joyce8/EMBER2024-capa huggingface dataset:
Function at 0xee4175
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82764], 1
jne 0xee41e5
or dword [0xf82764], 1
mov dword [0xf80f7c], 0x127201e
mov dword [0xf80f80], 0x18393d3d
mov dword [0xf80f84], 0x303b2c3c
mov dword [0xf80f88], 0x283d280d
mov dword [0xf80f8c], 0x20283f08
mov dword [0xf80f90], 0x252b2825
mov dword [0xf80f94], 0x6960612c
mov dword [0xf80f98], 0x2520282f
mov word [0xf80f9c], 0x2d2c
mov byte [0xf80f9e], 0x49
xor eax, eax
mov cl, byte [eax + 0xf80f7c]
xor cl, 0x49
mov byte [eax + 0xf81234], cl
inc eax
cmp eax, 0x23
jb 0xee41e7
mov eax, 0xf81234
ret

Function at 0xee4202
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82760], 1
jne 0xee4259
or dword [0xf82760], 1
mov dword [0xf80fa0], 0x2c3d2700
mov dword [0xf80fa4], 0x3d2c273b
mov dword [0xf80fa8], 0x2d282c1b
mov dword [0xf80fac], 0x2c25200f
mov dword [0xf80fb0], 0x2f696061
mov dword [0xf80fb4], 0x2c252028
mov word [0xf80fb8], 0x492d
mov cl, byte [eax + 0xf80fa0]
xor cl, 0x49
mov byte [eax + 0xf81258], cl
inc eax
cmp eax, 0x1a
jb 0xee4259
mov eax, 0xf81258
ret

Function at 0xee5057
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82744], 1
jne 0xee50de
or dword [0xf82744], 1
mov dword [0xf81290], 0x3f6a240b
mov dword [0xf81294], 0x292f3824
mov dword [0xf81298], 0x23242d25
mov dword [0xf8129c], 0x6a2e2f30
mov dword [0xf812a0], 0x2f21253e
mov dword [0xf812a4], 0x2b3d6a24
mov dword [0xf812a8], 0x252c6a39
mov dword [0xf812ac], 0x6a2e243f
mov dword [0xf812b0], 0x296a3e2b
mov dword [0xf812b4], 0x2b382b22
mov dword [0xf812b8], 0x382f3e29
mov word [0xf812bc], 0x4a6a
xor eax, eax
mov cl, byte [eax + 0xf81290]
xor cl, 0x4a
mov byte [eax + 0xf813e0], cl
inc eax
cmp eax, 0x2e
jb 0xee50e0
mov eax, 0xf813e0
ret
Function at 0xee5524
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82740], 1
jne 0xee5580
or dword [0xf82740], 1
mov dword [0xf812c0], 0x39392307
mov dword [0xf812c4], 0x6a2d2423
mov dword [0xf812c8], 0x2f266a2b
mov dword [0xf812cc], 0x3a6a3e2c
mov dword [0xf812d0], 0x242f382b
mov dword [0xf812d4], 0x392f223e
mov word [0xf812d8], 0x3923
mov byte [0xf812da], 0x4a
xor eax, eax
mov cl, byte [eax + 0xf812c0]
xor cl, 0x4a
mov byte [eax + 0xf81410], cl
inc eax
cmp eax, 0x1b
jb 0xee5582
mov eax, 0xf81410
ret

Function at 0xee559d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf8273c], 1
jne 0xee5606
or dword [0xf8273c], 1
mov dword [0xf812dc], 0x6a3e2504
mov dword [0xf812e0], 0x3f25242f
mov dword [0xf812e4], 0x256a222d
mov dword [0xf812e8], 0x2b382f3a
mov dword [0xf812ec], 0x6a392e24
mov dword [0xf812f0], 0x2f6a2423
mov dword [0xf812f4], 0x2f383a32
mov dword [0xf812f8], 0x25233939
mov word [0xf812fc], 0x4a24
xor eax, eax
mov cl, byte [eax + 0xf812dc]
xor cl, 0x4a
mov byte [eax + 0xf8142c], cl
inc eax
cmp eax, 0x22
jb 0xee5608
mov eax, 0xf8142c
ret

