joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb460a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xbce0c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0xc083c0], 1
push esi
jne 0xb460f5
or dword [0xc083c0], 1
mov dword [0xc02848], 0x31392933
mov dword [0xc0284c], 0x31397331
mov word [0xc02850], 0x5d31
xor eax, eax
mov cl, byte [eax + 0xc02848]
xor cl, 0x5d
mov byte [eax + 0xc02a48], cl
inc eax
cmp eax, 0xa
jb 0xb460f7
push 0xc02a48
call dword [0xbd60cc]
mov esi, eax
test esi, esi
jne 0xb46169
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.00b462b0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
push eax
call fcn.00bb0865
call fcn.00b46316
push eax
push esi
call dword [0xbd60c8]
test eax, eax
jne 0xb461c6
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00b46388
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
jmp 0xb46163
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0xb4624e
cmp dword [esp + 4], 0x18
jne 0xb4624e
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0xbd60c4]
test eax, eax
jne 0xb4629d
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.00b464c8
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
jmp 0xb46163
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00b4643b
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
jmp 0xb46163
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xb462b0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083bc], 1
jne 0xb462f9
or dword [0xc083bc], 1
mov dword [0xc02854], 0x393c3211
mov dword [0xc02858], 0x2f3f3411
mov dword [0xc0285c], 0x7d242f3c
mov dword [0xc02860], 0x31343c3b
mov dword [0xc02864], 0x7d673938
mov byte [0xc02868], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc02854]
xor cl, 0x5d
mov byte [eax + 0xc02a54], cl
inc eax
cmp eax, 0x15
jb 0xb462fb
mov eax, 0xc02a54
ret
Function at 0xb46316
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083b8], 1
jne 0xb4636b
or dword [0xc083b8], 1
mov dword [0xc0286c], 0x280c2913
mov dword [0xc02870], 0x14242f38
mov dword [0xc02874], 0x2f323b33
mov dword [0xc02878], 0x34293c30
mov dword [0xc0287c], 0x2f0d3332
mov dword [0xc02880], 0x2e383e32
mov word [0xc02884], 0x5d2e
xor eax, eax
mov cl, byte [eax + 0xc0286c]
xor cl, 0x5d
mov byte [eax + 0xc02a6c], cl
inc eax
cmp eax, 0x1a
jb 0xb4636d
mov eax, 0xc02a6c
ret

Function at 0xb46388
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083b4], 1
jne 0xb4641e
or dword [0xc083b4], 1
mov dword [0xc02888], 0xd29381a
mov dword [0xc0288c], 0x1c3e322f
mov dword [0xc02890], 0x382f3939
mov dword [0xc02894], 0x3b7d2e2e
mov dword [0xc02898], 0x3831343c
mov dword [0xc0289c], 0x13757d39
mov dword [0xc028a0], 0x38280c29
mov dword [0xc028a4], 0x3314242f
mov dword [0xc028a8], 0x302f323b
mov dword [0xc028ac], 0x3234293c
mov dword [0xc028b0], 0x322f0d33
mov dword [0xc028b4], 0x2e2e383e
mov dword [0xc028b8], 0x5d7d6774
xor eax, eax
mov cl, byte [eax + 0xc02888]
xor cl, 0x5d
mov byte [eax + 0xc02a88], cl
inc eax
cmp eax, 0x34
jb 0xb46420
mov eax, 0xc02a88
ret

Function at 0xb4643b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083b0], 1
jne 0xb464ab
or dword [0xc083b0], 1
mov dword [0xc028bc], 0x280c2913
mov dword [0xc028c0], 0x14242f38
mov dword [0xc028c4], 0x2f323b33
mov dword [0xc028c8], 0x34293c30
mov dword [0xc028cc], 0x2f0d3332
mov dword [0xc028d0], 0x2e383e32
mov dword [0xc028d4], 0x3c3b7d2e
mov dword [0xc028d8], 0x39383134
mov word [0xc028dc], 0x7d67
mov byte [0xc028de], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc028bc]
xor cl, 0x5d
mov byte [eax + 0xc02abc], cl
inc eax
cmp eax, 0x23
jb 0xb464ad
mov eax, 0xc02abc
ret

