joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420270
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040ddb0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42035f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x420403
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x420398
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420390
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x420400
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x42041a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x4203d2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4203d2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4203d2
Function at 0x47c630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
lea eax, [esp + 0x60]
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp + 0x38], 0x47fe90
mov dword [esp + 0x40], 0x47c735
mov dword [esp + 0x44], esp
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], eax
call dbg._Unwind_SjLj_Register
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x5f]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call sym.std::istream::sentry::sentry_std::istream__bool_
sub esp, 8
cmp byte [esp + 0x5f], 0
jne 0x47c6b3
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x80]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x80]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebx + eax + 0x78]
mov edx, dword [ecx + 8]
cmp edx, dword [ecx + 0xc]
jae 0x47c6f0
movzx eax, byte [edx]
add edx, 1
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x84]
mov byte [edx], al
jmp 0x47c698
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], 1
call eax
cmp eax, 0xffffffff
jne 0x47c6db
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
mov eax, dword [eax]
add ecx, dword [eax - 0xc]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x20], 0xffffffff
or eax, 6
mov dword [esp], eax
call method.std::basic_ios_char__std::char_traits_char___.clear_std::_Ios_Iostate_
sub esp, 4
jmp 0x47c698
Function at 0x401778
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [0x40121c]
pop ebx
mov eax, eax
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x4017af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 4], eax
lea esi, [ebp - 8]
push esi
push 0x40
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
nop
jne 0x4017cb
call dword [sym.imp.kernel32.dll_GetLastError]
mov eax, dword [ebp - 4]
leave
ret
Function at 0xbb110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0xbb11b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0xbb1160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0xbb11a8
mov esi, dword [ebp - 4]
jns 0xbb1187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0xbb1197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0xbb1169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0xbb1140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xbb11d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0xbb1024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0xbb1254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0xbb1214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xbb2540
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58e0c], 1
mov ecx, 0x7842
jne 0xbb25c7
or dword [0xc58e0c], 1
lea eax, [ecx + 0x25]
mov edx, eax
add eax, 0xffffffb7
mov word [0xc529d4], ax
mov word [0xc529c8], dx
add edx, 0xffffffaf
lea eax, [ecx - 0x1c]
mov word [0xc529d6], ax
add eax, 0x11
mov word [0xc529d8], ax
mov word [0xc529ca], dx
lea edx, [ecx - 0x3b]
lea eax, [ecx - 0x13]
mov word [0xc529da], ax
mov word [0xc529cc], dx
add edx, 8
add eax, 3
mov word [0xc529dc], ax
lea eax, [ecx - 0x25]
mov word [0xc529de], ax
mov eax, ecx
mov word [0xc529ce], dx
mov dword [0xc529d0], 0x78677812
mov word [0xc529e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc529c8]
add eax, 2
mov word [eax + 0xc53072], dx
cmp eax, 0x1a
jb 0xbb25c9
mov eax, 0xc53074
ret

Function at 0xbb25e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58e04], 1
jne 0xbb2615
or dword [0xc58e04], 1
mov dword [0xc529f0], 0x262d2f7e
mov dword [0xc529f4], 0x7d272e37
mov dword [0xc529f8], 0x427c7d7d
xor eax, eax
mov cl, byte [eax + 0xc529f0]
xor cl, 0x42
mov byte [eax + 0xc5309c], cl
inc eax
cmp eax, 0xc
jb 0xbb2617
mov eax, 0xc5309c
ret

