joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb486bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xbcf29c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.00b6fa7e
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.00b6de4e
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.00b44dd1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.00b4bd19
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0xb48749
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.00b7205e
add esp, 0x10
test al, al
jne 0xb4878e
call fcn.00b48805
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00ba6955
push 0xbf2d18
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00bb0865
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.00b4bd19
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0xb487ce
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0xb487ad
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.00b4b042
lea esi, [esp + 0x20]
call fcn.00b4bd00
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00b44c93
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xb48805
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08304], 1
jne 0xb4884e
or dword [0xc08304], 1
mov dword [0xc02fdc], 0x3a2c3e1d
mov dword [0xc02fe0], 0x3b7f6b69
mov dword [0xc02fe4], 0x3b303c3a
mov dword [0xc02fe8], 0x3e397f3a
mov dword [0xc02fec], 0x3b3a3336
mov byte [0xc02ff0], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc02fdc]
xor cl, 0x5f
mov byte [eax + 0xc0370c], cl
inc eax
cmp eax, 0x15
jb 0xb48850
mov eax, 0xc0370c
ret

Function at 0xb48f11
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08300], 1
jne 0xb48f66
or dword [0xc08300], 1
mov dword [0xc02ff4], 0x332a301c
mov dword [0xc02ff8], 0x30317f3b
mov dword [0xc02ffc], 0x2f307f2b
mov dword [0xc03000], 0x3c7f313a
mov dword [0xc03004], 0x372c3e2d
mov dword [0xc03008], 0x322a3b7f
mov word [0xc0300c], 0x5f2f
xor eax, eax
mov cl, byte [eax + 0xc02ff4]
xor cl, 0x5f
mov byte [eax + 0xc03724], cl
inc eax
cmp eax, 0x1a
jb 0xb48f68
mov eax, 0xc03724
ret
Function at 0xb48f83
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082f8], 1
jne 0xb48fa6
or dword [0xc082f8], 1
mov dword [0xc03014], 0x38303370
mov word [0xc03018], 0x5f70
xor eax, eax
mov cl, byte [eax + 0xc03014]
xor cl, 0x5f
mov byte [eax + 0xc03744], cl
inc eax
cmp eax, 6
jb 0xb48fa8
mov eax, 0xc03744
ret

Function at 0xb48fc6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082f4], 1
jne 0xb49041
or dword [0xc082f4], 1
mov dword [0xc0301c], 0x2f2b2b37
mov dword [0xc03020], 0x3e707065
mov dword [0xc03024], 0x26333e31
mov dword [0xc03028], 0x2c3c362b
mov dword [0xc0302c], 0x2b3a3871
mov dword [0xc03030], 0x3128303b
mov dword [0xc03034], 0x2b2c3a2b
mov dword [0xc03038], 0x32303c71
mov dword [0xc0303c], 0x706d2970
mov dword [0xc03040], 0x70383033
mov byte [0xc03044], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc0301c]
xor cl, 0x5f
mov byte [eax + 0xc0374c], cl
inc eax
cmp eax, 0x29
jb 0xb49043
mov eax, 0xc0374c
ret

Function at 0xb4905e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082f0], 1
jne 0xb49089
or dword [0xc082f0], 1
mov dword [0xc03048], 0x2c79623c
mov dword [0xc0304c], 0x622b7962
mov byte [0xc03050], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc03048]
xor cl, 0x5f
mov byte [eax + 0xc03778], cl
inc eax
cmp eax, 9
jb 0xb4908b
mov eax, 0xc03778
ret

Function at 0xb490a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082e0], 1
jne 0xb4912e
or dword [0xc082e0], 1
mov dword [0xc03064], 0x2b31301c
mov dword [0xc03068], 0x722b313a
mov dword [0xc0306c], 0x3a2f260b
mov dword [0xc03070], 0x2f3e7f65
mov dword [0xc03074], 0x3c36332f
mov dword [0xc03078], 0x30362b3e
mov dword [0xc0307c], 0x72277031
mov dword [0xc03080], 0x72282828
mov dword [0xc03084], 0x322d3039
mov dword [0xc03088], 0x332d2a72
mov dword [0xc0308c], 0x303c313a
mov dword [0xc03090], 0x5f3b3a3b
xor eax, eax
mov cl, byte [eax + 0xc03064]
xor cl, 0x5f
mov byte [eax + 0xc03794], cl
inc eax
cmp eax, 0x30
jb 0xb49130
mov eax, 0xc03794
ret

