joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbb44a4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d2c], 1
jne 0xbb4518
or dword [0xc58d2c], 1
mov dword [0xc52f0c], 0x2b23044b
mov dword [0xc52f10], 0x6226272e
mov dword [0xc52f14], 0x25622d36
mov dword [0xc52f18], 0x31623627
mov dword [0xc52f1c], 0x78782636
mov dword [0xc52f20], 0x27213a27
mov dword [0xc52f24], 0x2d2b3632
mov dword [0xc52f28], 0x3578782c
mov dword [0xc52f2c], 0x6a36232a
mov dword [0xc52f30], 0x42484f6b
xor eax, eax
mov cl, byte [eax + 0xc52f0c]
xor cl, 0x42
mov byte [eax + 0xc535b8], cl
inc eax
cmp eax, 0x28
jb 0xbb451a
mov eax, 0xc535b8
ret

Function at 0xbb4535
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d28], 1
jne 0xbb4569
or dword [0xc58d28], 1
mov dword [0xc52f34], 0x2f2d211d
mov dword [0xc52f38], 0x3030271d
mov word [0xc52f3c], 0x302d
mov byte [0xc52f3e], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52f34]
xor cl, 0x42
mov byte [eax + 0xc535e0], cl
inc eax
cmp eax, 0xb
jb 0xbb456b
mov eax, 0xc535e0
ret

Function at 0xbb4586
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d24], 1
jne 0xbb45ef
or dword [0xc58d24], 1
mov dword [0xc52f40], 0x2d211d4b
mov dword [0xc52f44], 0x30271d2f
mov dword [0xc52f48], 0x78302d30
mov dword [0xc52f4c], 0x30300778
mov dword [0xc52f50], 0x270f302d
mov dword [0xc52f54], 0x25233131
mov dword [0xc52f58], 0x786b6a27
mov dword [0xc52f5c], 0x4f316762
mov word [0xc52f60], 0x4248
xor eax, eax
mov cl, byte [eax + 0xc52f40]
xor cl, 0x42
mov byte [eax + 0xc535ec], cl
inc eax
cmp eax, 0x22
jb 0xbb45f1
mov eax, 0xc535ec
ret

Function at 0xbb460c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d20], 1
jne 0xbb468a
or dword [0xc58d20], 1
mov dword [0xc52f64], 0x2b23044b
mov dword [0xc52f68], 0x6226272e
mov dword [0xc52f6c], 0x25622d36
mov dword [0xc52f70], 0x1d623627
mov dword [0xc52f74], 0x1d2f2d21
mov dword [0xc52f78], 0x2d303027
mov dword [0xc52f7c], 0x7787830
mov dword [0xc52f80], 0x302d3030
mov dword [0xc52f84], 0x3131270f
mov dword [0xc52f88], 0x6a272523
mov dword [0xc52f8c], 0x42484f6b
xor eax, eax
mov cl, byte [eax + 0xc52f64]
xor cl, 0x42
mov byte [eax + 0xc53610], cl
inc eax
cmp eax, 0x2c
jb 0xbb468c
mov eax, 0xc53610
ret

Function at 0xbb46a7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d1c], 1
jne 0xbb4722
or dword [0xc58d1c], 1
mov dword [0xc52f90], 0x21233611
mov dword [0xc52f94], 0x37266229
mov dword [0xc52f98], 0x2762322f
mov dword [0xc52f9c], 0x302d3030
mov dword [0xc52fa0], 0x2d016278
mov dword [0xc52fa4], 0x3a27362c
mov dword [0xc52fa8], 0x21271036
mov dword [0xc52fac], 0x6226302d
mov dword [0xc52fb0], 0x62312335
mov dword [0xc52fb4], 0x2e2e372c
mov byte [0xc52fb8], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52f90]
xor cl, 0x42
mov byte [eax + 0xc5363c], cl
inc eax
cmp eax, 0x29
jb 0xbb4724
mov eax, 0xc5363c
ret
Function at 0xbb473f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d18], 1
jne 0xbb47b9
or dword [0xc58d18], 1
mov dword [0xc52fbc], 0x21233611
mov dword [0xc52fc0], 0x37266229
mov dword [0xc52fc4], 0x2762322f
mov dword [0xc52fc8], 0x302d3030
mov dword [0xc52fcc], 0x3b116278
mov dword [0xc52fd0], 0x2b2c0b2f
mov dword [0xc52fd4], 0x2e232b36
mov dword [0xc52fd8], 0x6227382b
mov dword [0xc52fdc], 0x2e2b2324
mov word [0xc52fe0], 0x2627
mov byte [0xc52fe2], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52fbc]
xor cl, 0x42
mov byte [eax + 0xc53668], cl
inc eax
cmp eax, 0x27
jb 0xbb47bb
mov eax, 0xc53668
ret