Function at 0xb464c8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083ac], 1
jne 0xb46511
or dword [0xc083ac], 1
mov dword [0xc028e0], 0x33382d12
mov dword [0xc028e4], 0x3e322f0d
mov dword [0xc028e8], 0x7d2e2e38
mov dword [0xc028ec], 0x31343c3b
mov dword [0xc028f0], 0x7d673938
mov byte [0xc028f4], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc028e0]
xor cl, 0x5d
mov byte [eax + 0xc02ae0], cl
inc eax
cmp eax, 0x15
jb 0xb46513
mov eax, 0xc02ae0
ret
Function at 0xb4652e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xbce06e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0xc083a8], 1
push esi
push edi
jne 0xb4658b
or dword [0xc083a8], 1
mov dword [0xc028f8], 0x332f3836
mov dword [0xc028fc], 0x6f6e3138
mov dword [0xc02900], 0x31313973
mov byte [0xc02904], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc028f8]
xor cl, 0x5d
mov byte [eax + 0xc02af8], cl
inc eax
cmp eax, 0xd
jb 0xb4658d
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0xc02af8
call edi
mov esi, eax
test esi, esi
jne 0xb46601
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00b46763
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
push eax
call fcn.00bb0865
call fcn.00b467e0
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0xb466ce
call fcn.00b46853
push eax
call edi
mov edi, eax
test edi, edi
jne 0xb46672
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.00b4689d
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
jmp 0xb465fb
call fcn.00b46917
push eax
push edi
call esi
test eax, eax
jne 0xb466ce
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00b46987
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
jmp 0xb465fb
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0xb46730
call dword [0xbd60a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00b6dbe9
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00b46a40
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00b46b01
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00b45bea
push 0xbf2d18
mov eax, esi
jmp 0xb465fb
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00b44c72
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xb46763
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083a4], 1
jne 0xb467c3
or dword [0xc083a4], 1
mov dword [0xc02908], 0x393c3211
mov dword [0xc0290c], 0x2f3f3411
mov dword [0xc02910], 0x7d242f3c
mov dword [0xc02914], 0x31343c3b
mov dword [0xc02918], 0x757d3938
mov dword [0xc0291c], 0x332f3836
mov dword [0xc02920], 0x6f6e3138
mov dword [0xc02924], 0x5d7d6774
xor eax, eax
mov cl, byte [eax + 0xc02908]
xor cl, 0x5d
mov byte [eax + 0xc02b08], cl
inc eax
cmp eax, 0x20
jb 0xb467c5
mov eax, 0xc02b08
ret
Function at 0xb467e0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc083a0], 1
jne 0xb46836
or dword [0xc083a0], 1
mov dword [0xc02928], 0x1a6f6e16
mov dword [0xc0292c], 0x2f0d2938
mov dword [0xc02930], 0x2e383e32
mov dword [0xc02934], 0x3c30142e
mov dword [0xc02938], 0x341b383a
mov dword [0xc0293c], 0x3c133831
mov dword [0xc02940], 0x5d1c3830
xor eax, eax
mov cl, byte [eax + 0xc02928]
xor cl, 0x5d
mov byte [eax + 0xc02b28], cl
inc eax
cmp eax, 0x1c
jb 0xb46838
mov eax, 0xc02b28
ret

Function at 0xb46853
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0839c], 1
jne 0xb46880
or dword [0xc0839c], 1
mov dword [0xc02944], 0x2d3c2e2d
mov dword [0xc02948], 0x31397334
mov word [0xc0294c], 0x5d31
xor eax, eax
mov cl, byte [eax + 0xc02944]
xor cl, 0x5d
mov byte [eax + 0xc02b44], cl
inc eax
cmp eax, 0xa
jb 0xb46882
mov eax, 0xc02b44
ret