Function at 0xb4914b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082dc], 1
jne 0xb49176
or dword [0xc082dc], 1
mov dword [0xc03094], 0xb0c100f
mov dword [0xc03098], 0x7f302b7f
mov byte [0xc0309c], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc03094]
xor cl, 0x5f
mov byte [eax + 0xc037c4], cl
inc eax
cmp eax, 9
jb 0xb49178
mov eax, 0xc037c4
ret

Function at 0xb49193
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082d8], 1
jne 0xb491dc
or dword [0xc082d8], 1
mov dword [0xc030a0], 0x363e397f
mov dword [0xc030a4], 0x7f3b3a33
mov dword [0xc030a8], 0x372b3628
mov dword [0xc030ac], 0x3e2b2c7f
mov dword [0xc030b0], 0x7f2c2a2b
mov byte [0xc030b4], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc030a0]
xor cl, 0x5f
mov byte [eax + 0xc037d0], cl
inc eax
cmp eax, 0x15
jb 0xb491de
mov eax, 0xc037d0
ret
Function at 0xb49b20
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082b0], 1
jne 0xb49b7c
or dword [0xc082b0], 1
mov dword [0xc03120], 0x33363e19
mov dword [0xc03124], 0x2b7f3b3a
mov dword [0xc03128], 0x3a2d7f30
mov dword [0xc0312c], 0x307f3b3e
mov dword [0xc03130], 0x307f2d2a
mov dword [0xc03134], 0x3a7f3128
mov word [0xc03138], 0x3a27
mov byte [0xc0313a], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc03120]
xor cl, 0x5f
mov byte [eax + 0xc03850], cl
inc eax
cmp eax, 0x1b
jb 0xb49b7e
mov eax, 0xc03850
ret

Function at 0xb49bfa
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082ac], 1
jne 0xb49c46
or dword [0xc082ac], 1
mov dword [0xc0313c], 0x132b3a18
mov dword [0xc03140], 0x162b2c3e
mov dword [0xc03144], 0x2b2a2f31
mov dword [0xc03148], 0x30393116
mov dword [0xc0314c], 0x363e397f
mov dword [0xc03150], 0x5f3b3a33
xor eax, eax
mov cl, byte [eax + 0xc0313c]
xor cl, 0x5f
mov byte [eax + 0xc0386c], cl
inc eax
cmp eax, 0x18
jb 0xb49c48
mov eax, 0xc0386c
ret

Function at 0xb49f5a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082a8], 1
mov ecx, 0xc45f
jne 0xb49fbf
or dword [0xc082a8], 1
lea eax, [ecx - 0x28]
mov word [0xc03154], ax
add eax, 0xfffffff4
mov edx, eax
mov word [0xc03158], ax
lea eax, [ecx - 0x30]
mov word [0xc0315a], ax
add eax, 0xfffffffd
mov word [0xc0315c], ax
lea eax, [ecx + 6]
mov word [0xc0315e], ax
add eax, 0xb
mov word [0xc03156], dx
mov edx, eax
mov word [0xc03162], ax
mov eax, ecx
mov word [0xc03160], dx
mov word [0xc03164], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc03154]
add eax, 2
mov word [eax + 0xc03882], dx
cmp eax, 0x12
jb 0xb49fc1
mov eax, 0xc03884
ret

Function at 0xb49fdf
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc082a4], 1
mov ecx, 0xc45f
jne 0xb4a03b
or dword [0xc082a4], 1
lea eax, [ecx - 0x28]
mov word [0xc03168], ax
add eax, 0xfffffff4
mov edx, eax
mov word [0xc0316c], ax
lea eax, [ecx - 0x30]
mov word [0xc0316e], ax
add eax, 0x36
mov word [0xc03170], ax
lea eax, [ecx + 0x11]
mov word [0xc0316a], dx
mov edx, eax
mov word [0xc03174], ax
mov eax, ecx
mov word [0xc03172], dx
mov word [0xc03176], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc03168]
add eax, 2
mov word [eax + 0xc03896], dx
cmp eax, 0x10
jb 0xb4a03d
mov eax, 0xc03898
ret