Function at 0xbb47d6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d14], 1
jne 0xbb483c
or dword [0xc58d14], 1
mov dword [0xc52fe4], 0x2b29317e
mov dword [0xc52fe8], 0x26273232
mov dword [0xc52fec], 0x23302462
mov dword [0xc52ff0], 0x626e272f
mov dword [0xc52ff4], 0x35620112
mov dword [0xc52ff8], 0x2c623123
mov dword [0xc52ffc], 0x7c2e2e37
mov word [0xc53000], 0x484f
mov byte [0xc53002], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52fe4]
xor cl, 0x42
mov byte [eax + 0xc53690], cl
inc eax
cmp eax, 0x1f
jb 0xbb483e
mov eax, 0xc53690
ret

Function at 0xbb4859
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d10], 1
jne 0xbb48ec
or dword [0xc58d10], 1
mov dword [0xc53004], 0x2b29317e
mov dword [0xc53008], 0x26273232
mov dword [0xc5300c], 0x23302462
mov dword [0xc53010], 0x626e272f
mov dword [0xc53014], 0x35620112
mov dword [0xc53018], 0x31623123
mov dword [0xc5301c], 0x62272f23
mov dword [0xc53020], 0x30623123
mov dword [0xc53024], 0x30373627
mov dword [0xc53028], 0x2623622c
mov dword [0xc5302c], 0x31273026
mov dword [0xc53030], 0x484f7c31
mov byte [0xc53034], 0x42
xor eax, eax
mov cl, byte [eax + 0xc53004]
xor cl, 0x42
mov byte [eax + 0xc536b0], cl
inc eax
cmp eax, 0x31
jb 0xbb48ee
mov eax, 0xc536b0
ret
Function at 0xbb4909
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.00c0eb50
push ebx
push esi
push edi
call dword [0xc2a094]
test byte [0xc58d0c], 1
mov dword [ebp - 4], eax
jne 0xbb4950
or dword [0xc58d0c], 1
mov dword [0xc53038], 0x262d2f7e
mov dword [0xc5303c], 0x7d272e37
mov dword [0xc53040], 0x427c7d7d
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0xc53038]
xor cl, 0x42
mov byte [eax + 0xc536e4], cl
inc eax
cmp eax, 0xc
jb 0xbb4954
test byte [0xc58d08], 1
mov dword [ebp - 8], 0xc536e4
jne 0xbb499e
or dword [0xc58d08], 1
mov dword [0xc53044], 0x2f3b317e
mov dword [0xc53048], 0x7d2e2d20
mov dword [0xc5304c], 0x427c7d7d
xor eax, eax
mov cl, byte [eax + 0xc53044]
xor cl, 0x42
mov byte [eax + 0xc536f0], cl
inc eax
cmp eax, 0xc
jb 0xbb49a0
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0xc536f0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00bff010
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0xc2a3b0]
test eax, eax
je 0xbb4a05
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.00bff010
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0xc2a3bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0xbb4a51
mov ecx, dword [ebp - 0x1c]
test byte [0xc58d04], 1
jne 0xbb4a88
or dword [0xc58d04], 1
mov dword [0xc53050], 0x67623267
mov dword [0xc53054], 0x31676331
mov dword [0xc53058], 0x673a7269
mov word [0xc5305c], 0x423a
xor eax, eax
mov dl, byte [eax + 0xc53050]
xor dl, 0x42
mov byte [eax + 0xc536fc], dl
inc eax
cmp eax, 0xe
jb 0xbb4a8a
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0xc536fc
push dword [ebp + 0xc]
call fcn.00bfc23d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0xc2a3a4]
test eax, eax
je 0xbb4b01
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00bb4b4e
push eax
push dword [ebp + 0xc]
call fcn.00bfc23d
add esp, 0x14
test byte [0xc58cfc], 1
jne 0xbb4b21
or dword [0xc58cfc], 1
mov word [0xc53070], 0x484f
mov byte [0xc53072], 0x42
xor eax, eax
mov cl, byte [eax + 0xc53070]
xor cl, 0x42
mov byte [eax + 0xc5371c], cl
inc eax
cmp eax, 3
jb 0xbb4b23
push dword [ebp + 0xc]
push 0xc5371c
call fcn.00bfbeb1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xbb4b4e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d00], 1
jne 0xbb4b86
or dword [0xc58d00], 1
mov dword [0xc53060], 0x31676a62
mov dword [0xc53064], 0x62266778
mov dword [0xc53068], 0x3a726269
mov dword [0xc5306c], 0x426b3a67
xor eax, eax
mov cl, byte [eax + 0xc53060]
xor cl, 0x42
mov byte [eax + 0xc5370c], cl
inc eax
cmp eax, 0x10
jb 0xbb4b88
mov eax, 0xc5370c
ret