Function at 0xb4689d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08398], 1
jne 0xb468fa
or dword [0xc08398], 1
mov dword [0xc02950], 0x393c3211
mov dword [0xc02954], 0x2f3f3411
mov dword [0xc02958], 0x7d242f3c
mov dword [0xc0295c], 0x31343c3b
mov dword [0xc02960], 0x757d3938
mov dword [0xc02964], 0x2d3c2e2d
mov dword [0xc02968], 0x7d677434
mov byte [0xc0296c], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc02950]
xor cl, 0x5d
mov byte [eax + 0xc02b50], cl
inc eax
cmp eax, 0x1d
jb 0xb468fc
mov eax, 0xc02b50
ret

Function at 0xb46917
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08394], 1
jne 0xb4696a
or dword [0xc08394], 1
mov dword [0xc02970], 0xd29381a
mov dword [0xc02974], 0x383e322f
mov dword [0xc02978], 0x30142e2e
mov dword [0xc0297c], 0x1b383a3c
mov dword [0xc02980], 0x13383134
mov dword [0xc02984], 0x1c38303c
mov byte [0xc02988], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc02970]
xor cl, 0x5d
mov byte [eax + 0xc02b70], cl
inc eax
cmp eax, 0x19
jb 0xb4696c
mov eax, 0xc02b70
ret

Function at 0xb46987
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08390], 1
jne 0xb46a23
or dword [0xc08390], 1
mov dword [0xc0298c], 0xd29381a
mov dword [0xc02990], 0x1c3e322f
mov dword [0xc02994], 0x382f3939
mov dword [0xc02998], 0x3b7d2e2e
mov dword [0xc0299c], 0x3831343c
mov dword [0xc029a0], 0x1a757d39
mov dword [0xc029a4], 0x2f0d2938
mov dword [0xc029a8], 0x2e383e32
mov dword [0xc029ac], 0x3c30142e
mov dword [0xc029b0], 0x341b383a
mov dword [0xc029b4], 0x3c133831
mov dword [0xc029b8], 0x741c3830
mov word [0xc029bc], 0x7d67
mov byte [0xc029be], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc0298c]
xor cl, 0x5d
mov byte [eax + 0xc02b8c], cl
inc eax
cmp eax, 0x33
jb 0xb46a25
mov eax, 0xc02b8c
ret

