joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22487a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.0027dd60
push ebx
push esi
push edi
call dword [0x299094]
test byte [0x2c6af0], 1
mov dword [ebp - 4], eax
jne 0x2248c1
or dword [0x2c6af0], 1
mov dword [0x2c100c], 0x151e1c4d
mov dword [0x2c1010], 0x4e141d04
mov dword [0x2c1014], 0x714f4e4e
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x2c100c]
xor cl, 0x71
mov byte [eax + 0x2c1698], cl
inc eax
cmp eax, 0xc
jb 0x2248c5
test byte [0x2c6aec], 1
mov dword [ebp - 8], 0x2c1698
jne 0x22490f
or dword [0x2c6aec], 1
mov dword [0x2c1018], 0x1c08024d
mov dword [0x2c101c], 0x4e1d1e13
mov dword [0x2c1020], 0x714f4e4e
xor eax, eax
mov cl, byte [eax + 0x2c1018]
xor cl, 0x71
mov byte [eax + 0x2c16a4], cl
inc eax
cmp eax, 0xc
jb 0x224911
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x2c16a4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0026e220
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x2993b0]
test eax, eax
je 0x224976
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.0026e220
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x2993bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x2249c2
mov ecx, dword [ebp - 0x1c]
test byte [0x2c6ae8], 1
jne 0x2249f9
or dword [0x2c6ae8], 1
mov dword [0x2c1024], 0x54510154
mov dword [0x2c1028], 0x2545002
mov dword [0x2c102c], 0x5409415a
mov word [0x2c1030], 0x7109
xor eax, eax
mov dl, byte [eax + 0x2c1024]
xor dl, 0x71
mov byte [eax + 0x2c16b0], dl
inc eax
cmp eax, 0xe
jb 0x2249fb
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x2c16b0
push dword [ebp + 0xc]
call fcn.0026b44d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x2993a4]
test eax, eax
je 0x224a72
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00224abf
push eax
push dword [ebp + 0xc]
call fcn.0026b44d
add esp, 0x14
test byte [0x2c6ae0], 1
jne 0x224a92
or dword [0x2c6ae0], 1
mov word [0x2c1044], 0x7b7c
mov byte [0x2c1046], 0x71
xor eax, eax
mov cl, byte [eax + 0x2c1044]
xor cl, 0x71
mov byte [eax + 0x2c16d0], cl
inc eax
cmp eax, 3
jb 0x224a94
push dword [ebp + 0xc]
push 0x2c16d0
call fcn.0026b0c1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x224abf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6ae4], 1
jne 0x224af7
or dword [0x2c6ae4], 1
mov dword [0x2c1034], 0x2545951
mov dword [0x2c1038], 0x5115544b
mov dword [0x2c103c], 0x941515a
mov dword [0x2c1040], 0x71580954
xor eax, eax
mov cl, byte [eax + 0x2c1034]
xor cl, 0x71
mov byte [eax + 0x2c16c0], cl
inc eax
cmp eax, 0x10
jb 0x224af9
mov eax, 0x2c16c0
ret

Function at 0x225d47
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6ad4], 1
jne 0x225d9c
or dword [0x2c6ad4], 1
mov dword [0x2c16f4], 0x3620333a
mov dword [0x2c16f8], 0x37203325
mov dword [0x2c16fc], 0x2231332e
mov dword [0x2c1700], 0x21362e3b
mov dword [0x2c1704], 0x242e2636
mov dword [0x2c1708], 0x2d2a3d30
mov word [0x2c170c], 0x722d
xor eax, eax
mov cl, byte [eax + 0x2c16f4]
xor cl, 0x72
mov byte [eax + 0x2c18f4], cl
inc eax
cmp eax, 0x1a
jb 0x225d9e
mov eax, 0x2c18f4
ret

Function at 0x225ead
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6ad0], 1
jne 0x225ed9
or dword [0x2c6ad0], 1
mov dword [0x2c1710], 0x13253f24
mov word [0x2c1714], 0x1700
mov byte [0x2c1716], 0x72
mov cl, byte [eax + 0x2c1710]
xor cl, 0x72
mov byte [eax + 0x2c1910], cl
inc eax
cmp eax, 7
jb 0x225ed9
mov eax, 0x2c1910
ret