Function at 0xb4a05b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0829c], 1
jne 0xb4a0a4
or dword [0xc0829c], 1
mov dword [0xc03184], 0x182c311b
mov dword [0xc03188], 0x3e1c2b3a
mov dword [0xc0318c], 0x1b3a373c
mov dword [0xc03190], 0xb3e2b3e
mov dword [0xc03194], 0x3a333d3e
mov byte [0xc03198], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc03184]
xor cl, 0x5f
mov byte [eax + 0xc038b4], cl
inc eax
cmp eax, 0x15
jb 0xb4a0a6
mov eax, 0xc038b4
ret
Function at 0xb4a98c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08298], 1
mov ecx, 0xc45f
jne 0xb4aa16
or dword [0xc08298], 1
lea eax, [ecx - 0x23]
mov word [0xc0319c], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0xc0319e], dx
lea edx, [ecx - 0x21]
mov word [0xc031a0], dx
add edx, 0xffffffee
mov word [0xc031a2], dx
lea edx, [ecx - 0x28]
mov word [0xc031a4], dx
add edx, 0xffffffc9
mov word [0xc031a6], dx
mov edx, eax
mov word [0xc031a8], dx
lea edx, [ecx - 0x25]
lea eax, [ecx - 0x34]
mov word [0xc031aa], dx
mov word [0xc031b2], ax
add edx, 0xfffffff5
mov eax, ecx
mov word [0xc031ac], dx
mov dword [0xc031ae], 0xc42dc430
mov word [0xc031b4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc0319c]
add eax, 2
mov word [eax + 0xc038ca], dx
cmp eax, 0x1a
jb 0xb4aa18
mov eax, 0xc038cc
ret

Function at 0xb4aa36
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08294], 1
jne 0xb4aab0
or dword [0xc08294], 1
mov dword [0xc031b8], 0x2d2d300c
mov dword [0xc031bc], 0x2b7f7326
mov dword [0xc031c0], 0x7f2c3637
mov dword [0xc031c4], 0x2b39302c
mov dword [0xc031c8], 0x3a2d3e28
mov dword [0xc031cc], 0x7f2c367f
mov dword [0xc031d0], 0x7f2b3031
mov dword [0xc031d4], 0x363e293e
mov dword [0xc031d8], 0x333d3e33
mov word [0xc031dc], 0x713a
mov byte [0xc031de], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc031b8]
xor cl, 0x5f
mov byte [eax + 0xc038e8], cl
inc eax
cmp eax, 0x27
jb 0xb4aab2
mov eax, 0xc038e8
ret

Function at 0xb4aacd
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08290], 1
jne 0xb4aaf0
or dword [0xc08290], 1
mov dword [0xc031e0], 0x302d2d1a
mov word [0xc031e4], 0x5f2d
xor eax, eax
mov cl, byte [eax + 0xc031e0]
xor cl, 0x5f
mov byte [eax + 0xc03910], cl
inc eax
cmp eax, 6
jb 0xb4aaf2
mov eax, 0xc03910
ret

Function at 0xb4ab0d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0828c], 1
jne 0xb4ab87
or dword [0xc0828c], 1
mov dword [0xc031e8], 0x2d2d300c
mov dword [0xc031ec], 0x2b7f7326
mov dword [0xc031f0], 0x7f2c3637
mov dword [0xc031f4], 0x2b39302c
mov dword [0xc031f8], 0x3a2d3e28
mov dword [0xc031fc], 0x7f2c367f
mov dword [0xc03200], 0x7f2b3031
mov dword [0xc03204], 0x363e293e
mov dword [0xc03208], 0x333d3e33
mov word [0xc0320c], 0x713a
mov byte [0xc0320e], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc031e8]
xor cl, 0x5f
mov byte [eax + 0xc03918], cl
inc eax
cmp eax, 0x27
jb 0xb4ab89
mov eax, 0xc03918
ret