Function at 0xb46a40
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0838c], 1
jne 0xb46aa7
or dword [0xc0838c], 1
mov dword [0xc029c0], 0xd29381a
mov dword [0xc029c4], 0x383e322f
mov dword [0xc029c8], 0x30142e2e
mov dword [0xc029cc], 0x1b383a3c
mov dword [0xc029d0], 0x33383134
mov dword [0xc029d4], 0x7d38303c
mov dword [0xc029d8], 0x31343c3b
mov dword [0xc029dc], 0x7d673938
mov byte [0xc029e0], 0x5d
xor eax, eax
mov cl, byte [eax + 0xc029c0]
xor cl, 0x5d
mov byte [eax + 0xc02bc0], cl
inc eax
cmp eax, 0x21
jb 0xb46aa9
mov eax, 0xc02bc0
ret
Function at 0xb4765a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xc08388], 1
jne 0xb47842
or dword [0xc08388], 1
mov dword [0xc02be8], 0x2c713036
mov dword [0xc02bec], 0x2a303b2b
mov dword [0xc02bf0], 0x3a2c652b
mov dword [0xc02bf4], 0x2a3d292b
mov dword [0xc02bf8], 0x31787739
mov dword [0xc02bfc], 0x55767830
mov dword [0xc02c00], 0x343c3e2f
mov dword [0xc02c04], 0x713a383e
mov dword [0xc02c08], 0x372b3e2f
mov dword [0xc02c0c], 0x787f627f
mov dword [0xc02c10], 0x3a2d5578
mov dword [0xc02c14], 0x2d362a2e
mov dword [0xc02c18], 0x2c78773a
mov dword [0xc02c1c], 0x3c362d2b
mov dword [0xc02c20], 0x5576782b
mov dword [0xc02c24], 0x3e3c3033
mov dword [0xc02c28], 0x732c7f33
mov dword [0xc02c2c], 0x627f2d7f
mov dword [0xc02c30], 0x3c2f277f
mov dword [0xc02c34], 0x7733333e
mov dword [0xc02c38], 0x3c312a39
mov dword [0xc02c3c], 0x3130362b
mov dword [0xc02c40], 0x2d7f7677
mov dword [0xc02c44], 0x2d2a2b3a
mov dword [0xc02c48], 0x3a2d7f31
mov dword [0xc02c4c], 0x2d362a2e
mov dword [0xc02c50], 0x7a78773a
mov dword [0xc02c54], 0x71767812
mov dword [0xc02c58], 0x31363e32
mov dword [0xc02c5c], 0x3e000077
mov dword [0xc02c60], 0x762c382d
mov dword [0xc02c64], 0x3b313a7f
mov dword [0xc02c68], 0x3a3b7f73
mov dword [0xc02c6c], 0x71382a3d
mov dword [0xc02c70], 0x3c3e2d2b
mov dword [0xc02c74], 0x3c3e3d3a
mov dword [0xc02c78], 0x36557634
mov dword [0xc02c7c], 0x30317f39
mov dword [0xc02c80], 0x7f2c7f2b
mov dword [0xc02c84], 0x313a372b
mov dword [0xc02c88], 0x2d2d3a7f
mov dword [0xc02c8c], 0x2d772d30
mov dword [0xc02c90], 0x313a7f76
mov dword [0xc02c94], 0x3a2d553b
mov dword [0xc02c98], 0x312d2a2b
mov word [0xc02c9c], 0x2d7f
mov byte [0xc02c9e], 0x5f
mov cl, byte [eax + 0xc02be8]
xor cl, 0x5f
mov byte [eax + 0xc03318], cl
inc eax
cmp eax, 0xb7
jb 0xb47842
mov eax, 0xc03318
ret
Function at 0xb4785f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08384], 1
jne 0xb47ae5
or dword [0xc08384], 1
mov dword [0xc02ca0], 0x2c713036
mov dword [0xc02ca4], 0x2a303b2b
mov dword [0xc02ca8], 0x3a2c652b
mov dword [0xc02cac], 0x2a3d292b
mov dword [0xc02cb0], 0x31787739
mov dword [0xc02cb4], 0x55767830
mov dword [0xc02cb8], 0x343c3e2f
mov dword [0xc02cbc], 0x713a383e
mov dword [0xc02cc0], 0x372b3e2f
mov dword [0xc02cc4], 0x55787862
mov dword [0xc02cc8], 0x2a2e3a2d
mov dword [0xc02ccc], 0x773a2d36
mov dword [0xc02cd0], 0x2d2b2c78
mov dword [0xc02cd4], 0x782b3c36
mov dword [0xc02cd8], 0x30335576
mov dword [0xc02cdc], 0x7f333e3c
mov dword [0xc02ce0], 0x627f3332
mov dword [0xc02ce4], 0x2e3a2d7f
mov dword [0xc02ce8], 0x3a2d362a
mov dword [0xc02cec], 0x33327877
mov dword [0xc02cf0], 0x33557678
mov dword [0xc02cf4], 0x333e3c30
mov dword [0xc02cf8], 0x2d732c7f
mov dword [0xc02cfc], 0x627f3a73
mov dword [0xc02d00], 0x3c2f277f
mov dword [0xc02d04], 0x7733333e
mov dword [0xc02d08], 0x3c312a39
mov dword [0xc02d0c], 0x3130362b
mov dword [0xc02d10], 0x2d7f7677
mov dword [0xc02d14], 0x2d2a2b3a
mov dword [0xc02d18], 0x3a2d7f31
mov dword [0xc02d1c], 0x2d362a2e
mov dword [0xc02d20], 0x7a78773a
mov dword [0xc02d24], 0x71767812
mov dword [0xc02d28], 0x7a77197a
mov dword [0xc02d2c], 0x3a7f761e
mov dword [0xc02d30], 0x7f733b31
mov dword [0xc02d34], 0x2a3d3a3b
mov dword [0xc02d38], 0x2d2b7138
mov dword [0xc02d3c], 0x3d3a3c3e
mov dword [0xc02d40], 0x76343c3e
mov dword [0xc02d44], 0x7f393655
mov dword [0xc02d48], 0x7f2b3031
mov dword [0xc02d4c], 0x372b7f2c
mov dword [0xc02d50], 0x2d7f313a
mov dword [0xc02d54], 0x2d2a2b3a
mov dword [0xc02d58], 0x36317f31
mov dword [0xc02d5c], 0x2d7f7333
mov dword [0xc02d60], 0x3b313a7f
mov dword [0xc02d64], 0x7f393655
mov dword [0xc02d68], 0x62217f2d
mov dword [0xc02d6c], 0x3336317f
mov dword [0xc02d70], 0x3a372b7f
mov dword [0xc02d74], 0x7f2d7f31
mov dword [0xc02d78], 0x33327f62
mov dword [0xc02d7c], 0x2b2c2b71
mov dword [0xc02d80], 0x3831362d
mov dword [0xc02d84], 0x7f762d77