Function at 0x225ef4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6acc], 1
jne 0x225f23
or dword [0x2c6acc], 1
mov dword [0x2c1718], 0x6001b24
mov dword [0x2c171c], 0x221e1307
mov word [0x2c1720], 0x7231
mov cl, byte [eax + 0x2c1718]
xor cl, 0x72
mov byte [eax + 0x2c1918], cl
inc eax
cmp eax, 0xa
jb 0x225f23
mov eax, 0x2c1918
ret

Function at 0x225f3e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6ac8], 1
jne 0x225f74
or dword [0x2c6ac8], 1
mov dword [0x2c1724], 0x6001b24
mov dword [0x2c1728], 0x301e1307
mov word [0x2c172c], 0xa1d
mov byte [0x2c172e], 0x72
mov cl, byte [eax + 0x2c1724]
xor cl, 0x72
mov byte [eax + 0x2c1924], cl
inc eax
cmp eax, 0xb
jb 0x225f74
mov eax, 0x2c1924
ret

Function at 0x225f8f
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6ac4], 1
jne 0x225fb5
or dword [0x2c6ac4], 1
mov dword [0x2c1730], 0x171c1735
mov dword [0x2c1734], 0x72111b00
mov cl, byte [eax + 0x2c1730]
xor cl, 0x72
mov byte [eax + 0x2c1930], cl
inc eax
cmp eax, 8
jb 0x225fb5
mov eax, 0x2c1930
ret
Function at 0x225fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x292581
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x2c6ac0], 1
push esi
jne 0x226023
or dword [0x2c6ac0], 1
mov dword [0x2c1738], 0x1e16061c
mov dword [0x2c173c], 0x1e165c1e
mov word [0x2c1740], 0x721e
xor eax, eax
mov cl, byte [eax + 0x2c1738]
xor cl, 0x72
mov byte [eax + 0x2c1938], cl
inc eax
cmp eax, 0xa
jb 0x226025
push 0x2c1938
call dword [0x2990cc]
mov esi, eax
test esi, esi
jne 0x226097
call dword [0x2990a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00249aeb
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.002261de
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00225af9
push 0x2b3490
mov eax, esi
push eax
call fcn.00274b66
call fcn.00226244
push eax
push esi
call dword [0x2990c8]
test eax, eax
jne 0x2260f4
call dword [0x2990a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.002262b6
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00225af9
push 0x2b3490
mov eax, esi
jmp 0x226091
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x22617c
cmp dword [esp + 4], 0x18
jne 0x22617c
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x2990c4]
test eax, eax
jne 0x2261cb
call dword [0x2990a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.002263f6
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00225af9
push 0x2b3490
mov eax, esi
jmp 0x226091
call dword [0x2990a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00226369
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00225af9
push 0x2b3490
mov eax, esi
jmp 0x226091
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x2261de
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6abc], 1
jne 0x226229
or dword [0x2c6abc], 1
mov dword [0x2c1744], 0x16131d3e
mov dword [0x2c1748], 0x101b3e
mov dword [0x2c174c], 0x520b0013
mov dword [0x2c1750], 0x1e1b1314
mov dword [0x2c1754], 0x52481617
mov byte [0x2c1758], 0x72
mov cl, byte [eax + 0x2c1744]
xor cl, 0x72
mov byte [eax + 0x2c1944], cl
inc eax
cmp eax, 0x15
jb 0x226229
mov eax, 0x2c1944
ret
Function at 0x226244
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6ab8], 1
jne 0x22629b
or dword [0x2c6ab8], 1
mov dword [0x2c175c], 0x723063c
mov dword [0x2c1760], 0x3b0b0017
mov dword [0x2c1764], 0x1d141c
mov dword [0x2c1768], 0x1b06131f
mov dword [0x2c176c], 0x221c1d
mov dword [0x2c1770], 0x117111d
mov word [0x2c1774], 0x7201
mov cl, byte [eax + 0x2c175c]
xor cl, 0x72
mov byte [eax + 0x2c195c], cl
inc eax
cmp eax, 0x1a
jb 0x22629b
mov eax, 0x2c195c
ret