Function at 0xee5623
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82738], 1
jne 0xee5683
or dword [0xf82738], 1
mov dword [0xf81300], 0x6a25251e
mov dword [0xf81304], 0x33242b27
mov dword [0xf81308], 0x2f3a256a
mov dword [0xf8130c], 0x2e242b38
mov dword [0xf81310], 0x24236a39
mov dword [0xf81314], 0x3a322f6a
mov dword [0xf81318], 0x39392f38
mov dword [0xf8131c], 0x4a242523
xor eax, eax
mov cl, byte [eax + 0xf81300]
xor cl, 0x4a
mov byte [eax + 0xf81450], cl
inc eax
cmp eax, 0x20
jb 0xee5685
mov eax, 0xf81450
ret

Function at 0xee56a0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82734], 1
jne 0xee56f6
or dword [0xf82734], 1
mov dword [0xf81320], 0x39392307
mov dword [0xf81324], 0x6a2d2423
mov dword [0xf81328], 0x23386a2b
mov dword [0xf8132c], 0x6a3e222d
mov dword [0xf81330], 0x2f382b3a
mov dword [0xf81334], 0x2f223e24
mov dword [0xf81338], 0x4a392339
xor eax, eax
mov cl, byte [eax + 0xf81320]
xor cl, 0x4a
mov byte [eax + 0xf81470], cl
inc eax
cmp eax, 0x1c
jb 0xee56f8
mov eax, 0xf81470
ret

Function at 0xee5713
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82730], 1
jne 0xee5784
or dword [0xf82730], 1
mov dword [0xf8133c], 0x382b241f
mov dword [0xf81340], 0x3a256a33
mov dword [0xf81344], 0x3e2b382f
mov dword [0xf81348], 0x276a3825
mov dword [0xf8134c], 0x6a3e393f
mov dword [0xf81350], 0x2f3c2b22
mov dword [0xf81354], 0x2f24256a
mov dword [0xf81358], 0x2f3a256a
mov dword [0xf8135c], 0x2e242b38
mov byte [0xf81360], 0x4a
xor eax, eax
mov cl, byte [eax + 0xf8133c]
xor cl, 0x4a
mov byte [eax + 0xf8148c], cl
inc eax
cmp eax, 0x25
jb 0xee5786
mov eax, 0xf8148c
ret
Function at 0xee57a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf8272c], 1
jne 0xee581b
or dword [0xf8272c], 1
mov dword [0xf81364], 0x2b242308
mov dword [0xf81368], 0x256a3338
mov dword [0xf8136c], 0x2b382f3a
mov dword [0xf81370], 0x6a38253e
mov dword [0xf81374], 0x3e393f27
mov dword [0xf81378], 0x3c2b226a
mov dword [0xf8137c], 0x3d3e6a2f
mov dword [0xf81380], 0x3a256a25
mov dword [0xf81384], 0x242b382f
mov word [0xf81388], 0x392e
mov byte [0xf8138a], 0x4a
xor eax, eax
mov cl, byte [eax + 0xf81364]
xor cl, 0x4a
mov byte [eax + 0xf814b4], cl
inc eax
cmp eax, 0x27
jb 0xee581d
mov eax, 0xf814b4
ret

Function at 0xee5838
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82728], 1
jne 0xee58a1
or dword [0xf82728], 1
mov dword [0xf8138c], 0x2b242308
mov dword [0xf81390], 0x256a3338
mov dword [0xf81394], 0x2b382f3a
mov dword [0xf81398], 0x6a38253e
mov dword [0xf8139c], 0x6a3e2524
mov dword [0xf813a0], 0x263a2723
mov dword [0xf813a4], 0x242f272f
mov dword [0xf813a8], 0x702e2f3e
mov word [0xf813ac], 0x4a6a
xor eax, eax
mov cl, byte [eax + 0xf8138c]
xor cl, 0x4a
mov byte [eax + 0xf814dc], cl
inc eax
cmp eax, 0x22
jb 0xee58a3
mov eax, 0xf814dc
ret
Function at 0xee7253
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0xee7295
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0xf6be20]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0xf6be20]
inc edx
cmp dword [ebp + 8], 0
jne 0xee7260
pop esi
not eax
pop ebp
ret