Function at 0xbb2632
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58e00], 1
mov edx, 0x7842
jne 0xbb26f2
push esi
lea ecx, [edx + 0x1e]
mov eax, ecx
mov word [0xc529fc], ax
add eax, 2
or dword [0xc58e00], 1
mov word [0xc529fe], ax
lea eax, [edx + 0x2d]
mov esi, eax
mov word [0xc52a00], si
mov word [0xc52a02], ax
add eax, 0xffffffb2
mov word [0xc52a04], ax
lea eax, [edx - 0x12]
mov esi, eax
mov word [0xc52a06], si
add esi, 0xfffffff3
mov word [0xc52a08], si
lea esi, [edx - 0x11]
mov word [0xc52a0a], si
add esi, 0xfffffff9
mov word [0xc52a0c], si
lea esi, [edx - 0x25]
mov word [0xc52a0e], si
mov esi, eax
mov word [0xc52a10], si
add esi, 0xfffffff7
add eax, 6
mov word [0xc52a12], si
lea esi, [edx - 0x10]
mov word [0xc52a1a], ax
mov eax, edx
mov word [0xc52a14], si
mov dword [0xc52a16], 0x7830782d
mov dword [0xc52a1c], 0x7860787f
mov word [0xc52a20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xc529fc]
add eax, 2
mov word [eax + 0xc530a6], cx
cmp eax, 0x26
jb 0xbb26f4
mov eax, 0xc530a8
ret
Function at 0xbb27d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0xc58dfc], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x7842
jne 0xbb2813
or dword [0xc58dfc], 1
lea eax, [ecx - 0xd]
mov word [0xc52a24], ax
add eax, 0xffffffeb
mov word [0xc52a26], ax
mov eax, ecx
mov word [0xc52a28], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc52a24]
add eax, 2
mov word [eax + 0xc530ce], dx
cmp eax, 6
jb 0xbb2817
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0xbb283a
mov eax, dword [eax]
push 0xc530d0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00bfb957
add esp, 0xc
test eax, eax
jne 0xbb2905
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00bb3569
push dword [esp + 0x10]
call fcn.00bb290e
push eax
call fcn.00bfbeb1
push dword [esp + 0x18]
call fcn.00bfc43c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00bff010
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0xc2a08c]
test eax, eax
jne 0xbb28f3
call dword [0xc2a0a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00bda8bc
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0xbb28d7
mov eax, dword [eax]
push eax
call fcn.00bb294e
push eax
call fcn.00bfc180
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.00bb4ca8
jmp 0xbb2905
push dword [esp + 0x18]
mov esi, dword [0xc2a0bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xbb290e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58df8], 1
jne 0xbb2931
or dword [0xc58df8], 1
mov dword [0xc52a2c], 0xc07484f
mov word [0xc52a30], 0x4206
xor eax, eax
mov cl, byte [eax + 0xc52a2c]
xor cl, 0x42
mov byte [eax + 0xc530d8], cl
inc eax
cmp eax, 6
jb 0xbb2933
mov eax, 0xc530d8
ret

Function at 0xbb294e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58df4], 1
jne 0xbb29d3
or dword [0xc58df4], 1
mov dword [0xc52a34], 0x2e2b2304
mov dword [0xc52a38], 0x36622627
mov dword [0xc52a3c], 0x3021622d
mov dword [0xc52a40], 0x27362327
mov dword [0xc52a44], 0x23302162
mov dword [0xc52a48], 0x30622a31
mov dword [0xc52a4c], 0x302d3227
mov dword [0xc52a50], 0x62302736
mov dword [0xc52a54], 0x212d3032
mov dword [0xc52a58], 0x78313127
mov dword [0xc52a5c], 0x48316762
mov byte [0xc52a60], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52a34]
xor cl, 0x42
mov byte [eax + 0xc530e0], cl
inc eax
cmp eax, 0x2d
jb 0xbb29d5
mov eax, 0xc530e0
ret
Function at 0xbb3a9e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d94], 1
jne 0xbb3ad3
or dword [0xc58d94], 1
mov dword [0xc52ce0], 0x37262d0f
mov dword [0xc52ce4], 0x6278272e
mov dword [0xc52ce8], 0x484f3167
mov byte [0xc52cec], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52ce0]
xor cl, 0x42
mov byte [eax + 0xc5338c], cl
inc eax
cmp eax, 0xd
jb 0xbb3ad5
mov eax, 0xc5338c
ret

Function at 0xbb3af0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d90], 1
jne 0xbb3b2f
or dword [0xc58d90], 1
mov dword [0xc52cf0], 0x27302a16
mov dword [0xc52cf4], 0x62782623
mov dword [0xc52cf8], 0x3a673a72
mov dword [0xc52cfc], 0x484f484f
mov byte [0xc52d00], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52cf0]
xor cl, 0x42
mov byte [eax + 0xc5339c], cl
inc eax
cmp eax, 0x11
jb 0xbb3b31
mov eax, 0xc5339c
ret

Function at 0xbb3b4c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d8c], 1
jne 0xbb3b8a
or dword [0xc58d8c], 1
mov dword [0xc52d04], 0x27213a07
mov dword [0xc52d08], 0x2d2b3632
mov dword [0xc52d0c], 0x2667622c
mov word [0xc52d10], 0x484f
mov byte [0xc52d12], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52d04]
xor cl, 0x42
mov byte [eax + 0xc533b0], cl
inc eax
cmp eax, 0xf
jb 0xbb3b8c
mov eax, 0xc533b0
ret

Function at 0xbb3ba7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d88], 1
jne 0xbb3be5
or dword [0xc58d88], 1
mov dword [0xc52d14], 0x23212d0e
mov dword [0xc52d18], 0x2c2d2b36
mov dword [0xc52d1c], 0x32676278
mov word [0xc52d20], 0x484f
mov byte [0xc52d22], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52d14]
xor cl, 0x42
mov byte [eax + 0xc533c0], cl
inc eax
cmp eax, 0xf
jb 0xbb3be7
mov eax, 0xc533c0
ret