mov dword [0xc02d88], 0x553b313a
mov dword [0xc02d8c], 0x2a2b3a2d
mov dword [0xc02d90], 0x2d7f312d
mov word [0xc02d94], 0x3a73
mov byte [0xc02d96], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc02ca0]
xor cl, 0x5f
mov byte [eax + 0xc033d0], cl
inc eax
cmp eax, 0xf7
jb 0xb47ae7
mov eax, 0xc033d0
ret
Function at 0xb47b04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0xc08344], 1
jne 0xb47b2b
or dword [0xc08344], 1
mov dword [0xc02e8c], 0x343c3e2f
mov dword [0xc02e90], 0x5f3a383e
xor eax, eax
mov cl, byte [eax + 0xc02e8c]
xor cl, 0x5f
mov byte [eax + 0xc035bc], cl
inc eax
cmp eax, 8
jb 0xb47b2d
push 0xc035bc
push dword [ebp + 8]
call fcn.00b93ba5
test byte [0xc08340], 1
pop ecx
pop ecx
jne 0xb47b75
or dword [0xc08340], 1
mov dword [0xc02e94], 0x333a2d2f
mov dword [0xc02e98], 0x5f3b3e30
xor eax, eax
mov cl, byte [eax + 0xc02e94]
xor cl, 0x5f
mov byte [eax + 0xc035c4], cl
inc eax
cmp eax, 8
jb 0xb47b77
push esi
push 0xc035c4
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00b93c19
add esp, 0xc
cmp dword [0xbfdc20], 0
mov esi, 0xbfdc20
je 0xb47bd7
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00b93ac5
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00b93e46
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0xb47bb0
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.00b9331a
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0xb47e44
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xbcdb32
call fcn.00bccc28
sub esp, 0x64
test byte [0xc0832c], 1
jne 0xb47e71
or dword [0xc0832c], 1
mov word [0xc02ec4], 0x127a
mov byte [0xc02ec6], 0x5f
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0xc02ec4]
xor cl, 0x5f
mov byte [eax + 0xc035f4], cl
inc eax
cmp eax, 3
jb 0xb47e78
mov esi, 0xc035f4
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xb47ea4
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00b44e57
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.00b4e97e
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00b44c93
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0xb47eeb
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.00b92718
pop ecx
pop ecx
cmp eax, ebx
je 0xb47f3c
cmp eax, 3
jne 0xb47f29
call fcn.00b48043
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00ba6955
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0xbf2d18
lea eax, [ebp - 0x1c]
push eax
call fcn.00bb0865
cmp eax, 4
jne 0xb47f35
call fcn.00b480f6
jmp 0xb47f05
call fcn.00b481a9
jmp 0xb47f05
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.00b9414e
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0xb47ff3
push ebx
call fcn.00b4822d
push eax
push 0xffffffffffffffff
push esi
call fcn.00b92eaf
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00b44c72
mov byte [ebp - 4], 3
cmp edi, 2
jne 0xb47fab
call fcn.00b48274
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.00b4e9ef
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.00b45bea
jmp 0xb47f1b
cmp edi, 4
jne 0xb47fca
call fcn.00b482d3
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.00b4e9ef
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0xb47f9e
cmp edi, 6
jne 0xb47fe9
call fcn.00b48338
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.00b4e9ef
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0xb47f9e
call fcn.00b483bc
jmp 0xb47f05
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.00b9350a
pop ecx
pop ecx
test eax, eax
je 0xb48014
push ebx
push edi
push esi
call fcn.00b936ce
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.00b93304
sub edi, eax
push edi
push esi
call fcn.00b9331a
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00b44c93
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xb48043
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08328], 1
jne 0xb480d9
or dword [0xc08328], 1
mov dword [0xc02ec8], 0x33363e19
mov dword [0xc02ecc], 0x2b7f3b3a
mov dword [0xc02ed0], 0x293a7f30
mov dword [0xc02ed4], 0x3e2a333e
mov dword [0xc02ed8], 0x3d7f3a2b
mov dword [0xc02edc], 0x2c2b3030
mov dword [0xc02ee0], 0x2f3e2d2b
mov dword [0xc02ee4], 0x3e2d397f
mov dword [0xc02ee8], 0x313a3238
mov dword [0xc02eec], 0x2c7f732b
mov dword [0xc02ef0], 0x3e2b3126
mov dword [0xc02ef4], 0x2d3a7f27
mov dword [0xc02ef8], 0x5f2d302d
xor eax, eax
mov cl, byte [eax + 0xc02ec8]
xor cl, 0x5f
mov byte [eax + 0xc035f8], cl
inc eax
cmp eax, 0x34
jb 0xb480db
mov eax, 0xc035f8
ret