Function at 0xee8ee0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0xee8f05
cmp dword [ecx + 0x38], ebx
je 0xee8f05
cmp eax, dword [ecx + 0x10]
jae 0xee8f05
cmp dword [ecx + 0x14], 1
jne 0xee8f05
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0xee8f07
xor edi, edi
cmp edi, ebx
je 0xee8fea
cmp esi, ebx
je 0xee8fea
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00ee8689
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0xee8f96
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00f26fd0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0xee8fbb
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00f26fd0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0xee8fec
xor eax, eax
pop edi
pop ebx
ret

Function at 0xee99e0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf8271c], 1
jne 0xee9a65
or dword [0xf8271c], 1
mov dword [0xf81518], 0x26232b0c
mov dword [0xf8151c], 0x3e6a2e2f
mov dword [0xf81520], 0x38296a25
mov dword [0xf81524], 0x2f3e2b2f
mov dword [0xf81528], 0x2b3f266a
mov dword [0xf8152c], 0x2b3e396a
mov dword [0xf81530], 0x626a2f3e
mov dword [0xf81534], 0x2138253d
mov dword [0xf81538], 0x3e6a382f
mov dword [0xf8153c], 0x2b2f3822
mov dword [0xf81540], 0x6a70632e
mov byte [0xf81544], 0x4a
xor eax, eax
mov cl, byte [eax + 0xf81518]
xor cl, 0x4a
mov byte [eax + 0xf815e0], cl
inc eax
cmp eax, 0x2d
jb 0xee9a67
mov eax, 0xf815e0
ret
Function at 0xee9a82
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf8270c], 1
jne 0xee9ae9
or dword [0xf8270c], 1
mov dword [0xf81554], 0x2f6a2504
mov dword [0xf81558], 0x38253838
mov dword [0xf8155c], 0x392f276a
mov dword [0xf81560], 0x2f2d2b39
mov dword [0xf81564], 0x3e2f386a
mov dword [0xf81568], 0x2f24383f
mov dword [0xf8156c], 0x33286a2e
mov dword [0xf81570], 0x2825206a
mov byte [0xf81574], 0x4a
xor eax, eax
mov cl, byte [eax + 0xf81554]
xor cl, 0x4a
mov byte [eax + 0xf8161c], cl
inc eax
cmp eax, 0x21
jb 0xee9aeb
mov eax, 0xf8161c
ret

Function at 0xee9b06
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82700], 1
jne 0xee9b6f
or dword [0xf82700], 1
mov dword [0xf815a0], 0x6a2b3f06
mov dword [0xf815a4], 0x2538382f
mov dword [0xf815a8], 0x3f386a38
mov dword [0xf815ac], 0x24232424
mov dword [0xf815b0], 0x382f6a2d
mov dword [0xf815b4], 0x6a382538
mov dword [0xf815b8], 0x2e242b22
mov dword [0xf815bc], 0x70382f26
mov word [0xf815c0], 0x4a6a
xor eax, eax
mov cl, byte [eax + 0xf815a0]
xor cl, 0x4a
mov byte [eax + 0xf81668], cl
inc eax
cmp eax, 0x22
jb 0xee9b71
mov eax, 0xf81668
ret