Function at 0xb4aba4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08288], 1
jne 0xb4abc7
or dword [0xc08288], 1
mov dword [0xc03210], 0x302d2d1a
mov word [0xc03214], 0x5f2d
xor eax, eax
mov cl, byte [eax + 0xc03210]
xor cl, 0x5f
mov byte [eax + 0xc03940], cl
inc eax
cmp eax, 6
jb 0xb4abc9
mov eax, 0xc03940
ret
Function at 0xb4abe4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08284], 1
jne 0xb4ac3a
or dword [0xc08284], 1
mov dword [0xc03218], 0x7f3a3310
mov dword [0xc0321c], 0x2b363136
mov dword [0xc03220], 0x36333e36
mov dword [0xc03224], 0x362b3e25
mov dword [0xc03228], 0x397f3130
mov dword [0xc0322c], 0x3a33363e
mov dword [0xc03230], 0x5f7f653b
xor eax, eax
mov cl, byte [eax + 0xc03218]
xor cl, 0x5f
mov byte [eax + 0xc03948], cl
inc eax
cmp eax, 0x1c
jb 0xb4ac3c
mov eax, 0xc03948
ret

Function at 0xb4ac57
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08280], 1
jne 0xb4ac82
or dword [0xc08280], 1
mov dword [0xc03234], 0x312d3a34
mov dword [0xc03238], 0x6d6c333a
mov byte [0xc0323c], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc03234]
xor cl, 0x5f
mov byte [eax + 0xc03964], cl
inc eax
cmp eax, 9
jb 0xb4ac84
mov eax, 0xc03964
ret

Function at 0xb4ac9f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0827c], 1
jne 0xb4ad08
or dword [0xc0827c], 1
mov dword [0xc03240], 0xf2b3a0c
mov dword [0xc03244], 0x3a3c302d
mov dword [0xc03248], 0x2c0a2c2c
mov dword [0xc0324c], 0x30122d3a
mov dword [0xc03250], 0x271a3a3b
mov dword [0xc03254], 0x2b2f3a3c
mov dword [0xc03258], 0xf313036
mov dword [0xc0325c], 0x3c363330
mov word [0xc03260], 0x5f26
xor eax, eax
mov cl, byte [eax + 0xc03240]
xor cl, 0x5f
mov byte [eax + 0xc03970], cl
inc eax
cmp eax, 0x22
jb 0xb4ad0a
mov eax, 0xc03970
ret

Function at 0xb4ad25
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08278], 1
jne 0xb4ad8e
or dword [0xc08278], 1
mov dword [0xc03264], 0xf2b3a18
mov dword [0xc03268], 0x3a3c302d
mov dword [0xc0326c], 0x2c0a2c2c
mov dword [0xc03270], 0x30122d3a
mov dword [0xc03274], 0x271a3a3b
mov dword [0xc03278], 0x2b2f3a3c
mov dword [0xc0327c], 0xf313036
mov dword [0xc03280], 0x3c363330
mov word [0xc03284], 0x5f26
xor eax, eax
mov cl, byte [eax + 0xc03264]
xor cl, 0x5f
mov byte [eax + 0xc03994], cl
inc eax
cmp eax, 0x22
jb 0xb4ad90
mov eax, 0xc03994
ret

Function at 0xb4adab
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08274], 1
mov ecx, 0xc45f
jne 0xb4adda
or dword [0xc08274], 1
lea eax, [ecx - 0x21]
mov word [0xc03288], ax
add eax, 0x2f
mov word [0xc0328a], ax
mov eax, ecx
mov word [0xc0328c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc03288]
add eax, 2
mov word [eax + 0xc039b6], dx
cmp eax, 6
jb 0xb4addc
mov eax, 0xc039b8
ret

