joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe3657a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7dcc], 1
jne 0xe365ea
or dword [0xed7dcc], 1
mov dword [0xed63cc], 0x96b0b789
mov dword [0xed63d0], 0x8faeaaaa
mov dword [0xed63d4], 0xa7acbbab
mov dword [0xed63d8], 0xbfaabf9a
mov dword [0xed63dc], 0xb7bfa89f
mov dword [0xed63e0], 0xb2bcbfb2
mov dword [0xed63e4], 0xfef7f6bb
mov dword [0xed63e8], 0xb2b7bfb8
mov word [0xed63ec], 0xbabb
mov byte [0xed63ee], 0xde
xor eax, eax
mov cl, byte [eax + 0xed63cc]
xor cl, 0xde
mov byte [eax + 0xed6684], cl
inc eax
cmp eax, 0x23
jb 0xe365ec
mov eax, 0xed6684
ret

Function at 0xe36607
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7dc8], 1
jne 0xe3665c
or dword [0xed7dc8], 1
mov dword [0xed63f0], 0xbbaab097
mov dword [0xed63f4], 0xaabbb0ac
mov dword [0xed63f8], 0xbabfbb8c
mov dword [0xed63fc], 0xbbb2b798
mov dword [0xed6400], 0xb8fef7f6
mov dword [0xed6404], 0xbbb2b7bf
mov word [0xed6408], 0xdeba
xor eax, eax
mov cl, byte [eax + 0xed63f0]
xor cl, 0xde
mov byte [eax + 0xed66a8], cl
inc eax
cmp eax, 0x1a
jb 0xe3665e
mov eax, 0xed66a8
ret

Function at 0xe373d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7dac], 1
jne 0xe3748f
or dword [0xed7dac], 1
or al, 0xff
mov word [0xed66e0], 0xb19e
mov byte [0xed66e2], al
mov dword [0xed66e3], 0xbaadb1aa
mov dword [0xed66e7], 0xb1b8b0bc
mov dword [0xed66eb], 0xbbbaa5b6
mov byte [0xed66ef], al
mov dword [0xed66f0], 0xbab4b0ab
mov byte [0xed66f4], 0xb1
mov byte [0xed66f5], al
mov word [0xed66f6], 0xbea8
mov byte [0xed66f8], 0xac
mov byte [0xed66f9], al
mov dword [0xed66fa], 0xb1aab0b9
mov byte [0xed66fe], 0xbb
mov byte [0xed66ff], al
mov word [0xed6700], 0xabbe
mov byte [0xed6702], al
mov dword [0xed6703], 0xadbeb7bc
mov dword [0xed6707], 0xbaabbcbe
mov byte [0xed670b], 0xad
mov byte [0xed670c], al
mov byte [0xed670d], 0xdf
xor eax, eax
mov cl, byte [eax + 0xed66e0]
xor cl, 0xdf
mov byte [eax + 0xed6830], cl
inc eax
cmp eax, 0x2e
jb 0xe37491
mov eax, 0xed6830
ret
Function at 0xe378d5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7da8], 1
jne 0xe37931
or dword [0xed7da8], 1
mov dword [0xed6710], 0xacacb692
mov dword [0xed6714], 0xffb8b1b6
mov dword [0xed6718], 0xbab3ffbe
mov dword [0xed671c], 0xafffabb9
mov dword [0xed6720], 0xb1baadbe
mov dword [0xed6724], 0xacbab7ab
mov word [0xed6728], 0xacb6
mov byte [0xed672a], 0xdf
xor eax, eax
mov cl, byte [eax + 0xed6710]
xor cl, 0xdf
mov byte [eax + 0xed6860], cl
inc eax
cmp eax, 0x1b
jb 0xe37933
mov eax, 0xed6860
ret