Function at 0x2262b6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6ab4], 1
jne 0x22634e
or dword [0x2c6ab4], 1
mov dword [0x2c1778], 0x22061735
mov dword [0x2c177c], 0x33111d00
mov dword [0x2c1780], 0x17001616
mov dword [0x2c1784], 0x14520101
mov dword [0x2c1788], 0x171e1b13
mov dword [0x2c178c], 0x3c5a5216
mov dword [0x2c1790], 0x17072306
mov dword [0x2c1794], 0x1c3b0b00
mov dword [0x2c1798], 0x1f001d14
mov dword [0x2c179c], 0x1d1b0613
mov dword [0x2c17a0], 0x1d00221c
mov dword [0x2c17a4], 0x1011711
mov dword [0x2c17a8], 0x7252485b
mov cl, byte [eax + 0x2c1778]
xor cl, 0x72
mov byte [eax + 0x2c1978], cl
inc eax
cmp eax, 0x34
jb 0x22634e
mov eax, 0x2c1978
ret

Function at 0x226369
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6ab0], 1
jne 0x2263db
or dword [0x2c6ab0], 1
mov dword [0x2c17ac], 0x723063c
mov dword [0x2c17b0], 0x3b0b0017
mov dword [0x2c17b4], 0x1d141c
mov dword [0x2c17b8], 0x1b06131f
mov dword [0x2c17bc], 0x221c1d
mov dword [0x2c17c0], 0x117111d
mov dword [0x2c17c4], 0x13145201
mov dword [0x2c17c8], 0x16171e1b
mov word [0x2c17cc], 0x5248
mov byte [0x2c17ce], 0x72
mov cl, byte [eax + 0x2c17ac]
xor cl, 0x72
mov byte [eax + 0x2c19ac], cl
inc eax
cmp eax, 0x23
jb 0x2263db
mov eax, 0x2c19ac
ret

Function at 0x2263f6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6aac], 1
jne 0x226441
or dword [0x2c6aac], 1
mov dword [0x2c17d0], 0x1c17023d
mov dword [0x2c17d4], 0x111d0022
mov dword [0x2c17d8], 0x52010117
mov dword [0x2c17dc], 0x1e1b1314
mov dword [0x2c17e0], 0x52481617
mov byte [0x2c17e4], 0x72
mov cl, byte [eax + 0x2c17d0]
xor cl, 0x72
mov byte [eax + 0x2c19d0], cl
inc eax
cmp eax, 0x15
jb 0x226441
mov eax, 0x2c19d0
ret
Function at 0x22645c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x29252e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebx
xor ebx, ebx
test byte [0x2c6aa8], 1
push esi
push edi
mov dword [esp + 0x1c], ebx
jne 0x2264bb
or dword [0x2c6aa8], 1
mov dword [0x2c17e8], 0x1c001719
mov dword [0x2c17ec], 0x40411e17
mov dword [0x2c17f0], 0x1e1e165c
mov byte [0x2c17f4], 0x72
xor eax, eax
mov cl, byte [eax + 0x2c17e8]
xor cl, 0x72
mov byte [eax + 0x2c19e8], cl
inc eax
cmp eax, 0xd
jb 0x2264bd
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x2c19e8
call edi
mov esi, eax
cmp esi, ebx
jne 0x226531
call dword [0x2990a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], ebx
call fcn.00226692
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 1
call fcn.00225af9
push 0x2b3490
mov eax, esi
push eax
call fcn.00274b66
call fcn.0022670f
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
cmp eax, ebx
jne 0x2265fe
call fcn.00226782
push eax
call edi
mov edi, eax
cmp edi, ebx
jne 0x2265a2
call dword [0x2990a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], 2
call fcn.002267cc
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 3
call fcn.00225af9
push 0x2b3490
mov eax, esi
jmp 0x22652b
call fcn.00226846
push eax
push edi
call esi
cmp eax, ebx
jne 0x2265fe
call dword [0x2990a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], 4
call fcn.002268b6
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 5
call fcn.00225af9
push 0x2b3490
mov eax, esi
jmp 0x22652b
push 0x208
lea ecx, [esp + 0x5c]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x226660
call dword [0x2990a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00249aeb
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], 6
call fcn.0022696f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00226a30
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 7
call fcn.00225af9
push 0x2b3490
mov eax, esi
jmp 0x22652b
mov esi, dword [ebp + 8]
lea eax, [esp + 0x58]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00224c02
mov ecx, dword [esp + 0x264]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x226692
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6aa4], 1
jne 0x2266f4
or dword [0x2c6aa4], 1
mov dword [0x2c17f8], 0x16131d3e
mov dword [0x2c17fc], 0x101b3e
mov dword [0x2c1800], 0x520b0013
mov dword [0x2c1804], 0x1e1b1314
mov dword [0x2c1808], 0x5a521617
mov dword [0x2c180c], 0x1c001719
mov dword [0x2c1810], 0x40411e17
mov dword [0x2c1814], 0x7252485b
mov cl, byte [eax + 0x2c17f8]
xor cl, 0x72
mov byte [eax + 0x2c19f8], cl
inc eax
cmp eax, 0x20
jb 0x2266f4
mov eax, 0x2c19f8
ret