Function at 0xbb3c02
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d84], 1
jne 0xbb3c43
or dword [0xc58d84], 1
mov dword [0xc52d24], 0x27323b16
mov dword [0xc52d28], 0x31676278
mov dword [0xc52d2c], 0x3a726a62
mov dword [0xc52d30], 0x4f6b3a67
mov word [0xc52d34], 0x4248
xor eax, eax
mov cl, byte [eax + 0xc52d24]
xor cl, 0x42
mov byte [eax + 0xc533d0], cl
inc eax
cmp eax, 0x12
jb 0xbb3c45
mov eax, 0xc533d0
ret

Function at 0xbb3c60
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d80], 1
jne 0xbb3ce8
or dword [0xc58d80], 1
mov dword [0xc52d38], 0x23362706
mov dword [0xc52d3c], 0x78312e2b
mov dword [0xc52d40], 0x2b301662
mov dword [0xc52d44], 0x36622627
mov dword [0xc52d48], 0x2730622d
mov dword [0xc52d4c], 0x24622623
mov dword [0xc52d50], 0x622f2d30
mov dword [0xc52d54], 0x2d2f272f
mov dword [0xc52d58], 0x23623b30
mov dword [0xc52d5c], 0x27302626
mov dword [0xc52d60], 0x67623131
mov dword [0xc52d64], 0x42484f32
xor eax, eax
mov cl, byte [eax + 0xc52d38]
xor cl, 0x42
mov byte [eax + 0xc533e4], cl
inc eax
cmp eax, 0x30
jb 0xbb3cea
mov eax, 0xc533e4
ret
Function at 0xbb3d05
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d7c], 1
jne 0xbb3d97
or dword [0xc58d7c], 1
mov dword [0xc52d68], 0x23362706
mov dword [0xc52d6c], 0x78312e2b
mov dword [0xc52d70], 0x2b301662
mov dword [0xc52d74], 0x36622627
mov dword [0xc52d78], 0x3035622d
mov dword [0xc52d7c], 0x6227362b
mov dword [0xc52d80], 0x2f622d36
mov dword [0xc52d84], 0x302d2f27
mov dword [0xc52d88], 0x2623623b
mov dword [0xc52d8c], 0x31273026
mov dword [0xc52d90], 0x32676231
mov word [0xc52d94], 0x484f
mov byte [0xc52d96], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52d68]
xor cl, 0x42
mov byte [eax + 0xc53414], cl
inc eax
cmp eax, 0x2f
jb 0xbb3d99
mov eax, 0xc53414
ret

Function at 0xbb3db4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d78], 1
jne 0xbb3e47
or dword [0xc58d78], 1
mov dword [0xc52d98], 0x23362706
mov dword [0xc52d9c], 0x78312e2b
mov dword [0xc52da0], 0x2b301662
mov dword [0xc52da4], 0x36622627
mov dword [0xc52da8], 0x3a27622d
mov dword [0xc52dac], 0x36372127
mov dword [0xc52db0], 0x272f6227
mov dword [0xc52db4], 0x3b302d2f
mov dword [0xc52db8], 0x62362362
mov dword [0xc52dbc], 0x30262623
mov dword [0xc52dc0], 0x62313127
mov dword [0xc52dc4], 0x484f3267
mov byte [0xc52dc8], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52d98]
xor cl, 0x42
mov byte [eax + 0xc53444], cl
inc eax
cmp eax, 0x31
jb 0xbb3e49
mov eax, 0xc53444
ret

Function at 0xbb3e64
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d74], 1
jne 0xbb3e9b
or dword [0xc58d74], 1
mov dword [0xc52dcc], 0x25232e04
mov dword [0xc52dd0], 0x72627831
mov dword [0xc52dd4], 0x4f3a673a
mov word [0xc52dd8], 0x4248
xor eax, eax
mov cl, byte [eax + 0xc52dcc]
xor cl, 0x42
mov byte [eax + 0xc53478], cl
inc eax
cmp eax, 0xe
jb 0xbb3e9d
mov eax, 0xc53478
ret

Function at 0xbb3eb8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d70], 1
jne 0xbb3eef
or dword [0xc58d70], 1
mov dword [0xc52ddc], 0x23302312
mov dword [0xc52de0], 0x2736272f
mov dword [0xc52de4], 0x4f783130
mov word [0xc52de8], 0x4248
xor eax, eax
mov cl, byte [eax + 0xc52ddc]
xor cl, 0x42
mov byte [eax + 0xc53488], cl
inc eax
cmp eax, 0xe
jb 0xbb3ef1
mov eax, 0xc53488
ret