Function at 0xb4adfa
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0826c], 1
jne 0xb4ae6a
or dword [0xc0826c], 1
mov dword [0xc03298], 0x33363e19
mov dword [0xc0329c], 0x2b7f3b3a
mov dword [0xc032a0], 0x31367f30
mov dword [0xc032a4], 0x3e362b36
mov dword [0xc032a8], 0x3a253633
mov dword [0xc032ac], 0x29313a7f
mov dword [0xc032b0], 0x31302d36
mov dword [0xc032b4], 0x2b313a32
mov word [0xc032b8], 0x7f65
mov byte [0xc032ba], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc03298]
xor cl, 0x5f
mov byte [eax + 0xc039c8], cl
inc eax
cmp eax, 0x23
jb 0xb4ae6c
mov eax, 0xc039c8
ret
Function at 0xb4ae87
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08264], 1
mov ecx, 0xc45f
jne 0xb4aed1
or dword [0xc08264], 1
lea eax, [ecx - 0x25]
mov word [0xc032c4], ax
add eax, 0xfffffff7
mov word [0xc032c6], ax
lea eax, [ecx - 0x34]
mov word [0xc032c8], ax
add eax, 2
mov word [0xc032ca], ax
lea eax, [ecx - 0x39]
mov word [0xc032cc], ax
mov eax, ecx
mov word [0xc032ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc032c4]
add eax, 2
mov word [eax + 0xc039f2], dx
cmp eax, 0xc
jb 0xb4aed3
mov eax, 0xc039f4
ret

Function at 0xb4aef1
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08260], 1
jne 0xb4af3c
or dword [0xc08260], 1
mov dword [0xc032d0], 0x3e37310a
mov dword [0xc032d4], 0x3a333b31
mov dword [0xc032d8], 0x273a7f3b
mov dword [0xc032dc], 0x2b2f3a3c
mov dword [0xc032e0], 0x65313036
mov word [0xc032e4], 0x5f7f
xor eax, eax
mov cl, byte [eax + 0xc032d0]
xor cl, 0x5f
mov byte [eax + 0xc03a00], cl
inc eax
cmp eax, 0x16
jb 0xb4af3e
mov eax, 0xc03a00
ret

Function at 0xb4af59
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0825c], 1
jne 0xb4afac
or dword [0xc0825c], 1
mov dword [0xc032e8], 0x3e37310a
mov dword [0xc032ec], 0x3a333b31
mov dword [0xc032f0], 0x273a7f3b
mov dword [0xc032f4], 0x2b2f3a3c
mov dword [0xc032f8], 0x65313036
mov dword [0xc032fc], 0x552c7a7f
mov byte [0xc03300], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc032e8]
xor cl, 0x5f
mov byte [eax + 0xc03a18], cl
inc eax
cmp eax, 0x19
jb 0xb4afae
mov eax, 0xc03a18
ret

Function at 0xb4afc9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08258], 1
jne 0xb4b001
or dword [0xc08258], 1
mov dword [0xc03304], 0x3d2a2b0c
mov dword [0xc03308], 0x36273a7f
mov dword [0xc0330c], 0x7a777f2b
mov dword [0xc03310], 0x5f55763b
xor eax, eax
mov cl, byte [eax + 0xc03304]
xor cl, 0x5f
mov byte [eax + 0xc03a34], cl
inc eax
cmp eax, 0x10
jb 0xb4b003
mov eax, 0xc03a34
ret
Function at 0xb4cf77
Capabilities:
Write file on windows

Disassembly:
mov eax, 0xbcdd6c
call fcn.00bccc28
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0xb4d05b
cmp byte [edi + 0x49], bl
je 0xb4d05b
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0xb4cfae
xor al, al
jmp 0xb4d05d
push esi
lea esi, [ebp - 0x2c]
call fcn.00b4c91c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xb4cffe
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0xb4d003
dec eax
je 0xb4d007
dec eax
dec eax
je 0xb4d057
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00b44c93
mov al, bl
pop esi
jmp 0xb4d05d
mov edx, dword [ebp - 0x2c]
jmp 0xb4cfc8
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xb4d013
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0xb4d039
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xb4d026
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.00ba8871
add esp, 0x10
cmp esi, eax
jne 0xb4cfeb
cmp byte [edi + 0x49], 0
je 0xb4d057
test esi, esi
jne 0xb4cfba
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.00b4c9f5
jmp 0xb4cfba
mov bl, 1
jmp 0xb4cfed
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0xb52871
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08254], 1
jne 0xb528e5
or dword [0xc08254], 1
mov dword [0xc03a54], 0xe170d21
mov dword [0xc03a58], 0xd0c4206
mov dword [0xc03a5c], 0x7054216
mov dword [0xc03a60], 0xb064216
mov dword [0xc03a64], 0x60b1211
mov dword [0xc03a68], 0x42040d42
mov dword [0xc03a6c], 0xa16070f
mov dword [0xc03a70], 0x4542060d
mov dword [0xc03a74], 0xe0e0301
mov dword [0xc03a78], 0x62425845
xor eax, eax
mov cl, byte [eax + 0xc03a54]
xor cl, 0x62
mov byte [eax + 0xc03b98], cl
inc eax
cmp eax, 0x28
jb 0xb528e7
mov eax, 0xc03b98
ret