Function at 0xe3794e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7da4], 1
jne 0xe379dc
or dword [0xed7da4], 1
or al, 0xff
mov word [0xed672c], 0xb091
mov byte [0xed672e], 0xab
mov byte [0xed672f], al
mov dword [0xed6730], 0xaab0b1ba
mov word [0xed6734], 0xb7b8
mov byte [0xed6736], al
mov dword [0xed6737], 0xadbaafb0
mov dword [0xed673b], 0xacbbb1be
mov byte [0xed673f], al
mov word [0xed6740], 0xb1b6
mov byte [0xed6742], al
mov dword [0xed6743], 0xadafa7ba
mov dword [0xed6747], 0xb6acacba
mov word [0xed674b], 0xb1b0
mov byte [0xed674d], 0xdf
xor eax, eax
mov cl, byte [eax + 0xed672c]
xor cl, 0xdf
mov byte [eax + 0xed687c], cl
inc eax
cmp eax, 0x22
jb 0xe379de
mov eax, 0xed687c
ret

Function at 0xe379f9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7da0], 1
jne 0xe37a7a
or dword [0xed7da0], 1
or al, 0xff
mov word [0xed6750], 0xb08b
mov byte [0xed6752], 0xb0
mov byte [0xed6753], al
mov dword [0xed6754], 0xa6b1beb2
mov byte [0xed6758], al
mov dword [0xed6759], 0xadbaafb0
mov dword [0xed675d], 0xacbbb1be
mov byte [0xed6761], al
mov word [0xed6762], 0xb1b6
mov byte [0xed6764], al
mov dword [0xed6765], 0xadafa7ba
mov dword [0xed6769], 0xb6acacba
mov word [0xed676d], 0xb1b0
mov byte [0xed676f], 0xdf
xor eax, eax
mov cl, byte [eax + 0xed6750]
xor cl, 0xdf
mov byte [eax + 0xed68a0], cl
inc eax
cmp eax, 0x20
jb 0xe37a7c
mov eax, 0xed68a0
ret

Function at 0xe37a97
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d9c], 1
jne 0xe37aed
or dword [0xed7d9c], 1
mov dword [0xed6770], 0xacacb692
mov dword [0xed6774], 0xffb8b1b6
mov dword [0xed6778], 0xb6adffbe
mov dword [0xed677c], 0xffabb7b8
mov dword [0xed6780], 0xbaadbeaf
mov dword [0xed6784], 0xbab7abb1
mov dword [0xed6788], 0xdfacb6ac
xor eax, eax
mov cl, byte [eax + 0xed6770]
xor cl, 0xdf
mov byte [eax + 0xed68c0], cl
inc eax
cmp eax, 0x1c
jb 0xe37aef
mov eax, 0xed68c0
ret

Function at 0xe37b0a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d98], 1
jne 0xe37b92
or dword [0xed7d98], 1
or al, 0xff
mov dword [0xed678c], 0xadbeb18a
mov byte [0xed6790], 0xa6
mov byte [0xed6791], al
mov dword [0xed6792], 0xadbaafb0
mov dword [0xed6796], 0xadb0abbe
mov byte [0xed679a], al
mov dword [0xed679b], 0xabacaab2
mov byte [0xed679f], al
mov dword [0xed67a0], 0xbaa9beb7
mov byte [0xed67a4], al
mov word [0xed67a5], 0xb1b0
mov byte [0xed67a7], 0xba
mov byte [0xed67a8], al
mov dword [0xed67a9], 0xadbaafb0
mov dword [0xed67ad], 0xdfbbb1be
xor eax, eax
mov cl, byte [eax + 0xed678c]
xor cl, 0xdf
mov byte [eax + 0xed68dc], cl
inc eax
cmp eax, 0x25
jb 0xe37b94
mov eax, 0xed68dc
ret
Function at 0xe37baf
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d94], 1
jne 0xe37c44
or dword [0xed7d94], 1
or al, 0xff
mov dword [0xed67b4], 0xbeb1b69d
mov word [0xed67b8], 0xa6ad
mov byte [0xed67ba], al
mov dword [0xed67bb], 0xadbaafb0
mov dword [0xed67bf], 0xadb0abbe
mov byte [0xed67c3], al
mov dword [0xed67c4], 0xabacaab2
mov byte [0xed67c8], al
mov dword [0xed67c9], 0xbaa9beb7
mov byte [0xed67cd], al
mov word [0xed67ce], 0xa8ab
mov byte [0xed67d0], 0xb0
mov byte [0xed67d1], al
mov dword [0xed67d2], 0xadbaafb0
mov dword [0xed67d6], 0xacbbb1be
mov byte [0xed67da], 0xdf
xor eax, eax
mov cl, byte [eax + 0xed67b4]
xor cl, 0xdf
mov byte [eax + 0xed6904], cl
inc eax
cmp eax, 0x27
jb 0xe37c46
mov eax, 0xed6904
ret

