x986998], 0x99838498
mov dword [0x98699c], 0x81b2dfde
mov dword [0x9869a0], 0x99858a84
mov dword [0x9869a4], 0x9f889e98
mov dword [0x9869a8], 0x8c998c89
mov dword [0x9869ac], 0xb28299b2
mov dword [0x9869b0], 0x8f809883
mov word [0x9869b4], 0x9f88
mov byte [0x9869b6], 0xed
xor eax, eax
mov cl, byte [eax + 0x986998]
xor cl, 0xed
mov byte [eax + 0x986b70], cl
inc eax
cmp eax, 0x1f
jb 0x901cce
mov eax, 0x986b70
ret

Function at 0x901ce9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887cc], 1
jne 0x901d48
or dword [0x9887cc], 1
mov dword [0x9869b8], 0xde998384
mov dword [0x9869bc], 0x8481b2df
mov dword [0x9869c0], 0x9899858a
mov dword [0x9869c4], 0x899f889e
mov dword [0x9869c8], 0xb28c998c
mov dword [0x9869cc], 0x83b28299
mov dword [0x9869d0], 0x888f8098
mov word [0x9869d4], 0xed9f
xor eax, eax
mov cl, byte [eax + 0x9869b8]
xor cl, 0xed
mov byte [eax + 0x986b90], cl
inc eax
cmp eax, 0x1e
jb 0x901d4a
mov eax, 0x986b90
ret

Function at 0x901d65
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887c8], 1
jne 0x901dc4
or dword [0x9887c8], 1
mov dword [0x9869d8], 0x8c858e9d
mov dword [0x9869dc], 0x8481b29f
mov dword [0x9869e0], 0x9899858a
mov dword [0x9869e4], 0x899f889e
mov dword [0x9869e8], 0xb28c998c
mov dword [0x9869ec], 0x9eb28299
mov dword [0x9869f0], 0x83849f99
mov word [0x9869f4], 0xed8a
xor eax, eax
mov cl, byte [eax + 0x9869d8]
xor cl, 0xed
mov byte [eax + 0x986bb0], cl
inc eax
cmp eax, 0x1e
jb 0x901dc6
mov eax, 0x986bb0
ret

Function at 0x901de1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887c4], 1
jne 0x901e47
or dword [0x9887c4], 1
mov dword [0x9869f8], 0x858e9a9d
mov dword [0x9869fc], 0x81b29f8c
mov dword [0x986a00], 0x99858a84
mov dword [0x986a04], 0x9f889e98
mov dword [0x986a08], 0x8c998c89
mov dword [0x986a0c], 0xb28299b2
mov dword [0x986a10], 0x849f999e
mov word [0x986a14], 0x8a83
mov byte [0x986a16], 0xed
xor eax, eax
mov cl, byte [eax + 0x9869f8]
xor cl, 0xed
mov byte [eax + 0x986bd0], cl
inc eax
cmp eax, 0x1f
jb 0x901e49
mov eax, 0x986bd0
ret

Function at 0x901e64
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887c0], 1
jne 0x901ecb
or dword [0x9887c0], 1
mov dword [0x986a18], 0x858a8481
mov dword [0x986a1c], 0x889e9899
mov dword [0x986a20], 0x998c899f
mov dword [0x986a24], 0x889eb28c
mov dword [0x986a28], 0x8c9bb299
mov dword [0x986a2c], 0x838c849f
mov dword [0x986a30], 0x999eb299
mov dword [0x986a34], 0x8a83849f
mov byte [0x986a38], 0xed
xor eax, eax
mov cl, byte [eax + 0x986a18]
xor cl, 0xed
mov byte [eax + 0x986bf0], cl
inc eax
cmp eax, 0x21
jb 0x901ecd
mov eax, 0x986bf0
ret
Function at 0x901ee8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887bc], 1
jne 0x901f4f
or dword [0x9887bc], 1
mov dword [0x986a3c], 0x858a8481
mov dword [0x986a40], 0x889e9899
mov dword [0x986a44], 0x998c899f
mov dword [0x986a48], 0x889eb28c
mov dword [0x986a4c], 0x8c9bb299
mov dword [0x986a50], 0x838c849f
mov dword [0x986a54], 0x9883b299
mov dword [0x986a58], 0x9f888f80
mov byte [0x986a5c], 0xed
xor eax, eax
mov cl, byte [eax + 0x986a3c]
xor cl, 0xed
mov byte [eax + 0x986c14], cl
inc eax
cmp eax, 0x21
jb 0x901f51
mov eax, 0x986c14
ret