Function at 0xbb5e30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xc58cf0], 1
jne 0xbb5e87
or dword [0xc58cf0], 1
mov dword [0xc53740], 0x711020b
mov dword [0xc53744], 0x6110214
mov dword [0xc53748], 0x1300021f
mov dword [0xc5374c], 0x10071f0a
mov dword [0xc53750], 0x151f1707
mov dword [0xc53754], 0x1c1b0c01
mov word [0xc53758], 0x431c
mov cl, byte [eax + 0xc53740]
xor cl, 0x43
mov byte [eax + 0xc53940], cl
inc eax
cmp eax, 0x1a
jb 0xbb5e87
mov eax, 0xc53940
ret

Function at 0xbb5f96
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cec], 1
jne 0xbb5fc0
or dword [0xc58cec], 1
mov dword [0xc5375c], 0x22140e15
mov word [0xc53760], 0x2631
mov byte [0xc53762], 0x43
xor eax, eax
mov cl, byte [eax + 0xc5375c]
xor cl, 0x43
mov byte [eax + 0xc5395c], cl
inc eax
cmp eax, 7
jb 0xbb5fc2
mov eax, 0xc5395c
ret

Function at 0xbb5fdd
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xc58ce8], 1
jne 0xbb600c
or dword [0xc58ce8], 1
mov dword [0xc53764], 0x37312a15
mov dword [0xc53768], 0x132f2236
mov word [0xc5376c], 0x4300
mov cl, byte [eax + 0xc53764]
xor cl, 0x43
mov byte [eax + 0xc53964], cl
inc eax
cmp eax, 0xa
jb 0xbb600c
mov eax, 0xc53964
ret

Function at 0xbb6027
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58ce4], 1
jne 0xbb605b
or dword [0xc58ce4], 1
mov dword [0xc53770], 0x37312a15
mov dword [0xc53774], 0x12f2236
mov word [0xc53778], 0x3b2c
mov byte [0xc5377a], 0x43
xor eax, eax
mov cl, byte [eax + 0xc53770]
xor cl, 0x43
mov byte [eax + 0xc53970], cl
inc eax
cmp eax, 0xb
jb 0xbb605d
mov eax, 0xc53970
ret

Function at 0xbb6078
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58ce0], 1
jne 0xbb609c
or dword [0xc58ce0], 1
mov dword [0xc5377c], 0x262d2604
mov dword [0xc53780], 0x43202a31
xor eax, eax
mov cl, byte [eax + 0xc5377c]
xor cl, 0x43
mov byte [eax + 0xc5397c], cl
inc eax
cmp eax, 8
jb 0xbb609e
mov eax, 0xc5397c
ret
Function at 0xbb60b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xc2337f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0xc58cdc], 1
push esi
jne 0xbb610c
or dword [0xc58cdc], 1
mov dword [0xc53784], 0x2f27372d
mov dword [0xc53788], 0x2f276d2f
mov word [0xc5378c], 0x432f
xor eax, eax
mov cl, byte [eax + 0xc53784]
xor cl, 0x43
mov byte [eax + 0xc53984], cl
inc eax
cmp eax, 0xa
jb 0xbb610e
push 0xc53984
call dword [0xc2a0cc]
mov esi, eax
test esi, esi
jne 0xbb6180
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.00bb62c7
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
push eax
call fcn.00c05956
call fcn.00bb632d
push eax
push esi
call dword [0xc2a0c8]
test eax, eax
jne 0xbb61dd
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00bb639f
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
jmp 0xbb617a
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0xbb6265
cmp dword [esp + 4], 0x18
jne 0xbb6265
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0xc2a0c4]
test eax, eax
jne 0xbb62b4
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.00bb64df
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
jmp 0xbb617a
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00bb6452
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
jmp 0xbb617a
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xbb62c7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cd8], 1
jne 0xbb6310
or dword [0xc58cd8], 1
mov dword [0xc53790], 0x27222c0f
mov dword [0xc53794], 0x31212a0f
mov dword [0xc53798], 0x633a3122
mov dword [0xc5379c], 0x2f2a2225
mov dword [0xc537a0], 0x63792726
mov byte [0xc537a4], 0x43
xor eax, eax
mov cl, byte [eax + 0xc53790]
xor cl, 0x43
mov byte [eax + 0xc53990], cl
inc eax
cmp eax, 0x15
jb 0xbb6312
mov eax, 0xc53990
ret
Function at 0xbb632d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cd4], 1
jne 0xbb6382
or dword [0xc58cd4], 1
mov dword [0xc537a8], 0x3612370d
mov dword [0xc537ac], 0xa3a3126
mov dword [0xc537b0], 0x312c252d
mov dword [0xc537b4], 0x2a37222e
mov dword [0xc537b8], 0x31132d2c
mov dword [0xc537bc], 0x3026202c
mov word [0xc537c0], 0x4330
xor eax, eax
mov cl, byte [eax + 0xc537a8]
xor cl, 0x43
mov byte [eax + 0xc539a8], cl
inc eax
cmp eax, 0x1a
jb 0xbb6384
mov eax, 0xc539a8
ret