Function at 0xb52902
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08250], 1
jne 0xb52969
or dword [0xc08250], 1
mov dword [0xc03a7c], 0xe0b0324
mov dword [0xc03a80], 0x16420607
mov dword [0xc03a84], 0xc0b420d
mov dword [0xc03a88], 0x7090d14
mov dword [0xc03a8c], 0x16070f42
mov dword [0xc03a90], 0x42060d0a
mov dword [0xc03a94], 0xe030145
mov dword [0xc03a98], 0x4258450e
mov byte [0xc03a9c], 0x62
xor eax, eax
mov cl, byte [eax + 0xc03a7c]
xor cl, 0x62
mov byte [eax + 0xc03bc0], cl
inc eax
cmp eax, 0x21
jb 0xb5296b
mov eax, 0xc03bc0
ret
Function at 0xb52986
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xc0824c], 1
jne 0xb529e8
or dword [0xc0824c], 1
mov dword [0xc03aa0], 0xd103268
mov dword [0xc03aa4], 0xe000300
mov dword [0xc03aa8], 0x1706421b
mov dword [0xc03aac], 0xd164207
mov dword [0xc03ab0], 0x10011142
mov dword [0xc03ab4], 0x4216120b
mov dword [0xc03ab8], 0xd101007
mov dword [0xc03abc], 0x62425810
mov cl, byte [eax + 0xc03aa0]
xor cl, 0x62
mov byte [eax + 0xc03be4], cl
inc eax
cmp eax, 0x20
jb 0xb529e8
mov eax, 0xc03be4
ret

Function at 0xb52fc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0xb53108
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0xc08248], 1
jne 0xb53025
or dword [0xc08248], 1
mov eax, 0xc411
mov word [0xc03ac0], ax
add eax, 0xfffffff6
mov word [0xc03ac2], ax
mov eax, 0xc40c
mov word [0xc03ac4], ax
add eax, 0xfffffffa
mov word [0xc03ac6], ax
mov eax, 0xc462
mov word [0xc03ac8], ax
xor eax, eax
mov ecx, 0xc462
xor cx, word [eax + 0xc03ac0]
add eax, 2
mov word [eax + 0xc03c02], cx
cmp eax, 0xa
jb 0xb53027
mov eax, dword [ebx + edi]
mov ecx, 0xc03c04
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb5306e
test dx, dx
je 0xb5306a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb5306e
add eax, esi
add ecx, esi
test dx, dx
jne 0xb5304a
xor eax, eax
jmp 0xb53073
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0xb5307f
mov dword [edi], 0x385
jmp 0xb530f7
call fcn.00b53118
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0xb530ab
test dx, dx
je 0xb530a7
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0xb530ab
add ecx, esi
add eax, esi
test dx, dx
jne 0xb53087
xor eax, eax
jmp 0xb530b0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0xb530bc
mov dword [edi], 0x386
jmp 0xb530f7
call fcn.00b531eb
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0xb530e8
test dx, dx
je 0xb530e4
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0xb530e8
add ecx, esi
add eax, esi
test dx, dx
jne 0xb530c4
xor eax, eax
jmp 0xb530ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0xb53111
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0xb52fe2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0xb5310a
Function at 0xb53118
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08244], 1
jne 0xb531c8
or dword [0xc08244], 1
mov eax, 0xc403
mov word [0xc03acc], ax
add eax, 3
mov ecx, eax
mov word [0xc03ad0], ax
mov eax, 0xc427
mov word [0xc03ad2], ax
add eax, 0xffffffed
mov word [0xc03ad4], ax
mov eax, 0xc407
mov word [0xc03ace], cx
mov ecx, eax
lea edx, [eax + 5]
mov word [0xc03ad6], cx
mov ecx, edx
push edi
mov word [0xc03ad8], cx
add ecx, 0xa
mov edi, ecx
mov word [0xc03ada], di
lea edi, [eax + 0x27]
mov word [0xc03adc], di
add edi, 0xffffffdd
mov ecx, eax
add eax, 9
mov word [0xc03aea], ax
lea eax, [ecx + 0x5b]
mov word [0xc03ade], di
mov dword [0xc03ae0], 0xc416c411
mov word [0xc03ae4], cx
mov dword [0xc03ae6], 0xc407c40c
mov word [0xc03aec], ax
pop edi
xor eax, eax
mov ecx, 0xc462
xor cx, word [eax + 0xc03acc]
add eax, 2
mov word [eax + 0xc03c0e], cx
cmp eax, 0x22
jb 0xb531ca
mov eax, 0xc03c10
ret