Function at 0xee9b8c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826fc], 1
jne 0xee9bde
or dword [0xf826fc], 1
mov dword [0xf815c4], 0x62b3f26
mov dword [0xf815c8], 0x2b252615
mov dword [0xf815cc], 0x383e392e
mov dword [0xf815d0], 0x6a2d2423
mov dword [0xf815d4], 0x26232b2c
mov word [0xf815d8], 0x2e2f
mov byte [0xf815da], 0x4a
xor eax, eax
mov cl, byte [eax + 0xf815c4]
xor cl, 0x4a
mov byte [eax + 0xf8168c], cl
inc eax
cmp eax, 0x17
jb 0xee9be0
mov eax, 0xf8168c
ret
Function at 0xeea8dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xf4ad72
call fcn.00f49c28
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0xf5212c]
test eax, eax
jne 0xeea924
call fcn.00eeaa7d
mov ecx, dword [ebp + 8]
push eax
call fcn.00ec6acd
mov eax, dword [ebp + 8]
jmp 0xeeaa6e
test byte [0xf826f0], 1
jne 0xeea945
or dword [0xf826f0], 1
mov dword [0xf816c8], 0x6b414642
mov byte [0xf816cc], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf816c8]
xor cl, 0x4b
mov byte [eax + 0xf81e9c], cl
inc eax
cmp eax, 5
jb 0xeea947
push 0xf
mov esi, 0xf81e9c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0xeea972
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00ec4c59
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00ec4cce
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00eefd82
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00ec4cef
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00ec4cef
push dword [ebp - 0x10]
call dword [0xf520e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.00eeadc8
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.00eeaae6
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00ec6b0a
add esp, 0xc
push 0xf6d294
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.00ecd68a
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.00ecb58f
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00ec4cef
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00ec4cef
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00ec4cef
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00ec4c0f
push ebx
push 1
mov ecx, esi
call fcn.00ec4cef
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0xeeaa7d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826f4], 1
jne 0xeeaac9
or dword [0xf826f4], 1
mov dword [0xf816b0], 0x2e39251e
mov dword [0xf816b4], 0x252c2428
mov dword [0xf816b8], 0x2f2e3122
mov dword [0xf816bc], 0x39392e6b
mov dword [0xf816c0], 0x286b3924
mov dword [0xf816c4], 0x4b2e2f24
xor eax, eax
mov cl, byte [eax + 0xf816b0]
xor cl, 0x4b
mov byte [eax + 0xf81e84], cl
inc eax
cmp eax, 0x18
jb 0xeeaacb
mov eax, 0xf81e84
ret

Function at 0xeeaae6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826ec], 1
jne 0xeeab24
or dword [0xf826ec], 1
mov dword [0xf816d0], 0x392e636b
mov dword [0xf816d4], 0x6b392439
mov dword [0xf816d8], 0x2e2f2428
mov word [0xf816dc], 0x6b71
mov byte [0xf816de], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf816d0]
xor cl, 0x4b
mov byte [eax + 0xf81ea4], cl
inc eax
cmp eax, 0xf
jb 0xeeab26
mov eax, 0xf81ea4
ret
Function at 0xeeadc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0xf826e8], 1
jne 0xeeadf3
or dword [0xf826e8], 1
mov dword [0xf816e0], 0x2f27276e
mov byte [0xf816e4], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf816e0]
xor cl, 0x4b
mov byte [eax + 0xf81eb4], cl
inc eax
cmp eax, 5
jb 0xeeadf5
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0xf81eb4
push eax
call fcn.00eefddb
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00ec4cce
mov eax, esi
leave
ret

Function at 0xeeaf97
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826e4], 1
jne 0xeeaff3
or dword [0xf826e4], 1
mov dword [0xf816e8], 0x63f2e0c
mov dword [0xf816ec], 0x273e2f24
mov dword [0xf816f0], 0x27220d2e
mov dword [0xf816f4], 0x262a052e
mov dword [0xf816f8], 0x2a2d6b2e
mov dword [0xf816fc], 0x2f2e2722
mov word [0xf81700], 0x6b71
mov byte [0xf81702], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf816e8]
xor cl, 0x4b
mov byte [eax + 0xf81ebc], cl
inc eax
cmp eax, 0x1b
jb 0xeeaff5
mov eax, 0xf81ebc
ret