Function at 0xbb639f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cd0], 1
jne 0xbb6435
or dword [0xc58cd0], 1
mov dword [0xc537c4], 0x13372604
mov dword [0xc537c8], 0x2202c31
mov dword [0xc537cc], 0x26312727
mov dword [0xc537d0], 0x25633030
mov dword [0xc537d4], 0x262f2a22
mov dword [0xc537d8], 0xd6b6327
mov dword [0xc537dc], 0x26361237
mov dword [0xc537e0], 0x2d0a3a31
mov dword [0xc537e4], 0x2e312c25
mov dword [0xc537e8], 0x2c2a3722
mov dword [0xc537ec], 0x2c31132d
mov dword [0xc537f0], 0x30302620
mov dword [0xc537f4], 0x4363796a
xor eax, eax
mov cl, byte [eax + 0xc537c4]
xor cl, 0x43
mov byte [eax + 0xc539c4], cl
inc eax
cmp eax, 0x34
jb 0xbb6437
mov eax, 0xc539c4
ret

Function at 0xbb6452
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58ccc], 1
jne 0xbb64c2
or dword [0xc58ccc], 1
mov dword [0xc537f8], 0x3612370d
mov dword [0xc537fc], 0xa3a3126
mov dword [0xc53800], 0x312c252d
mov dword [0xc53804], 0x2a37222e
mov dword [0xc53808], 0x31132d2c
mov dword [0xc5380c], 0x3026202c
mov dword [0xc53810], 0x22256330
mov dword [0xc53814], 0x27262f2a
mov word [0xc53818], 0x6379
mov byte [0xc5381a], 0x43
xor eax, eax
mov cl, byte [eax + 0xc537f8]
xor cl, 0x43
mov byte [eax + 0xc539f8], cl
inc eax
cmp eax, 0x23
jb 0xbb64c4
mov eax, 0xc539f8
ret