Function at 0xb480f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08324], 1
jne 0xb4818c
or dword [0xc08324], 1
mov dword [0xc02efc], 0x33363e19
mov dword [0xc02f00], 0x2b7f3b3a
mov dword [0xc02f04], 0x293a7f30
mov dword [0xc02f08], 0x3e2a333e
mov dword [0xc02f0c], 0x3d7f3a2b
mov dword [0xc02f10], 0x2c2b3030
mov dword [0xc02f14], 0x2f3e2d2b
mov dword [0xc02f18], 0x3e2d397f
mov dword [0xc02f1c], 0x313a3238
mov dword [0xc02f20], 0x327f732b
mov dword [0xc02f24], 0x2d30323a
mov dword [0xc02f28], 0x2d3a7f26
mov dword [0xc02f2c], 0x5f2d302d
xor eax, eax
mov cl, byte [eax + 0xc02efc]
xor cl, 0x5f
mov byte [eax + 0xc0362c], cl
inc eax
cmp eax, 0x34
jb 0xb4818e
mov eax, 0xc0362c
ret

Function at 0xb481a9
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xc08320], 1
jne 0xb48212
or dword [0xc08320], 1
mov dword [0xc02f30], 0x3134310a
mov dword [0xc02f34], 0x7f312830
mov dword [0xc02f38], 0x302d2d3a
mov dword [0xc02f3c], 0x31367f2d
mov dword [0xc02f40], 0x3e2a337f
mov dword [0xc02f44], 0x30330013
mov dword [0xc02f48], 0x2b2c3b3e
mov dword [0xc02f4c], 0x3831362d
mov byte [0xc02f50], 0x5f
mov cl, byte [eax + 0xc02f30]
xor cl, 0x5f
mov byte [eax + 0xc03660], cl
inc eax
cmp eax, 0x21
jb 0xb48212
mov eax, 0xc03660
ret