Function at 0xeeb010
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826e0], 1
jne 0xeeb06d
or dword [0xf826e0], 1
mov dword [0xf81704], 0x83f2e18
mov dword [0xf81708], 0x2e39393e
mov dword [0xf8170c], 0x220f3f25
mov dword [0xf81710], 0x3f282e39
mov dword [0xf81714], 0x6b323924
mov dword [0xf81718], 0x27222a2d
mov dword [0xf8171c], 0x6b712f2e
mov byte [0xf81720], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf81704]
xor cl, 0x4b
mov byte [eax + 0xf81ed8], cl
inc eax
cmp eax, 0x1d
jb 0xeeb06f
mov eax, 0xf81ed8
ret

Function at 0xeeb181
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826dc], 1
jne 0xeeb1de
or dword [0xf826dc], 1
mov dword [0xf81724], 0x83f2e0c
mov dword [0xf81728], 0x2e39393e
mov dword [0xf8172c], 0x220f3f25
mov dword [0xf81730], 0x3f282e39
mov dword [0xf81734], 0x6b323924
mov dword [0xf81738], 0x27222a2d
mov dword [0xf8173c], 0x6b712f2e
mov byte [0xf81740], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf81724]
xor cl, 0x4b
mov byte [eax + 0xf81ef8], cl
inc eax
cmp eax, 0x1d
jb 0xeeb1e0
mov eax, 0xf81ef8
ret
Function at 0xeeb399
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826d8], 1
jne 0xeeb506
or dword [0xf826d8], 1
mov eax, 0x7917
mov ecx, eax
mov word [0xf81748], cx
mov word [0xf8174a], cx
inc ecx
mov word [0xf8174c], cx
lea ecx, [eax + 0x28]
mov word [0xf8174e], cx
add ecx, 0xfffffffa
lea edx, [eax + 0xb]
mov word [0xf81750], cx
push ebx
mov ecx, edx
mov word [0xf81752], cx
add ecx, 3
push esi
mov esi, ecx
lea ecx, [eax + 0x16]
mov word [0xf81754], si
lea esi, [eax + 0x15]
mov word [0xf81756], si
mov word [0xf81764], cx
add esi, 0xfffffff8
add edx, 5
mov ecx, esi
push edi
lea edi, [eax + 0x17]
mov word [0xf81766], cx
mov ecx, eax
mov word [0xf8175c], dx
mov edx, edi
mov word [0xf81768], cx
mov word [0xf8176a], cx
add ecx, 0x64
mov word [0xf8175e], dx
mov edx, ecx
mov word [0xf8176c], dx
lea edx, [eax + 0x68]
mov ebx, edx
mov word [0xf8176e], bx
mov ebx, ecx
mov word [0xf81770], bx
lea ebx, [eax + 0x5b]
mov word [0xf8177e], ax
mov word [0xf81772], bx
mov ebx, ecx
mov ecx, eax
add eax, 4
mov word [0xf81780], ax
lea eax, [ecx + 0x18]
mov word [0xf81786], ax
add eax, 0xf
mov word [0xf81788], ax
lea eax, [ecx + 0x11]
mov word [0xf8178a], ax
add eax, 0x17
mov word [0xf8178c], ax
lea eax, [ecx - 0x12]
mov word [0xf8178e], ax
add eax, 0x25
pop edi
mov word [0xf81790], ax
lea eax, [ecx + 0x34]
pop esi
mov word [0xf81774], bx
mov dword [0xf81758], 0x7922790d
mov dword [0xf81760], 0x79257902
mov word [0xf81776], dx
mov dword [0xf81778], 0x797b7909
mov word [0xf8177c], cx
mov dword [0xf81782], 0x79247939
mov dword [0xf81792], 0x792e7926
mov word [0xf81796], ax
pop ebx
xor eax, eax
mov ecx, 0x794b
xor cx, word [eax + 0xf81748]
add eax, 2
mov word [eax + 0xf81f16], cx
cmp eax, 0x50
jb 0xeeb508
mov eax, 0xf81f18
ret