Function at 0xe37c61
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d90], 1
jne 0xe37ce3
or dword [0xed7d90], 1
or al, 0xff
mov dword [0xed67dc], 0xbeb1b69d
mov word [0xed67e0], 0xa6ad
mov byte [0xed67e2], al
mov dword [0xed67e3], 0xadbaafb0
mov dword [0xed67e7], 0xadb0abbe
mov byte [0xed67eb], al
mov word [0xed67ec], 0xb0b1
mov byte [0xed67ee], 0xab
mov byte [0xed67ef], al
mov dword [0xed67f0], 0xb3afb2b6
mov dword [0xed67f4], 0xb1bab2ba
mov dword [0xed67f8], 0xe5bbbaab
mov byte [0xed67fc], al
mov byte [0xed67fd], 0xdf
xor eax, eax
mov cl, byte [eax + 0xed67dc]
xor cl, 0xdf
mov byte [eax + 0xed692c], cl
inc eax
cmp eax, 0x22
jb 0xe37ce5
mov eax, 0xed692c
ret

Function at 0xe38c19
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d80], 1
mov edx, 0xb1e1
jne 0xe38cab
or dword [0xed7d80], 1
lea ecx, [edx - 0x1d]
push esi
mov eax, ecx
mov word [0xed698c], ax
add eax, 0xffffffee
mov esi, eax
mov word [0xed698e], si
lea eax, [edx - 0x2c]
mov word [0xed6994], ax
add eax, 0xffffffef
mov esi, eax
mov word [0xed6996], si
lea esi, [edx - 0x35]
mov word [0xed6998], si
add esi, 0xfffffff9
mov word [0xed699a], si
lea esi, [edx - 0x2e]
mov word [0xed699c], si
add esi, 0xfffffff5
mov eax, edx
mov word [0xed699e], si
mov dword [0xed6990], 0xb1b2b1b8
mov dword [0xed69a0], 0xb1a4b1b7
mov word [0xed69a4], cx
mov word [0xed69a6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xed698c]
add eax, 2
mov word [eax + 0xed6a46], cx
cmp eax, 0x1c
jb 0xe38cad
mov eax, 0xed6a48
ret