Function at 0x901f6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887b8], 1
jne 0x901fd5
or dword [0x9887b8], 1
mov dword [0x986a60], 0x858a8481
mov dword [0x986a64], 0x889e9899
mov dword [0x986a68], 0x998c899f
mov dword [0x986a6c], 0x889eb28c
mov dword [0x986a70], 0x8c9bb299
mov dword [0x986a74], 0x838c849f
mov dword [0x986a78], 0x828fb299
mov dword [0x986a7c], 0x8c888182
mov word [0x986a80], 0xed83
xor eax, eax
mov cl, byte [eax + 0x986a60]
xor cl, 0xed
mov byte [eax + 0x986c38], cl
inc eax
cmp eax, 0x22
jb 0x901fd7
mov eax, 0x986c38
ret

Function at 0x901ff5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9887b4], 1
jne 0x90205b
or dword [0x9887b4], 1
mov dword [0x986a84], 0x858a8481
mov dword [0x986a88], 0x889e9899
mov dword [0x986a8c], 0x998c899f
mov dword [0x986a90], 0x889eb28c
mov dword [0x986a94], 0x8c9bb299
mov dword [0x986a98], 0x838c849f
mov dword [0x986a9c], 0x9883b299
mov word [0x986aa0], 0x8181
mov byte [0x986aa2], 0xed
xor eax, eax
mov cl, byte [eax + 0x986a84]
xor cl, 0xed
mov byte [eax + 0x986c5c], cl
inc eax
cmp eax, 0x1f
jb 0x90205d
mov eax, 0x986c5c
ret

Function at 0x9022ed
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x952ad9
call fcn.00951d38
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x95a0a8]
test byte [0x988794], 1
mov edi, eax
jne 0x90233a
or dword [0x988794], 1
mov dword [0x986cf8], 0x87808799
mov dword [0x986cfc], 0xc09a8b80
mov dword [0x986d00], 0xee82828a
xor ecx, ecx
mov al, byte [ecx + 0x986cf8]
xor al, 0xee
mov byte [ecx + 0x986fac], al
inc ecx
cmp ecx, 0xc
jb 0x90233c
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x986fac
call dword [0x95a0d4]
push eax
push 0x1b00
call dword [0x95a12c]
test eax, eax
jne 0x902388
call fcn.009023fe
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.008ed34b
pop ecx
pop ecx
jmp 0x9023ed
test byte [0x98878c], 1
jne 0x9023a8
or dword [0x98878c], 1
mov word [0x986d20], 0xced4
mov byte [0x986d22], 0xee
xor eax, eax
mov cl, byte [eax + 0x986d20]
xor cl, 0xee
mov byte [eax + 0x986fd4], cl
inc eax
cmp eax, 3
jb 0x9023aa
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x986fd4
push eax
call fcn.008ed34b
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.008ed6fe
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.008e4ce6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x9023fe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988790], 1
jne 0x902453
or dword [0x988790], 1
mov dword [0x986d04], 0x8fa8c6ce
mov dword [0x986d08], 0x8a8b8287
mov dword [0x986d0c], 0xce819ace
mov dword [0x986d10], 0x839c8188
mov dword [0x986d14], 0x8bce9a8f
mov dword [0x986d18], 0x9c819c9c
mov word [0x986d1c], 0xeec7
xor eax, eax
mov cl, byte [eax + 0x986d04]
xor cl, 0xee
mov byte [eax + 0x986fb8], cl
inc eax
cmp eax, 0x1a
jb 0x902455
mov eax, 0x986fb8
ret

Function at 0x9025be
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988788], 1
jne 0x902607
or dword [0x988788], 1
mov dword [0x986d24], 0xa68087b9
mov dword [0x986d28], 0xa19e9a9a
mov dword [0x986d2c], 0xc6808b9e
mov dword [0x986d30], 0x8f88cec7
mov dword [0x986d34], 0x8a8b8287
mov byte [0x986d38], 0xee
xor eax, eax
mov cl, byte [eax + 0x986d24]
xor cl, 0xee
mov byte [eax + 0x986fd8], cl
inc eax
cmp eax, 0x15
jb 0x902609
mov eax, 0x986fd8
ret