Function at 0xb4822d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc0831c], 1
jne 0xb48257
or dword [0xc0831c], 1
mov dword [0xc02f54], 0x31303163
mov word [0xc02f58], 0x613a
mov byte [0xc02f5a], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc02f54]
xor cl, 0x5f
mov byte [eax + 0xc03684], cl
inc eax
cmp eax, 7
jb 0xb48259
mov eax, 0xc03684
ret

Function at 0xb48274
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08318], 1
jne 0xb482b6
or dword [0xc08318], 1
mov dword [0xc02f5c], 0x7f3e2a13
mov dword [0xc02f60], 0x2b312a2d
mov dword [0xc02f64], 0x7f3a3236
mov dword [0xc02f68], 0x302d2d3a
mov dword [0xc02f6c], 0x5f7f652d
xor eax, eax
mov cl, byte [eax + 0xc02f5c]
xor cl, 0x5f
mov byte [eax + 0xc0368c], cl
inc eax
cmp eax, 0x14
jb 0xb482b8
mov eax, 0xc0368c
ret
Function at 0xb482d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08314], 1
jne 0xb4831b
or dword [0xc08314], 1
mov dword [0xc02f70], 0x7f3e2a13
mov dword [0xc02f74], 0x30323a32
mov dword [0xc02f78], 0x3a7f262d
mov dword [0xc02f7c], 0x2d302d2d
mov word [0xc02f80], 0x7f65
mov byte [0xc02f82], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc02f70]
xor cl, 0x5f
mov byte [eax + 0xc036a0], cl
inc eax
cmp eax, 0x13
jb 0xb4831d
mov eax, 0xc036a0
ret

Function at 0xb48338
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08310], 1
jne 0xb4839f
or dword [0xc08310], 1
mov dword [0xc02f84], 0x7f3e2a13
mov dword [0xc02f88], 0x302d2d3a
mov dword [0xc02f8c], 0x31367f2d
mov dword [0xc02f90], 0x3a3b362c
mov dword [0xc02f94], 0x2d2d3a7f
mov dword [0xc02f98], 0x377f2d30
mov dword [0xc02f9c], 0x333b313e
mov dword [0xc02fa0], 0x7f652d3a
mov byte [0xc02fa4], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc02f84]
xor cl, 0x5f
mov byte [eax + 0xc036b4], cl
inc eax
cmp eax, 0x21
jb 0xb483a1
mov eax, 0xc036b4
ret

Function at 0xb483bc
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xc0830c], 1
jne 0xb4841a
or dword [0xc0830c], 1
mov dword [0xc02fa8], 0x3134310a
mov dword [0xc02fac], 0x7f312830
mov dword [0xc02fb0], 0x302d2d3a
mov dword [0xc02fb4], 0x31367f2d
mov dword [0xc02fb8], 0x3e2a337f
mov dword [0xc02fbc], 0x3e3c2f00
mov word [0xc02fc0], 0x3333
mov byte [0xc02fc2], 0x5f
mov cl, byte [eax + 0xc02fa8]
xor cl, 0x5f
mov byte [eax + 0xc036d8], cl
inc eax
cmp eax, 0x1b
jb 0xb4841a
mov eax, 0xc036d8
ret

Function at 0xb48656
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc08308], 1
jne 0xb4869f
or dword [0xc08308], 1
mov dword [0xc02fc4], 0x3a2c3e1d
mov dword [0xc02fc8], 0x3b7f6b69
mov dword [0xc02fcc], 0x3b303c3a
mov dword [0xc02fd0], 0x3e397f3a
mov dword [0xc02fd4], 0x3b3a3336
mov byte [0xc02fd8], 0x5f
xor eax, eax
mov cl, byte [eax + 0xc02fc4]
xor cl, 0x5f
mov byte [eax + 0xc036f4], cl
inc eax
cmp eax, 0x15
jb 0xb486a1
mov eax, 0xc036f4
ret