Function at 0xe38ccb
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d7c], 1
jne 0xe38d2a
or dword [0xed7d7c], 1
mov dword [0xed69a8], 0xb79584a6
mov dword [0xed69ac], 0x8c948d8e
mov dword [0xed69b0], 0x878fa884
mov dword [0xed69b4], 0x808c938e
mov dword [0xed69b8], 0x8f8e8895
mov dword [0xed69bc], 0x8880a7c1
mov dword [0xed69c0], 0xdb85848d
mov word [0xed69c4], 0xe1c1
xor eax, eax
mov cl, byte [eax + 0xed69a8]
xor cl, 0xe1
mov byte [eax + 0xed6a64], cl
inc eax
cmp eax, 0x1e
jb 0xe38d2c
mov eax, 0xed6a64
ret
Function at 0xe38f09
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d78], 1
jne 0xe3912b
or dword [0xed7d78], 1
push ebx
push esi
push edi
mov edi, 0xb1a9
mov eax, edi
mov word [0xed69c8], ax
inc eax
mov word [0xed69ca], ax
lea esi, [edi - 5]
mov eax, esi
mov word [0xed69cc], ax
add eax, 0x14
mov word [0xed69ce], ax
lea edx, [edi + 0x15]
mov eax, edx
mov word [0xed69d0], ax
lea ecx, [edi + 4]
mov eax, ecx
mov word [0xed69d2], ax
inc eax
mov word [0xed69d4], ax
lea eax, [edi - 7]
mov word [0xed69d6], ax
add eax, 0xfffffffe
mov ebx, eax
mov word [0xed69d8], bx
mov word [0xed69e0], ax
lea ebx, [edi + 3]
mov ecx, ebx
lea eax, [edi - 1]
mov word [0xed69e6], ax
dec edx
mov eax, edx
mov word [0xed69ec], ax
lea eax, [edi + 9]
mov word [0xed69ee], ax
mov word [0xed69de], cx
add ecx, 0xffffffe2
mov eax, ecx
mov word [0xed69f0], ax
lea eax, [edi - 0x22]
mov word [0xed69f2], ax
add eax, 0xe
mov word [0xed69f4], ax
lea eax, [edi - 0x13]
add edi, 0xffffffd7
mov word [0xed69f6], ax
mov eax, edi
mov word [0xed69f8], ax
lea eax, [esi - 0x11]
mov esi, eax
mov word [0xed69fa], si
add esi, 0xfffffff1
mov word [0xed6a00], bx
mov word [0xed69fc], si
mov esi, edx
mov word [0xed69fe], si
lea esi, [ebx - 0x24]
mov ebx, esi
mov word [0xed6a02], bx
add ebx, 0xfffffffa
mov word [0xed6a04], bx
mov ebx, eax
mov word [0xed6a06], bx
mov ebx, ecx
mov word [0xed6a08], bx
lea ebx, [eax - 1]
mov word [0xed6a0a], bx
mov ebx, ecx
mov word [0xed6a0c], bx
lea ebx, [eax - 0xc]
mov word [0xed6a0e], bx
add ebx, 0xe
mov word [0xed6a10], bx
mov ebx, edx
mov word [0xed6a12], bx
mov dword [0xed69da], 0xb1beb1ad
mov dword [0xed69e2], 0xb1a9b1a2
mov dword [0xed69e8], 0xb1a4b1af
lea ebx, [eax + 0xf]
mov word [0xed6a14], bx
mov ebx, eax
mov word [0xed6a16], bx
add ebx, 5
mov word [0xed6a18], bx
lea ebx, [eax - 2]
mov eax, edi
mov word [0xed6a24], ax
mov eax, ebx
mov word [0xed6a26], ax
add eax, 0xfffffff8
mov ecx, eax
mov eax, esi
mov word [0xed6a36], ax
add eax, 7
mov word [0xed6a38], ax
lea eax, [esi - 4]
mov word [0xed6a3a], ax
add eax, 0x22
mov word [0xed6a3c], ax
lea eax, [esi - 3]
pop edi
mov word [0xed6a42], ax
add eax, 0x5c
pop esi
mov word [0xed6a1a], bx
mov dword [0xed6a1c], 0xb18eb195
mov dword [0xed6a20], 0xb193b186
mov word [0xed6a28], cx
mov dword [0xed6a2a], 0xb1bdb198
mov dword [0xed6a2e], 0xb180b1ac
mov dword [0xed6a32], 0xb189b182
mov dword [0xed6a3e], 0xb188b194
mov word [0xed6a44], ax
pop ebx
xor eax, eax
mov ecx, 0xb1e1
xor cx, word [eax + 0xed69c8]
add eax, 2
mov word [eax + 0xed6a86], cx
cmp eax, 0x7e
jb 0xe3912d
mov eax, 0xed6a88
ret
Function at 0xe39bcf
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0xe39d91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0xe39dd3
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0xebfee8]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0xebfee8]
inc edx
cmp dword [ebp + 8], 0
jne 0xe39d9e
pop esi
not eax
pop ebp
ret