Function at 0x9028ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988784], 1
jne 0x902921
or dword [0x988784], 1
mov dword [0x986d3c], 0xa68087b9
mov dword [0x986d40], 0xad9e9a9a
mov dword [0x986d44], 0x858d8f9c
mov dword [0x986d48], 0xc6829cbb
mov dword [0x986d4c], 0x8f88cec7
mov dword [0x986d50], 0x8a8b8287
mov byte [0x986d54], 0xee
xor eax, eax
mov cl, byte [eax + 0x986d3c]
xor cl, 0xee
mov byte [eax + 0x986ff0], cl
inc eax
cmp eax, 0x19
jb 0x902923
mov eax, 0x986ff0
ret

Function at 0x90293e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988780], 1
jne 0x90298a
or dword [0x988780], 1
mov dword [0x986d58], 0xa68087b9
mov dword [0x986d5c], 0xad9e9a9a
mov dword [0x986d60], 0x8b808081
mov dword [0x986d64], 0xc7c69a8d
mov dword [0x986d68], 0x878f88ce
mov dword [0x986d6c], 0xee8a8b82
xor eax, eax
mov cl, byte [eax + 0x986d58]
xor cl, 0xee
mov byte [eax + 0x98700c], cl
inc eax
cmp eax, 0x18
jb 0x90298c
mov eax, 0x98700c
ret

Function at 0x9032e4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98877c], 1
jne 0x9033bd
or dword [0x98877c], 1
mov dword [0x986d70], 0x9b9f8bbc
mov dword [0x986d74], 0xce9a9d8b
mov dword [0x986d78], 0xce829c9b
mov dword [0x986d7c], 0x8a8b9d9b
mov dword [0x986d80], 0x8ace8fce
mov dword [0x986d84], 0x8b888887
mov dword [0x986d88], 0x9a808b9c
mov dword [0x986d8c], 0x868d9dce
mov dword [0x986d90], 0xce8b838b
mov dword [0x986d94], 0x808f869a
mov dword [0x986d98], 0x8b869ace
mov dword [0x986d9c], 0x80818dce
mov dword [0x986da0], 0x9a8d8b80
mov dword [0x986da4], 0xce808187
mov dword [0x986da8], 0xce9d8f99
mov dword [0x986dac], 0x9a878087
mov dword [0x986db0], 0x87828f87
mov dword [0x986db4], 0xce8a8b94
mov dword [0x986db8], 0x869a8799
mov byte [0x986dbc], 0xee
xor eax, eax
mov cl, byte [eax + 0x986d70]
xor cl, 0xee
mov byte [eax + 0x987028], cl
inc eax
cmp eax, 0x4d
jb 0x9033bf
mov eax, 0x987028
ret
Function at 0x9033da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988778], 1
jne 0x9034b6
or dword [0x988778], 1
mov dword [0x986dc0], 0x9b9f8bbc
mov dword [0x986dc4], 0xce9a9d8b
mov dword [0x986dc8], 0xce829c9b
mov dword [0x986dcc], 0x8a8b9d9b
mov dword [0x986dd0], 0x8ace8fce
mov dword [0x986dd4], 0x8b888887
mov dword [0x986dd8], 0x9a808b9c
mov dword [0x986ddc], 0x9d8186ce
mov dword [0x986de0], 0x8f80ce9a
mov dword [0x986de4], 0x9ace8b83
mov dword [0x986de8], 0xce808f86
mov dword [0x986dec], 0xce8b869a
mov dword [0x986df0], 0x8080818d
mov dword [0x986df4], 0x879a8d8b
mov dword [0x986df8], 0x99ce8081
mov dword [0x986dfc], 0x87ce9d8f
mov dword [0x986e00], 0x879a8780
mov dword [0x986e04], 0x9487828f
mov dword [0x986e08], 0x99ce8a8b
mov dword [0x986e0c], 0xee869a87
xor eax, eax
mov cl, byte [eax + 0x986dc0]
xor cl, 0xee
mov byte [eax + 0x987078], cl
inc eax
cmp eax, 0x50
jb 0x9034b8
mov eax, 0x987078
ret