Function at 0x22670f
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6aa0], 1
jne 0x226767
or dword [0x2c6aa0], 1
mov dword [0x2c1818], 0x35404139
mov dword [0x2c181c], 0x220617
mov dword [0x2c1820], 0x117111d
mov dword [0x2c1824], 0x131f3b01
mov dword [0x2c1828], 0x1b341715
mov dword [0x2c182c], 0x133c171e
mov dword [0x2c1830], 0x7233171f
mov cl, byte [eax + 0x2c1818]
xor cl, 0x72
mov byte [eax + 0x2c1a18], cl
inc eax
cmp eax, 0x1c
jb 0x226767
mov eax, 0x2c1a18
ret

Function at 0x226782
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6a9c], 1
jne 0x2267af
or dword [0x2c6a9c], 1
mov dword [0x2c1834], 0x2130102
mov dword [0x2c1838], 0x1e165c1b
mov word [0x2c183c], 0x721e
xor eax, eax
mov cl, byte [eax + 0x2c1834]
xor cl, 0x72
mov byte [eax + 0x2c1a34], cl
inc eax
cmp eax, 0xa
jb 0x2267b1
mov eax, 0x2c1a34
ret

Function at 0x2267cc
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a98], 1
jne 0x22682b
or dword [0x2c6a98], 1
mov dword [0x2c1840], 0x16131d3e
mov dword [0x2c1844], 0x101b3e
mov dword [0x2c1848], 0x520b0013
mov dword [0x2c184c], 0x1e1b1314
mov dword [0x2c1850], 0x5a521617
mov dword [0x2c1854], 0x2130102
mov dword [0x2c1858], 0x52485b1b
mov byte [0x2c185c], 0x72
mov cl, byte [eax + 0x2c1840]
xor cl, 0x72
mov byte [eax + 0x2c1a40], cl
inc eax
cmp eax, 0x1d
jb 0x22682b
mov eax, 0x2c1a40
ret

Function at 0x226846
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a94], 1
jne 0x22689b
or dword [0x2c6a94], 1
mov dword [0x2c1860], 0x22061735
mov dword [0x2c1864], 0x17111d00
mov dword [0x2c1868], 0x1f3b0101
mov dword [0x2c186c], 0x34171513
mov dword [0x2c1870], 0x3c171e1b
mov dword [0x2c1874], 0x33171f13
mov byte [0x2c1878], 0x72
mov cl, byte [eax + 0x2c1860]
xor cl, 0x72
mov byte [eax + 0x2c1a60], cl
inc eax
cmp eax, 0x19
jb 0x22689b
mov eax, 0x2c1a60
ret

Function at 0x2268b6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a90], 1
jne 0x226954
or dword [0x2c6a90], 1
mov dword [0x2c187c], 0x22061735
mov dword [0x2c1880], 0x33111d00
mov dword [0x2c1884], 0x17001616
mov dword [0x2c1888], 0x14520101
mov dword [0x2c188c], 0x171e1b13
mov dword [0x2c1890], 0x355a5216
mov dword [0x2c1894], 0x220617
mov dword [0x2c1898], 0x117111d
mov dword [0x2c189c], 0x131f3b01
mov dword [0x2c18a0], 0x1b341715
mov dword [0x2c18a4], 0x133c171e
mov dword [0x2c18a8], 0x5b33171f
mov word [0x2c18ac], 0x5248
mov byte [0x2c18ae], 0x72
mov cl, byte [eax + 0x2c187c]
xor cl, 0x72
mov byte [eax + 0x2c1a7c], cl
inc eax
cmp eax, 0x33
jb 0x226954
mov eax, 0x2c1a7c
ret
Function at 0x22696f
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a8c], 1
jne 0x2269d8
or dword [0x2c6a8c], 1
mov dword [0x2c18b0], 0x22061735
mov dword [0x2c18b4], 0x17111d00
mov dword [0x2c18b8], 0x1f3b0101
mov dword [0x2c18bc], 0x34171513
mov dword [0x2c18c0], 0x1c171e1b
mov dword [0x2c18c4], 0x52171f13
mov dword [0x2c18c8], 0x1e1b1314
mov dword [0x2c18cc], 0x52481617
mov byte [0x2c18d0], 0x72
mov cl, byte [eax + 0x2c18b0]
xor cl, 0x72
mov byte [eax + 0x2c1ab0], cl
inc eax
cmp eax, 0x21
jb 0x2269d8
mov eax, 0x2c1ab0
ret