Function at 0xe3ba1e
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0xe3ba43
cmp dword [ecx + 0x38], ebx
je 0xe3ba43
cmp eax, dword [ecx + 0x10]
jae 0xe3ba43
cmp dword [ecx + 0x14], 1
jne 0xe3ba43
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0xe3ba45
xor edi, edi
cmp edi, ebx
je 0xe3bb28
cmp esi, ebx
je 0xe3bb28
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00e3b1c7
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0xe3bad4
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00e7a030
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0xe3baf9
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00e7a030
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0xe3bb2a
xor eax, eax
pop edi
pop ebx
ret
Function at 0xe3cd87
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d70], 1
jne 0xe3ce0c
or dword [0xed7d70], 1
mov dword [0xed6b0c], 0x888d85a2
mov dword [0xed6b10], 0x90c48081
mov dword [0xed6b14], 0x9687c48b
mov dword [0xed6b18], 0x81908581
mov dword [0xed6b1c], 0x859188c4
mov dword [0xed6b20], 0x859097c4
mov dword [0xed6b24], 0xccc48190
mov dword [0xed6b28], 0x8f968b93
mov dword [0xed6b2c], 0x90c49681
mov dword [0xed6b30], 0x8581968c
mov dword [0xed6b34], 0xc4decd80
mov byte [0xed6b38], 0xe4
xor eax, eax
mov cl, byte [eax + 0xed6b0c]
xor cl, 0xe4
mov byte [eax + 0xed6bd4], cl
inc eax
cmp eax, 0x2d
jb 0xe3ce0e
mov eax, 0xed6bd4
ret

Function at 0xe3ce29
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d60], 1
jne 0xe3ce90
or dword [0xed7d60], 1
mov dword [0xed6b48], 0x81c48baa
mov dword [0xed6b4c], 0x968b9696
mov dword [0xed6b50], 0x978189c4
mov dword [0xed6b54], 0x81838597
mov dword [0xed6b58], 0x908196c4
mov dword [0xed6b5c], 0x818a9691
mov dword [0xed6b60], 0x9d86c480
mov dword [0xed6b64], 0x868b8ec4
mov byte [0xed6b68], 0xe4
xor eax, eax
mov cl, byte [eax + 0xed6b48]
xor cl, 0xe4
mov byte [eax + 0xed6c10], cl
inc eax
cmp eax, 0x21
jb 0xe3ce92
mov eax, 0xed6c10
ret

Function at 0xe3cead
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d54], 1
jne 0xe3cf16
or dword [0xed7d54], 1
mov dword [0xed6b94], 0xc48591a8
mov dword [0xed6b98], 0x8b969681
mov dword [0xed6b9c], 0x9196c496
mov dword [0xed6ba0], 0x8a8d8a8a
mov dword [0xed6ba4], 0x9681c483
mov dword [0xed6ba8], 0xc4968b96
mov dword [0xed6bac], 0x808a858c
mov dword [0xed6bb0], 0xde968188
mov word [0xed6bb4], 0xe4c4
xor eax, eax
mov cl, byte [eax + 0xed6b94]
xor cl, 0xe4
mov byte [eax + 0xed6c5c], cl
inc eax
cmp eax, 0x22
jb 0xe3cf18
mov eax, 0xed6c5c
ret

Function at 0xe3cf33
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d50], 1
jne 0xe3cf85
or dword [0xed7d50], 1
mov dword [0xed6bb8], 0xa8859188
mov dword [0xed6bbc], 0x858b88bb
mov dword [0xed6bc0], 0x96909780
mov dword [0xed6bc4], 0xc4838a8d
mov dword [0xed6bc8], 0x888d8582
mov word [0xed6bcc], 0x8081
mov byte [0xed6bce], 0xe4
xor eax, eax
mov cl, byte [eax + 0xed6bb8]
xor cl, 0xe4
mov byte [eax + 0xed6c80], cl
inc eax
cmp eax, 0x17
jb 0xe3cf87
mov eax, 0xed6c80
ret
Function at 0xe3dcfa
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe9dcfd
call fcn.00e9cd48
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0xea6134]
test eax, eax
jne 0xe3dd42
call fcn.00e3de9b
mov ecx, dword [ebp + 8]
push eax
call fcn.00e16ae2
mov eax, dword [ebp + 8]
jmp 0xe3de8c
test byte [0xed7d44], 1
jne 0xe3dd63
or dword [0xed7d44], 1
mov dword [0xed6cbc], 0xc6ecebef
mov byte [0xed6cc0], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed6cbc]
xor cl, 0xe6
mov byte [eax + 0xed73fc], cl
inc eax
cmp eax, 5
jb 0xe3dd65
push 0xf
mov esi, 0xed73fc
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0xe3dd90
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00e14e72
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00e14c8d
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00e423f4
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00e14cae
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00e14cae
push dword [ebp - 0x10]
call dword [0xea60e8]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.00e3e1e6
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.00e3df04
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00e16b1f
add esp, 0xc
push 0xec13a0
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.00e1f05a
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.00e1c99f
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00e14cae
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00e14cae
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00e14cae
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00e14c43
push ebx
push 1
mov ecx, esi
call fcn.00e14cae
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0xe3de9b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d48], 1
jne 0xe3dee7
or dword [0xed7d48], 1
mov dword [0xed6ca4], 0x839488b3
mov dword [0xed6ca8], 0x88818985
mov dword [0xed6cac], 0x82839c8f
mov dword [0xed6cb0], 0x949483c6
mov dword [0xed6cb4], 0x85c69489
mov dword [0xed6cb8], 0xe6838289
xor eax, eax
mov cl, byte [eax + 0xed6ca4]
xor cl, 0xe6
mov byte [eax + 0xed73e4], cl
inc eax
cmp eax, 0x18
jb 0xe3dee9
mov eax, 0xed73e4
ret