Function at 0x9034d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988774], 1
jne 0x9035ab
or dword [0x988774], 1
mov dword [0x986e10], 0x9b9f8bbc
mov dword [0x986e14], 0xce9a9d8b
mov dword [0x986e18], 0xce829c9b
mov dword [0x986e1c], 0x8a8b9d9b
mov dword [0x986e20], 0x8ace8fce
mov dword [0x986e24], 0x8b888887
mov dword [0x986e28], 0x9a808b9c
mov dword [0x986e2c], 0x9c819ece
mov dword [0x986e30], 0x869ace9a
mov dword [0x986e34], 0x9ace808f
mov dword [0x986e38], 0x8dce8b86
mov dword [0x986e3c], 0x8b808081
mov dword [0x986e40], 0x81879a8d
mov dword [0x986e44], 0x8f99ce80
mov dword [0x986e48], 0x8087ce9d
mov dword [0x986e4c], 0x8f879a87
mov dword [0x986e50], 0x8b948782
mov dword [0x986e54], 0x8799ce8a
mov word [0x986e58], 0x869a
mov byte [0x986e5a], 0xee
xor eax, eax
mov cl, byte [eax + 0x986e10]
xor cl, 0xee
mov byte [eax + 0x9870c8], cl
inc eax
cmp eax, 0x4b
jb 0x9035ad
mov eax, 0x9870c8
ret

Function at 0x9035c8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988770], 1
jne 0x90361e
or dword [0x988770], 1
mov dword [0x986e5c], 0xa68087b9
mov dword [0x986e60], 0xa19e9a9a
mov dword [0x986e64], 0xbc808b9e
mov dword [0x986e68], 0x8b9b9f8b
mov dword [0x986e6c], 0xc7c69a9d
mov dword [0x986e70], 0x878f88ce
mov dword [0x986e74], 0xee8a8b82
xor eax, eax
mov cl, byte [eax + 0x986e5c]
xor cl, 0xee
mov byte [eax + 0x987114], cl
inc eax
cmp eax, 0x1c
jb 0x903620
mov eax, 0x987114
ret
Function at 0x90363b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98876c], 1
jne 0x90370a
or dword [0x98876c], 1
mov dword [0x986e78], 0xa68087b9
mov dword [0x986e7c], 0xbd9e9a9a
mov dword [0x986e80], 0x9ea19a8b
mov dword [0x986e84], 0x8081879a
mov dword [0x986e88], 0xa0a7b9c6
mov dword [0x986e8c], 0xbebabaa6
mov dword [0x986e90], 0xbabea1b1
mov dword [0x986e94], 0xb1a0a1a7
mov dword [0x986e98], 0xbbadabbd
mov dword [0x986e9c], 0xb7baa7bc
mov dword [0x986ea0], 0xafa2a8b1
mov dword [0x986ea4], 0xcec7bda9
mov dword [0x986ea8], 0x9cce8081
mov dword [0x986eac], 0x8b9b9f8b
mov dword [0x986eb0], 0x86ce9a9d
mov dword [0x986eb4], 0x828a808f
mov dword [0x986eb8], 0x8f88ce8b
mov dword [0x986ebc], 0x8a8b8287
mov byte [0x986ec0], 0xee
xor eax, eax
mov cl, byte [eax + 0x986e78]
xor cl, 0xee
mov byte [eax + 0x987130], cl
inc eax
cmp eax, 0x49
jb 0x90370c
mov eax, 0x987130
ret