Function at 0x227571
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a88], 1
jne 0x227759
or dword [0x2c6a88], 1
mov dword [0x2c1ad8], 0x5d1c1a
mov dword [0x2c1adc], 0x61c1707
mov dword [0x2c1ae0], 0x16004907
mov dword [0x2c1ae4], 0x6110507
mov dword [0x2c1ae8], 0x1d545b15
mov dword [0x2c1aec], 0x795a541c
mov dword [0x2c1af0], 0x18101203
mov dword [0x2c1af4], 0x5d161412
mov dword [0x2c1af8], 0x1b071203
mov dword [0x2c1afc], 0x54534e53
mov dword [0x2c1b00], 0x16017954
mov dword [0x2c1b04], 0x11a0602
mov dword [0x2c1b08], 0x545b16
mov dword [0x2c1b0c], 0x101a0107
mov dword [0x2c1b10], 0x795a5407
mov dword [0x2c1b14], 0x12101c1f
mov dword [0x2c1b18], 0x5f00531f
mov dword [0x2c1b1c], 0x4e530153
mov dword [0x2c1b20], 0x10030b53
mov dword [0x2c1b24], 0x5b1f1f12
mov dword [0x2c1b28], 0x101d0615
mov dword [0x2c1b2c], 0x1d1c1a07
mov dword [0x2c1b30], 0x1535a5b
mov dword [0x2c1b34], 0x1060716
mov dword [0x2c1b38], 0x1601531d
mov dword [0x2c1b3c], 0x11a0602
mov dword [0x2c1b40], 0x56545b16
mov dword [0x2c1b44], 0x5d5a543e
mov dword [0x2c1b48], 0x1d1a121e
mov dword [0x2c1b4c], 0x122c2c5b
mov dword [0x2c1b50], 0x5a001401
mov dword [0x2c1b54], 0x171d1653
mov dword [0x2c1b58], 0x1617535f
mov dword [0x2c1b5c], 0x5d140611
mov dword [0x2c1b60], 0x10120107
mov dword [0x2c1b64], 0x10121116
mov dword [0x2c1b68], 0x1a795a18
mov dword [0x2c1b6c], 0x1c1d5315
mov dword [0x2c1b70], 0x53005307
mov dword [0x2c1b74], 0x1d161b07
mov dword [0x2c1b78], 0x1011653
mov dword [0x2c1b7c], 0x15b011c
mov dword [0x2c1b80], 0x1d16535a
mov dword [0x2c1b84], 0x16017917
mov dword [0x2c1b88], 0x1d010607
mov word [0x2c1b8c], 0x153
mov byte [0x2c1b8e], 0x73
mov cl, byte [eax + 0x2c1ad8]
xor cl, 0x73
mov byte [eax + 0x2c20c8], cl
inc eax
cmp eax, 0xb7
jb 0x227759
mov eax, 0x2c20c8
ret
Function at 0x227776
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a84], 1
jne 0x2279fe
or dword [0x2c6a84], 1
mov dword [0x2c1b90], 0x5d1c1a
mov dword [0x2c1b94], 0x61c1707
mov dword [0x2c1b98], 0x16004907
mov dword [0x2c1b9c], 0x6110507
mov dword [0x2c1ba0], 0x1d545b15
mov dword [0x2c1ba4], 0x795a541c
mov dword [0x2c1ba8], 0x18101203
mov dword [0x2c1bac], 0x5d161412
mov dword [0x2c1bb0], 0x1b071203
mov dword [0x2c1bb4], 0x7954544e
mov dword [0x2c1bb8], 0x6021601
mov dword [0x2c1bbc], 0x5b16011a
mov dword [0x2c1bc0], 0x1070054
mov dword [0x2c1bc4], 0x5407101a
mov dword [0x2c1bc8], 0x1c1f795a
mov dword [0x2c1bcc], 0x531f1210
mov dword [0x2c1bd0], 0x4e531f1e
mov dword [0x2c1bd4], 0x2160153
mov dword [0x2c1bd8], 0x16011a06
mov dword [0x2c1bdc], 0x1f1e545b