Function at 0xe3df04
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d40], 1
jne 0xe3df42
or dword [0xed7d40], 1
mov dword [0xed6cc4], 0x9483cec6
mov dword [0xed6cc8], 0xc6948994
mov dword [0xed6ccc], 0x83828985
mov word [0xed6cd0], 0xc6dc
mov byte [0xed6cd2], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed6cc4]
xor cl, 0xe6
mov byte [eax + 0xed7404], cl
inc eax
cmp eax, 0xf
jb 0xe3df44
mov eax, 0xed7404
ret
Function at 0xe3e1e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0xed7d3c], 1
jne 0xe3e211
or dword [0xed7d3c], 1
mov dword [0xed6cd4], 0x828a8ac3
mov byte [0xed6cd8], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed6cd4]
xor cl, 0xe6
mov byte [eax + 0xed7414], cl
inc eax
cmp eax, 5
jb 0xe3e213
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0xed7414
push eax
call fcn.00e4244d
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00e14c8d
mov eax, esi
leave
ret

Function at 0xe3e3b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d38], 1
jne 0xe3e411
or dword [0xed7d38], 1
mov dword [0xed6cdc], 0xab9283a1
mov dword [0xed6ce0], 0x8a938289
mov dword [0xed6ce4], 0x8a8fa083
mov dword [0xed6ce8], 0x8b87a883
mov dword [0xed6cec], 0x8780c683
mov dword [0xed6cf0], 0x82838a8f
mov word [0xed6cf4], 0xc6dc
mov byte [0xed6cf6], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed6cdc]
xor cl, 0xe6
mov byte [eax + 0xed741c], cl
inc eax
cmp eax, 0x1b
jb 0xe3e413
mov eax, 0xed741c
ret

Function at 0xe3e42e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d34], 1
jne 0xe3e48b
or dword [0xed7d34], 1
mov dword [0xed6cf8], 0xa59283b5
mov dword [0xed6cfc], 0x83949493
mov dword [0xed6d00], 0x8fa29288
mov dword [0xed6d04], 0x92858394
mov dword [0xed6d08], 0xc69f9489
mov dword [0xed6d0c], 0x8a8f8780
mov dword [0xed6d10], 0xc6dc8283
mov byte [0xed6d14], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed6cf8]
xor cl, 0xe6
mov byte [eax + 0xed7438], cl
inc eax
cmp eax, 0x1d
jb 0xe3e48d
mov eax, 0xed7438
ret