Function at 0x903727
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988768], 1
jne 0x9037f5
or dword [0x988768], 1
mov dword [0x986ec8], 0xa68087b9
mov dword [0x986ecc], 0xbd9e9a9a
mov dword [0x986ed0], 0x9ea19a8b
mov dword [0x986ed4], 0x8081879a
mov dword [0x986ed8], 0xa0a7b9c6
mov dword [0x986edc], 0xbebabaa6
mov dword [0x986ee0], 0xbabea1b1
mov dword [0x986ee4], 0xb1a0a1a7
mov dword [0x986ee8], 0xaaa0abbd
mov dword [0x986eec], 0xa3a7bab1
mov dword [0x986ef0], 0xbabba1ab
mov dword [0x986ef4], 0x8081cec7
mov dword [0x986ef8], 0x9f8b9cce
mov dword [0x986efc], 0x9a9d8b9b
mov dword [0x986f00], 0x808f86ce
mov dword [0x986f04], 0xce8b828a
mov dword [0x986f08], 0x82878f88
mov word [0x986f0c], 0x8a8b
mov byte [0x986f0e], 0xee
xor eax, eax
mov cl, byte [eax + 0x986ec8]
xor cl, 0xee
mov byte [eax + 0x987180], cl
inc eax
cmp eax, 0x47
jb 0x9037f7
mov eax, 0x987180
ret

Function at 0x903812
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988764], 1
jne 0x90387b
or dword [0x988764], 1
mov dword [0x986f10], 0xa68087b9
mov dword [0x986f14], 0xaf9e9a9a
mov dword [0x986f18], 0x8bbc8a8a
mov dword [0x986f1c], 0x9d8b9b9f
mov dword [0x986f20], 0x8f8ba69a
mov dword [0x986f24], 0x9d9c8b8a
mov dword [0x986f28], 0x88cec7c6
mov dword [0x986f2c], 0x8b82878f
mov word [0x986f30], 0xee8a
xor eax, eax
mov cl, byte [eax + 0x986f10]
xor cl, 0xee
mov byte [eax + 0x9871c8], cl
inc eax
cmp eax, 0x22
jb 0x90387d
mov eax, 0x9871c8
ret

Function at 0x903898
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988760], 1
jne 0x9038eb
or dword [0x988760], 1
mov dword [0x986f34], 0x9e9a9aa6
mov dword [0x986f38], 0x8a808bbd
mov dword [0x986f3c], 0x9b9f8bbc
mov dword [0x986f40], 0xc69a9d8b
mov dword [0x986f44], 0x8f88cec7
mov dword [0x986f48], 0x8a8b8287
mov byte [0x986f4c], 0xee
xor eax, eax
mov cl, byte [eax + 0x986f34]
xor cl, 0xee
mov byte [eax + 0x9871ec], cl
inc eax
cmp eax, 0x19
jb 0x9038ed
mov eax, 0x9871ec
ret
Function at 0x903908
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98875c], 1
jne 0x90395a
or dword [0x98875c], 1
mov dword [0x986f50], 0x9e9a9aa6
mov dword [0x986f54], 0x9c8b9bbf
mov dword [0x986f58], 0x8880a797
mov dword [0x986f5c], 0xcec7c681
mov dword [0x986f60], 0x82878f88
mov word [0x986f64], 0x8a8b
mov byte [0x986f66], 0xee
xor eax, eax
mov cl, byte [eax + 0x986f50]
xor cl, 0xee
mov byte [eax + 0x987208], cl
inc eax
cmp eax, 0x17
jb 0x90395c
mov eax, 0x987208
ret
Function at 0x90413a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988754], 1
jne 0x9041aa
or dword [0x988754], 1
mov dword [0x986f6c], 0xa68087b9
mov dword [0x986f70], 0xbf9e9a9a
mov dword [0x986f74], 0x979c8b9b
mov dword [0x986f78], 0x8f9a8faa
mov dword [0x986f7c], 0x878f98af
mov dword [0x986f80], 0x828c8f82
mov dword [0x986f84], 0xcec7c68b
mov dword [0x986f88], 0x82878f88
mov word [0x986f8c], 0x8a8b
mov byte [0x986f8e], 0xee
xor eax, eax
mov cl, byte [eax + 0x986f6c]
xor cl, 0xee
mov byte [eax + 0x987224], cl
inc eax
cmp eax, 0x23
jb 0x9041ac
mov eax, 0x987224
ret

Function at 0x9041c7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988750], 1
jne 0x90421c
or dword [0x988750], 1
mov dword [0x986f90], 0x8b9a80a7
mov dword [0x986f94], 0x9a8b809c
mov dword [0x986f98], 0x8a8f8bbc
mov dword [0x986f9c], 0x8b8287a8
mov dword [0x986fa0], 0x88cec7c6
mov dword [0x986fa4], 0x8b82878f
mov word [0x986fa8], 0xee8a
xor eax, eax
mov cl, byte [eax + 0x986f90]
xor cl, 0xee
mov byte [eax + 0x987248], cl
inc eax
cmp eax, 0x1a
jb 0x90421e
mov eax, 0x987248
ret