Function at 0xeeb529
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826d4], 1
jne 0xeeb57e
or dword [0xf826d4], 1
mov dword [0xf81798], 0x3d6b2405
mov dword [0xf8179c], 0x2238392e
mov dword [0xf817a0], 0x226b2524
mov dword [0xf817a4], 0x6b242d25
mov dword [0xf817a8], 0x222a3d2a
mov dword [0xf817ac], 0x27292a27
mov word [0xf817b0], 0x4b2e
xor eax, eax
mov cl, byte [eax + 0xf81798]
xor cl, 0x4b
mov byte [eax + 0xf81f68], cl
inc eax
cmp eax, 0x1a
jb 0xeeb580
mov eax, 0xf81f68
ret

Function at 0xeeb76d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826d0], 1
jne 0xeeb7c2
or dword [0xf826d0], 1
mov dword [0xf817b4], 0x3d6b2405
mov dword [0xf817b8], 0x2238392e
mov dword [0xf817bc], 0x226b2524
mov dword [0xf817c0], 0x6b242d25
mov dword [0xf817c4], 0x222a3d2a
mov dword [0xf817c8], 0x27292a27
mov word [0xf817cc], 0x4b2e
xor eax, eax
mov cl, byte [eax + 0xf817b4]
xor cl, 0x4b
mov byte [eax + 0xf81f84], cl
inc eax
cmp eax, 0x1a
jb 0xeeb7c4
mov eax, 0xf81f84
ret
Function at 0xeeb7df
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826cc], 1
jne 0xeeb845
or dword [0xf826cc], 1
mov dword [0xf817d0], 0x2a3d2502
mov dword [0xf817d4], 0x6b2f2227
mov dword [0xf817d8], 0x38392e3d
mov dword [0xf817dc], 0x6b252422
mov dword [0xf817e0], 0x242d2522
mov dword [0xf817e4], 0x2c22386b
mov dword [0xf817e8], 0x3e3f2a25
mov word [0xf817ec], 0x2e39
mov byte [0xf817ee], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf817d0]
xor cl, 0x4b
mov byte [eax + 0xf81fa0], cl
inc eax
cmp eax, 0x1f
jb 0xeeb847
mov eax, 0xf81fa0
ret

Function at 0xeebb4c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826c8], 1
jne 0xeebbb2
or dword [0xf826c8], 1
mov dword [0xf817f0], 0x27222a0d
mov dword [0xf817f4], 0x3f6b2f2e
mov dword [0xf817f8], 0x2e2c6b24
mov dword [0xf817fc], 0x2e3f6b3f
mov dword [0xf81800], 0x2d6b3b26
mov dword [0xf81804], 0x2e2f2724
mov dword [0xf81808], 0x2a3b6b39
mov word [0xf8180c], 0x233f
mov byte [0xf8180e], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf817f0]
xor cl, 0x4b
mov byte [eax + 0xf81fc0], cl
inc eax
cmp eax, 0x1f
jb 0xeebbb4
mov eax, 0xf81fc0
ret

Function at 0xeebd24
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826c4], 1
jne 0xeebd76
or dword [0xf826c4], 1
mov dword [0xf81810], 0xd3f2e0c
mov dword [0xf81814], 0x2e2f2724
mov dword [0xf81818], 0x3f2a1b39
mov dword [0xf8181c], 0x2a2d6b23
mov dword [0xf81820], 0x2f2e2722
mov word [0xf81824], 0x6b71
mov byte [0xf81826], 0x4b
xor eax, eax
mov cl, byte [eax + 0xf81810]
xor cl, 0x4b
mov byte [eax + 0xf81fe0], cl
inc eax
cmp eax, 0x17
jb 0xeebd78
mov eax, 0xf81fe0
ret

Function at 0xeec040
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826c0], 1
mov edx, 0x794b
jne 0xeec0d7
or dword [0xf826c0], 1
lea ecx, [edx + 0x23]
mov eax, ecx
mov word [0xf81828], ax
add eax, 0xffffffad
mov word [0xf8182a], ax
push esi
lea eax, [edx - 0x12]
mov esi, eax
add eax, 0xfffffff1
mov word [0xf81834], ax
lea eax, [edx - 0x25]
mov word [0xf81836], ax
add eax, 0xfffffff6
mov word [0xf81838], ax
lea eax, [edx + 0x32]
mov word [0xf8182c], si
add esi, 0xffffffeb
mov word [0xf8183a], ax
add eax, 2
mov word [0xf8183c], ax
lea eax, [edx + 0x2d]
mov word [0xf8183e], ax
mov eax, edx
mov word [0xf8182e], si
mov dword [0xf81830], 0x7939792c
mov dword [0xf81840], 0x796e7979
mov word [0xf81844], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xf81828]
add eax, 2
mov word [eax + 0xf81ff6], cx
cmp eax, 0x1e
jb 0xeec0d9
mov eax, 0xf81ff8
ret