Function at 0xb531eb
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08240], 1
mov ecx, 0xc462
jne 0xb53245
or dword [0xc08240], 1
lea eax, [ecx - 0x4e]
mov word [0xc03af0], ax
add eax, 0xfffffff3
mov word [0xc03af2], ax
lea eax, [ecx - 0x52]
mov word [0xc03af4], ax
inc eax
mov word [0xc03af6], ax
lea eax, [ecx - 0x57]
mov word [0xc03af8], ax
add eax, 2
mov word [0xc03afa], ax
lea eax, [ecx - 0x56]
mov word [0xc03afc], ax
mov eax, ecx
mov word [0xc03afe], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc03af0]
add eax, 2
mov word [eax + 0xc03c32], dx
cmp eax, 0x10
jb 0xb53247
mov eax, 0xc03c34
ret

Function at 0xb53bb8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0823c], 1
mov edx, 0xc462
jne 0xb53c1b
or dword [0xc0823c], 1
lea ecx, [edx - 0x5b]
mov eax, ecx
mov word [0xc03b00], ax
add eax, 9
push esi
mov esi, eax
lea eax, [edx - 0x34]
mov word [0xc03b0a], ax
add eax, 0xffffffdd
mov word [0xc03b0c], ax
mov eax, edx
mov word [0xc03b02], si
mov word [0xc03b04], si
mov dword [0xc03b06], 0xc410c40d
mov dword [0xc03b0e], 0xc407c40c
mov word [0xc03b12], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xc03b00]
add eax, 2
mov word [eax + 0xc03c42], cx
cmp eax, 0x14
jb 0xb53c1d
mov eax, 0xc03c44
ret

Function at 0xb53c3b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08238], 1
jne 0xb53cd7
or dword [0xc08238], 1
mov edx, 0xc407
mov eax, edx
mov word [0xc03b14], ax
add eax, 9
mov ecx, eax
mov word [0xc03b16], cx
mov word [0xc03b18], cx
lea ecx, [edx + 6]
mov word [0xc03b1a], cx
mov ecx, eax
mov word [0xc03b1c], cx
lea ecx, [edx + 0x1a]
mov word [0xc03b1e], cx
add ecx, 0xffffffe9
mov word [0xc03b20], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0xc03b22], di
mov edi, eax
mov word [0xc03b26], cx
mov word [0xc03b2e], ax
add ecx, 0xfffffffe
lea eax, [edx + 0x5b]
mov word [0xc03b24], di
mov word [0xc03b28], cx
mov dword [0xc03b2a], 0xc407c416
mov word [0xc03b30], ax
pop edi
xor eax, eax
mov ecx, 0xc462
xor cx, word [eax + 0xc03b14]
add eax, 2
mov word [eax + 0xc03c56], cx
cmp eax, 0x1e
jb 0xb53cd9
mov eax, 0xc03c58
ret