Function at 0x905004
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988734], 1
jne 0x90508b
or dword [0x988734], 1
mov dword [0x987280], 0x9acf81ae
mov dword [0x987284], 0x8c8a9d81
mov dword [0x987288], 0x86818880
mov dword [0x98728c], 0xcf8b8a95
mov dword [0x987290], 0x8a84809b
mov dword [0x987294], 0x8e98cf81
mov dword [0x987298], 0x8089cf9c
mov dword [0x98729c], 0xcf8b819a
mov dword [0x9872a0], 0x8ccf9b8e
mov dword [0x9872a4], 0x8e9d8e87
mov dword [0x9872a8], 0x9d8a9b8c
mov word [0x9872ac], 0xefcf
xor eax, eax
mov cl, byte [eax + 0x987280]
xor cl, 0xef
mov byte [eax + 0x9873d0], cl
inc eax
cmp eax, 0x2e
jb 0x90508d
mov eax, 0x9873d0
ret
Function at 0x9054d1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988730], 1
jne 0x90552d
or dword [0x988730], 1
mov dword [0x9872b0], 0x9c9c86a2
mov dword [0x9872b4], 0xcf888186
mov dword [0x9872b8], 0x8a83cf8e
mov dword [0x9872bc], 0x9fcf9b89
mov dword [0x9872c0], 0x818a9d8e
mov dword [0x9872c4], 0x9c8a879b
mov word [0x9872c8], 0x9c86
mov byte [0x9872ca], 0xef
xor eax, eax
mov cl, byte [eax + 0x9872b0]
xor cl, 0xef
mov byte [eax + 0x987400], cl
inc eax
cmp eax, 0x1b
jb 0x90552f
mov eax, 0x987400
ret

Function at 0x90554a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98872c], 1
jne 0x9055b3
or dword [0x98872c], 1
mov dword [0x9872cc], 0xcf9b80a1
mov dword [0x9872d0], 0x9a80818a
mov dword [0x9872d4], 0x80cf8788
mov dword [0x9872d8], 0x8e9d8a9f
mov dword [0x9872dc], 0xcf9c8b81
mov dword [0x9872e0], 0x8acf8186
mov dword [0x9872e4], 0x8a9d9f97
mov dword [0x9872e8], 0x80869c9c
mov word [0x9872ec], 0xef81
xor eax, eax
mov cl, byte [eax + 0x9872cc]
xor cl, 0xef
mov byte [eax + 0x98741c], cl
inc eax
cmp eax, 0x22
jb 0x9055b5
mov eax, 0x98741c
ret

Function at 0x9055d0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988728], 1
jne 0x905630
or dword [0x988728], 1
mov dword [0x9872f0], 0xcf8080bb
mov dword [0x9872f4], 0x96818e82
mov dword [0x9872f8], 0x8a9f80cf
mov dword [0x9872fc], 0x8b818e9d
mov dword [0x987300], 0x8186cf9c
mov dword [0x987304], 0x9f978acf
mov dword [0x987308], 0x9c9c8a9d
mov dword [0x98730c], 0xef818086
xor eax, eax
mov cl, byte [eax + 0x9872f0]
xor cl, 0xef
mov byte [eax + 0x987440], cl
inc eax
cmp eax, 0x20
jb 0x905632
mov eax, 0x987440
ret

Function at 0x90564d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988724], 1
jne 0x9056a3
or dword [0x988724], 1
mov dword [0x987310], 0x9c9c86a2
mov dword [0x987314], 0xcf888186
mov dword [0x987318], 0x869dcf8e
mov dword [0x98731c], 0xcf9b8788
mov dword [0x987320], 0x8a9d8e9f
mov dword [0x987324], 0x8a879b81
mov dword [0x987328], 0xef9c869c
xor eax, eax
mov cl, byte [eax + 0x987310]
xor cl, 0xef
mov byte [eax + 0x987460], cl
inc eax
cmp eax, 0x1c
jb 0x9056a5
mov eax, 0x987460
ret