Function at 0xbb64df
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cc8], 1
jne 0xbb6528
or dword [0xc58cc8], 1
mov dword [0xc5381c], 0x2d26330c
mov dword [0xc53820], 0x202c3113
mov dword [0xc53824], 0x63303026
mov dword [0xc53828], 0x2f2a2225
mov dword [0xc5382c], 0x63792726
mov byte [0xc53830], 0x43
xor eax, eax
mov cl, byte [eax + 0xc5381c]
xor cl, 0x43
mov byte [eax + 0xc53a1c], cl
inc eax
cmp eax, 0x15
jb 0xbb652a
mov eax, 0xc53a1c
ret
Function at 0xbb6545
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xc2332c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0xc58cc4], 1
push esi
push edi
jne 0xbb65a2
or dword [0xc58cc4], 1
mov dword [0xc53834], 0x2d312628
mov dword [0xc53838], 0x71702f26
mov dword [0xc5383c], 0x2f2f276d
mov byte [0xc53840], 0x43
xor eax, eax
mov cl, byte [eax + 0xc53834]
xor cl, 0x43
mov byte [eax + 0xc53a34], cl
inc eax
cmp eax, 0xd
jb 0xbb65a4
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0xc53a34
call edi
mov esi, eax
test esi, esi
jne 0xbb6618
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00bb677a
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
push eax
call fcn.00c05956
call fcn.00bb67f7
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0xbb66e5
call fcn.00bb686a
push eax
call edi
mov edi, eax
test edi, edi
jne 0xbb6689
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.00bb68b4
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
jmp 0xbb6612
call fcn.00bb692e
push eax
push edi
call esi
test eax, eax
jne 0xbb66e5
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00bb699e
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
jmp 0xbb6612
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0xbb6747
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00bda8bc
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00bb6a57
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00bb6b18
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00bb5c01
push 0xc444a0
mov eax, esi
jmp 0xbb6612
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00bb4c87
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xbb677a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cc0], 1
jne 0xbb67da
or dword [0xc58cc0], 1
mov dword [0xc53844], 0x27222c0f
mov dword [0xc53848], 0x31212a0f
mov dword [0xc5384c], 0x633a3122
mov dword [0xc53850], 0x2f2a2225
mov dword [0xc53854], 0x6b632726
mov dword [0xc53858], 0x2d312628
mov dword [0xc5385c], 0x71702f26
mov dword [0xc53860], 0x4363796a
xor eax, eax
mov cl, byte [eax + 0xc53844]
xor cl, 0x43
mov byte [eax + 0xc53a44], cl
inc eax
cmp eax, 0x20
jb 0xbb67dc
mov eax, 0xc53a44
ret
Function at 0xbb67f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cbc], 1
jne 0xbb684d
or dword [0xc58cbc], 1
mov dword [0xc53864], 0x4717008
mov dword [0xc53868], 0x31133726
mov dword [0xc5386c], 0x3026202c
mov dword [0xc53870], 0x222e0a30
mov dword [0xc53874], 0x2a052624
mov dword [0xc53878], 0x220d262f
mov dword [0xc5387c], 0x4302262e
xor eax, eax
mov cl, byte [eax + 0xc53864]
xor cl, 0x43
mov byte [eax + 0xc53a64], cl
inc eax
cmp eax, 0x1c
jb 0xbb684f
mov eax, 0xc53a64
ret

Function at 0xbb686a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cb8], 1
jne 0xbb6897
or dword [0xc58cb8], 1
mov dword [0xc53880], 0x33223033
mov dword [0xc53884], 0x2f276d2a
mov word [0xc53888], 0x432f
xor eax, eax
mov cl, byte [eax + 0xc53880]
xor cl, 0x43
mov byte [eax + 0xc53a80], cl
inc eax
cmp eax, 0xa
jb 0xbb6899
mov eax, 0xc53a80
ret

Function at 0xbb68b4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cb4], 1
jne 0xbb6911
or dword [0xc58cb4], 1
mov dword [0xc5388c], 0x27222c0f
mov dword [0xc53890], 0x31212a0f
mov dword [0xc53894], 0x633a3122
mov dword [0xc53898], 0x2f2a2225
mov dword [0xc5389c], 0x6b632726
mov dword [0xc538a0], 0x33223033
mov dword [0xc538a4], 0x63796a2a
mov byte [0xc538a8], 0x43
xor eax, eax
mov cl, byte [eax + 0xc5388c]
xor cl, 0x43
mov byte [eax + 0xc53a8c], cl
inc eax
cmp eax, 0x1d
jb 0xbb6913
mov eax, 0xc53a8c
ret

Function at 0xbb692e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cb0], 1
jne 0xbb6981
or dword [0xc58cb0], 1
mov dword [0xc538ac], 0x13372604
mov dword [0xc538b0], 0x26202c31
mov dword [0xc538b4], 0x2e0a3030
mov dword [0xc538b8], 0x5262422
mov dword [0xc538bc], 0xd262f2a
mov dword [0xc538c0], 0x2262e22
mov byte [0xc538c4], 0x43
xor eax, eax
mov cl, byte [eax + 0xc538ac]
xor cl, 0x43
mov byte [eax + 0xc53aac], cl
inc eax
cmp eax, 0x19
jb 0xbb6983
mov eax, 0xc53aac
ret