mov dword [0x2c1be0], 0x1f795a54
mov dword [0x2c1be4], 0x1f12101c
mov dword [0x2c1be8], 0x15f0053
mov dword [0x2c1bec], 0x4e53165f
mov dword [0x2c1bf0], 0x10030b53
mov dword [0x2c1bf4], 0x5b1f1f12
mov dword [0x2c1bf8], 0x101d0615
mov dword [0x2c1bfc], 0x1d1c1a07
mov dword [0x2c1c00], 0x1535a5b
mov dword [0x2c1c04], 0x1060716
mov dword [0x2c1c08], 0x1601531d
mov dword [0x2c1c0c], 0x11a0602
mov dword [0x2c1c10], 0x56545b16
mov dword [0x2c1c14], 0x5d5a543e
mov dword [0x2c1c18], 0x565b3556
mov dword [0x2c1c1c], 0x16535a32
mov dword [0x2c1c20], 0x535f171d
mov dword [0x2c1c24], 0x6111617
mov dword [0x2c1c28], 0x1075d14
mov dword [0x2c1c2c], 0x11161012
mov dword [0x2c1c30], 0x5a181012
mov dword [0x2c1c34], 0x53151a79
mov dword [0x2c1c38], 0x53071c1d
mov dword [0x2c1c3c], 0x1b075300
mov dword [0x2c1c40], 0x1531d16
mov dword [0x2c1c44], 0x1060716
mov dword [0x2c1c48], 0x1a1d531d
mov dword [0x2c1c4c], 0x1535f1f
mov dword [0x2c1c50], 0x171d1653
mov dword [0x2c1c54], 0x53151a79
mov dword [0x2c1c58], 0x4e0d5301
mov dword [0x2c1c5c], 0x1f1a1d53
mov dword [0x2c1c60], 0x161b0753
mov dword [0x2c1c64], 0x5301531d
mov dword [0x2c1c68], 0x1f1e534e
mov dword [0x2c1c6c], 0x700075d
mov dword [0x2c1c70], 0x141d1a01
mov dword [0x2c1c74], 0x535a015b
mov dword [0x2c1c78], 0x79171d16
mov dword [0x2c1c7c], 0x6071601
mov dword [0x2c1c80], 0x1531d01
mov word [0x2c1c84], 0x165f
mov byte [0x2c1c86], 0x73
mov cl, byte [eax + 0x2c1b90]
xor cl, 0x73
mov byte [eax + 0x2c2180], cl
inc eax
cmp eax, 0xf7
jb 0x2279fe
mov eax, 0x2c2180
ret
Function at 0x227a1b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x2c6a48], 1
jne 0x227a42
or dword [0x2c6a48], 1
mov dword [0x2c1d78], 0x18101203
mov dword [0x2c1d7c], 0x73161412
xor eax, eax
mov cl, byte [eax + 0x2c1d78]
xor cl, 0x73
mov byte [eax + 0x2c2368], cl
inc eax
cmp eax, 8
jb 0x227a44
push 0x2c2368
push dword [ebp + 8]
call fcn.00257eb5
test byte [0x2c6a44], 1
pop ecx
pop ecx
jne 0x227a8c
or dword [0x2c6a44], 1
mov dword [0x2c1d80], 0x1f160103
mov dword [0x2c1d84], 0x7317121c
xor eax, eax
mov cl, byte [eax + 0x2c1d80]
xor cl, 0x73
mov byte [eax + 0x2c2370], cl
inc eax
cmp eax, 8
jb 0x227a8e
push esi
push 0x2c2370
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00257f29
add esp, 0xc
cmp dword [0x2bcbe0], 0
mov esi, 0x2bcbe0
je 0x227aee
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00257dd5
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00258156
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x227ac7
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0025762a
pop ecx
pop ecx
pop esi
pop ebp
ret