Function at 0xe3e59f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d30], 1
jne 0xe3e5fc
or dword [0xed7d30], 1
mov dword [0xed6d18], 0xa59283a1
mov dword [0xed6d1c], 0x83949493
mov dword [0xed6d20], 0x8fa29288
mov dword [0xed6d24], 0x92858394
mov dword [0xed6d28], 0xc69f9489
mov dword [0xed6d2c], 0x8a8f8780
mov dword [0xed6d30], 0xc6dc8283
mov byte [0xed6d34], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed6d18]
xor cl, 0xe6
mov byte [eax + 0xed7458], cl
inc eax
cmp eax, 0x1d
jb 0xe3e5fe
mov eax, 0xed7458
ret
Function at 0xe3e7b7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d2c], 1
jne 0xe3e926
mov eax, 0xb1ba
mov ecx, eax
mov word [0xed6d38], cx
mov word [0xed6d3a], cx
add ecx, 0xfffffffb
mov word [0xed6d3c], cx
lea ecx, [eax - 0x28]
mov word [0xed6d3e], cx
add ecx, 2
lea edx, [eax - 0x2b]
mov word [0xed6d40], cx
push ebx
mov ecx, edx
mov word [0xed6d42], cx
add ecx, 0xfffffff9
push esi
mov esi, ecx
lea ecx, [eax - 0x3a]
mov word [0xed6d44], si
lea esi, [eax - 0x39]
mov word [0xed6d46], si
mov word [0xed6d54], cx
add esi, 8
add edx, 0xfffffffb
mov ecx, esi
push edi
lea edi, [eax - 0x37]
mov word [0xed6d56], cx
mov ecx, eax
mov word [0xed6d4c], dx
mov edx, edi
mov word [0xed6d58], cx
mov word [0xed6d5a], cx
add ecx, 0x1c
mov word [0xed6d4e], dx
mov edx, ecx
or dword [0xed7d2c], 1
mov word [0xed6d5c], dx
lea edx, [eax + 0x18]
mov ebx, edx
mov word [0xed6d5e], bx
mov ebx, ecx
mov word [0xed6d60], bx
lea ebx, [eax + 0x25]
mov word [0xed6d6e], ax
mov word [0xed6d62], bx
mov ebx, ecx
mov ecx, eax
add eax, 0xfffffffc
mov word [0xed6d70], ax
lea eax, [ecx - 0x38]
mov word [0xed6d76], ax
add eax, 0x11
mov word [0xed6d78], ax
lea eax, [ecx - 0x35]
mov word [0xed6d7a], ax
add eax, 0xd
mov word [0xed6d7c], ax
lea eax, [ecx - 0x12]
mov word [0xed6d7e], ax
add eax, 0xffffffdf
pop edi
mov word [0xed6d80], ax
lea eax, [ecx + 0x2c]
pop esi
mov word [0xed6d64], bx
mov dword [0xed6d48], 0xb18fb1a0
mov dword [0xed6d50], 0xb188b1af
mov word [0xed6d66], dx
mov dword [0xed6d68], 0xb1d6b1a4
mov word [0xed6d6c], cx
mov dword [0xed6d72], 0xb189b194
mov dword [0xed6d82], 0xb183b18b
mov word [0xed6d86], ax
pop ebx
xor eax, eax
mov ecx, 0xb1e6
xor cx, word [eax + 0xed6d38]
add eax, 2
mov word [eax + 0xed7476], cx
cmp eax, 0x50
jb 0xe3e928
mov eax, 0xed7478
ret

Function at 0xe3e949
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d28], 1
jne 0xe3e99e
or dword [0xed7d28], 1
mov dword [0xed6d88], 0x90c689a8
mov dword [0xed6d8c], 0x8f959483
mov dword [0xed6d90], 0x8fc68889
mov dword [0xed6d94], 0xc6898088
mov dword [0xed6d98], 0x8f879087
mov dword [0xed6d9c], 0x8a84878a
mov word [0xed6da0], 0xe683
xor eax, eax
mov cl, byte [eax + 0xed6d88]
xor cl, 0xe6
mov byte [eax + 0xed74c8], cl
inc eax
cmp eax, 0x1a
jb 0xe3e9a0
mov eax, 0xed74c8
ret

Function at 0xe3eb8d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7d24], 1
jne 0xe3ebe2
or dword [0xed7d24], 1
mov dword [0xed6da4], 0x90c689a8
mov dword [0xed6da8], 0x8f959483
mov dword [0xed6dac], 0x8fc68889
mov dword [0xed6db0], 0xc6898088
mov dword [0xed6db4], 0x8f879087
mov dword [0xed6db8], 0x8a84878a
mov word [0xed6dbc], 0xe683
xor eax, eax
mov cl, byte [eax + 0xed6da4]
xor cl, 0xe6
mov byte [eax + 0xed74e4], cl
inc eax
cmp eax, 0x1a
jb 0xe3ebe4
mov eax, 0xed74e4
ret