Function at 0xeec0f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826bc], 1
mov ecx, 0x794b
jne 0xeec138
or dword [0xf826bc], 1
lea eax, [ecx - 0x1b]
mov word [0xf81848], ax
add eax, 0xb
mov word [0xf8184a], ax
lea eax, [ecx - 0x1e]
mov word [0xf8184c], ax
add eax, 9
mov word [0xf8184e], ax
mov eax, ecx
mov word [0xf81850], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf81848]
add eax, 2
mov word [eax + 0xf82016], dx
cmp eax, 0xa
jb 0xeec13a
mov eax, 0xf82018
ret
Function at 0xeec158
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826b8], 1
mov ecx, 0x794b
jne 0xeec1ab
or dword [0xf826b8], 1
lea eax, [ecx - 0x1b]
mov word [0xf81854], ax
add eax, 0xb
mov word [0xf81856], ax
lea eax, [ecx - 0x1e]
mov word [0xf81858], ax
add eax, 0x4b
mov word [0xf8185a], ax
lea eax, [ecx + 0x2e]
mov word [0xf8185c], ax
add eax, 0xffffffbd
mov word [0xf8185e], ax
mov eax, ecx
mov word [0xf81860], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf81854]
add eax, 2
mov word [eax + 0xf82022], dx
cmp eax, 0xe
jb 0xeec1ad
mov eax, 0xf82024
ret

Function at 0xeec1cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826b4], 1
mov ecx, 0x794b
jne 0xeec21e
or dword [0xf826b4], 1
lea eax, [ecx - 0x1b]
mov word [0xf81864], ax
add eax, 0xb
mov word [0xf81866], ax
lea eax, [ecx - 0x1e]
mov word [0xf81868], ax
add eax, 0x50
mov word [0xf8186a], ax
lea eax, [ecx + 0x34]
mov word [0xf8186c], ax
add eax, 0xffffffb7
mov word [0xf8186e], ax
mov eax, ecx
mov word [0xf81870], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf81864]
add eax, 2
mov word [eax + 0xf82032], dx
cmp eax, 0xe
jb 0xeec220
mov eax, 0xf82034
ret

Function at 0xeec23e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826b0], 1
mov ecx, 0x794b
jne 0xeec27f
or dword [0xf826b0], 1
lea eax, [ecx - 0x1b]
mov word [0xf81874], ax
add eax, 0xb
mov word [0xf81876], ax
lea eax, [ecx - 0x1e]
mov word [0xf81878], ax
add eax, 9
mov word [0xf8187a], ax
mov eax, ecx
mov word [0xf8187c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf81874]
add eax, 2
mov word [eax + 0xf82042], dx
cmp eax, 0xa
jb 0xeec281
mov eax, 0xf82044
ret

Function at 0xeec29f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf826ac], 1
mov ecx, 0x794b
jne 0xeec2f2
or dword [0xf826ac], 1
lea eax, [ecx - 0x1b]
mov word [0xf81880], ax
add eax, 0xb
mov word [0xf81882], ax
lea eax, [ecx - 0x1e]
mov word [0xf81884], ax
add eax, 0x4b
mov word [0xf81886], ax
lea eax, [ecx + 0x2e]
mov word [0xf81888], ax
add eax, 0xffffffbd
mov word [0xf8188a], ax
mov eax, ecx
mov word [0xf8188c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf81880]
add eax, 2
mov word [eax + 0xf8204e], dx
cmp eax, 0xe
jb 0xeec2f4
mov eax, 0xf82050
ret