Function at 0xbb699e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58cac], 1
jne 0xbb6a3a
or dword [0xc58cac], 1
mov dword [0xc538c8], 0x13372604
mov dword [0xc538cc], 0x2202c31
mov dword [0xc538d0], 0x26312727
mov dword [0xc538d4], 0x25633030
mov dword [0xc538d8], 0x262f2a22
mov dword [0xc538dc], 0x46b6327
mov dword [0xc538e0], 0x31133726
mov dword [0xc538e4], 0x3026202c
mov dword [0xc538e8], 0x222e0a30
mov dword [0xc538ec], 0x2a052624
mov dword [0xc538f0], 0x220d262f
mov dword [0xc538f4], 0x6a02262e
mov word [0xc538f8], 0x6379
mov byte [0xc538fa], 0x43
xor eax, eax
mov cl, byte [eax + 0xc538c8]
xor cl, 0x43
mov byte [eax + 0xc53ac8], cl
inc eax
cmp eax, 0x33
jb 0xbb6a3c
mov eax, 0xc53ac8
ret

Function at 0xbb6a57
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58ca8], 1
jne 0xbb6abe
or dword [0xc58ca8], 1
mov dword [0xc538fc], 0x13372604
mov dword [0xc53900], 0x26202c31
mov dword [0xc53904], 0x2e0a3030
mov dword [0xc53908], 0x5262422
mov dword [0xc5390c], 0x2d262f2a
mov dword [0xc53910], 0x63262e22
mov dword [0xc53914], 0x2f2a2225
mov dword [0xc53918], 0x63792726
mov byte [0xc5391c], 0x43
xor eax, eax
mov cl, byte [eax + 0xc538fc]
xor cl, 0x43
mov byte [eax + 0xc53afc], cl
inc eax
cmp eax, 0x21
jb 0xbb6ac0
mov eax, 0xc53afc
ret
Function at 0xbb768c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58ca4], 1
jne 0xbb7872
or dword [0xc58ca4], 1
mov dword [0xc53b28], 0x376a2b2d
mov dword [0xc53b2c], 0x312b2030
mov dword [0xc53b30], 0x21377e30
mov dword [0xc53b34], 0x31263230
mov dword [0xc53b38], 0x2a636c22
mov dword [0xc53b3c], 0x4e6d632b
mov dword [0xc53b40], 0x2f272534
mov dword [0xc53b44], 0x6a212325
mov dword [0xc53b48], 0x2c302534
mov dword [0xc53b4c], 0x63647964
mov dword [0xc53b50], 0x21364e63
mov dword [0xc53b54], 0x362d3135
mov dword [0xc53b58], 0x37636c21
mov dword [0xc53b5c], 0x272d3630
mov dword [0xc53b60], 0x4e6d6330
mov dword [0xc53b64], 0x25272b28
mov dword [0xc53b68], 0x68376428
mov dword [0xc53b6c], 0x79643664
mov dword [0xc53b70], 0x27343c64
mov dword [0xc53b74], 0x6c282825
mov dword [0xc53b78], 0x272a3122
mov dword [0xc53b7c], 0x2a2b2d30
mov dword [0xc53b80], 0x36646d6c
mov dword [0xc53b84], 0x36313021
mov dword [0xc53b88], 0x2136642a
mov dword [0xc53b8c], 0x362d3135
mov dword [0xc53b90], 0x61636c21
mov dword [0xc53b94], 0x6a6d6309
mov dword [0xc53b98], 0x2a2d2529
mov dword [0xc53b9c], 0x251b1b6c
mov dword [0xc53ba0], 0x6d372336
mov dword [0xc53ba4], 0x202a2164
mov dword [0xc53ba8], 0x21206468
mov dword [0xc53bac], 0x6a233126
mov dword [0xc53bb0], 0x27253630
mov dword [0xc53bb4], 0x27252621
mov dword [0xc53bb8], 0x2d4e6d2f
mov dword [0xc53bbc], 0x2b2a6422
mov dword [0xc53bc0], 0x64376430
mov dword [0xc53bc4], 0x2a212c30
mov dword [0xc53bc8], 0x36362164
mov dword [0xc53bcc], 0x366c362b
mov dword [0xc53bd0], 0x2a21646d
mov dword [0xc53bd4], 0x21364e20
mov dword [0xc53bd8], 0x2a363130
mov word [0xc53bdc], 0x3664
mov byte [0xc53bde], 0x44
xor eax, eax
mov cl, byte [eax + 0xc53b28]
xor cl, 0x44
mov byte [eax + 0xc54118], cl
inc eax
cmp eax, 0xb7
jb 0xbb7874
mov eax, 0xc54118
ret