Function at 0x9056c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988720], 1
jne 0x905731
or dword [0x988720], 1
mov dword [0x98732c], 0x9d8e81ba
mov dword [0x987330], 0x9f80cf96
mov dword [0x987334], 0x9b8e9d8a
mov dword [0x987338], 0x82cf9d80
mov dword [0x98733c], 0xcf9b9c9a
mov dword [0x987340], 0x8a998e87
mov dword [0x987344], 0x8a8180cf
mov dword [0x987348], 0x8a9f80cf
mov dword [0x98734c], 0x8b818e9d
mov byte [0x987350], 0xef
xor eax, eax
mov cl, byte [eax + 0x98732c]
xor cl, 0xef
mov byte [eax + 0x98747c], cl
inc eax
cmp eax, 0x25
jb 0x905733
mov eax, 0x98747c
ret
Function at 0x90574e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98871c], 1
jne 0x9057c8
or dword [0x98871c], 1
mov dword [0x987354], 0x8e8186ad
mov dword [0x987358], 0x80cf969d
mov dword [0x98735c], 0x8e9d8a9f
mov dword [0x987360], 0xcf9d809b
mov dword [0x987364], 0x9b9c9a82
mov dword [0x987368], 0x998e87cf
mov dword [0x98736c], 0x989bcf8a
mov dword [0x987370], 0x9f80cf80
mov dword [0x987374], 0x818e9d8a
mov word [0x987378], 0x9c8b
mov byte [0x98737a], 0xef
xor eax, eax
mov cl, byte [eax + 0x987354]
xor cl, 0xef
mov byte [eax + 0x9874a4], cl
inc eax
cmp eax, 0x27
jb 0x9057ca
mov eax, 0x9874a4
ret

Function at 0x9057e5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988718], 1
jne 0x90584e
or dword [0x988718], 1
mov dword [0x98737c], 0x8e8186ad
mov dword [0x987380], 0x80cf969d
mov dword [0x987384], 0x8e9d8a9f
mov dword [0x987388], 0xcf9d809b
mov dword [0x98738c], 0xcf9b8081
mov dword [0x987390], 0x839f8286
mov dword [0x987394], 0x818a828a
mov dword [0x987398], 0xd58b8a9b
mov word [0x98739c], 0xefcf
xor eax, eax
mov cl, byte [eax + 0x98737c]
xor cl, 0xef
mov byte [eax + 0x9874cc], cl
inc eax
cmp eax, 0x22
jb 0x905850
mov eax, 0x9874cc
ret
Function at 0x907200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x907242
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x971f08]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x971f08]
inc edx
cmp dword [ebp + 8], 0
jne 0x90720d
pop esi
not eax
pop ebp
ret

Function at 0x908e8d
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x908eb2
cmp dword [ecx + 0x38], ebx
je 0x908eb2
cmp eax, dword [ecx + 0x10]
jae 0x908eb2
cmp dword [ecx + 0x14], 1
jne 0x908eb2
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x908eb4
xor edi, edi
cmp edi, ebx
je 0x908f97
cmp esi, ebx
je 0x908f97
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00908636
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x908f43
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0092f0d0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x908f68
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0092f0d0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x908f99
xor eax, eax
pop edi
pop ebx
ret

Function at 0x909972
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98870c], 1
jne 0x9099f7
or dword [0x98870c], 1
mov dword [0x987508], 0x9c9991b6
mov dword [0x98750c], 0x84d09495
mov dword [0x987510], 0x8293d09f
mov dword [0x987514], 0x95849195
mov dword [0x987518], 0x91859cd0
mov dword [0x98751c], 0x918483d0
mov dword [0x987520], 0xd8d09584
mov dword [0x987524], 0x9b829f87
mov dword [0x987528], 0x84d08295
mov dword [0x98752c], 0x91958298
mov dword [0x987530], 0xd0cad994
mov byte [0x987534], 0xf0
xor eax, eax
mov cl, byte [eax + 0x987508]
xor cl, 0xf0
mov byte [eax + 0x9875d0], cl
inc eax
cmp eax, 0x2d
jb 0x9099f9
mov eax, 0x9875d0
ret