Function at 0xbb3f0c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d6c], 1
jne 0xbb3f55
or dword [0xc58d6c], 1
mov dword [0xc52dec], 0x3023124b
mov dword [0xc52df0], 0x36272f23
mov dword [0xc52df4], 0x67193027
mov dword [0xc52df8], 0x62781f26
mov dword [0xc52dfc], 0x484f3267
mov byte [0xc52e00], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52dec]
xor cl, 0x42
mov byte [eax + 0xc53498], cl
inc eax
cmp eax, 0x15
jb 0xbb3f57
mov eax, 0xc53498
ret

Function at 0xbb3f72
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d68], 1
jne 0xbb3faa
or dword [0xc58d68], 1
mov dword [0xc52e04], 0x620a0711
mov dword [0xc52e08], 0x2e232c03
mov dword [0xc52e0c], 0x312b313b
mov dword [0xc52e10], 0x42484f78
xor eax, eax
mov cl, byte [eax + 0xc52e04]
xor cl, 0x42
mov byte [eax + 0xc534b0], cl
inc eax
cmp eax, 0x10
jb 0xbb3fac
mov eax, 0xc534b0
ret
Function at 0xbb3fc7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d64], 1
jne 0xbb400f
or dword [0xc58d64], 1
mov dword [0xc52e14], 0x28200d4b
mov dword [0xc52e18], 0x62362127
mov dword [0xc52e1c], 0x27323b36
mov dword [0xc52e20], 0x31676278
mov word [0xc52e24], 0x484f
mov byte [0xc52e26], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52e14]
xor cl, 0x42
mov byte [eax + 0xc534c0], cl
inc eax
cmp eax, 0x13
jb 0xbb4011
mov eax, 0xc534c0
ret

Function at 0xbb402c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d60], 1
jne 0xbb4095
or dword [0xc58d60], 1
mov dword [0xc52e28], 0x2b23044b
mov dword [0xc52e2c], 0x6226272e
mov dword [0xc52e30], 0x24622d36
mov dword [0xc52e34], 0x2d2e2e2d
mov dword [0xc52e38], 0x2d326235
mov dword [0xc52e3c], 0x27362c2b
mov dword [0xc52e40], 0x2a216230
mov dword [0xc52e44], 0x4f2c2b23
mov word [0xc52e48], 0x4248
xor eax, eax
mov cl, byte [eax + 0xc52e28]
xor cl, 0x42
mov byte [eax + 0xc534d4], cl
inc eax
cmp eax, 0x22
jb 0xbb4097
mov eax, 0xc534d4
ret

Function at 0xbb40b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d5c], 1
jne 0xbb40d5
or dword [0xc58d5c], 1
mov dword [0xc52e4c], 0x26363102
mov word [0xc52e50], 0x4202
xor eax, eax
mov cl, byte [eax + 0xc52e4c]
xor cl, 0x42
mov byte [eax + 0xc534f8], cl
inc eax
cmp eax, 6
jb 0xbb40d7
mov eax, 0xc534f8
ret

Function at 0xbb40f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d58], 1
jne 0xbb4129
or dword [0xc58d58], 1
mov dword [0xc52e54], 0x362c3730
mov dword [0xc52e58], 0x1d272f2b
mov dword [0xc52e5c], 0x2d303027
mov word [0xc52e60], 0x4230
xor eax, eax
mov cl, byte [eax + 0xc52e54]
xor cl, 0x42
mov byte [eax + 0xc53500], cl
inc eax
cmp eax, 0xe
jb 0xbb412b
mov eax, 0xc53500
ret

Function at 0xbb4146
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d54], 1
jne 0xbb4174
or dword [0xc58d54], 1
mov dword [0xc52e64], 0x252c2330
mov dword [0xc52e68], 0x30271d27
mov dword [0xc52e6c], 0x42302d30
xor eax, eax
mov cl, byte [eax + 0xc52e64]
xor cl, 0x42
mov byte [eax + 0xc53510], cl
inc eax
cmp eax, 0xc
jb 0xbb4176
mov eax, 0xc53510
ret

Function at 0xbb4191
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d50], 1
jne 0xbb41cf
or dword [0xc58d50], 1
mov dword [0xc52e70], 0x3027342d
mov dword [0xc52e74], 0x352d2e24
mov dword [0xc52e78], 0x3030271d
mov word [0xc52e7c], 0x302d
mov byte [0xc52e7e], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52e70]
xor cl, 0x42
mov byte [eax + 0xc5351c], cl
inc eax
cmp eax, 0xf
jb 0xbb41d1
mov eax, 0xc5351c
ret

Function at 0xbb41ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d4c], 1
jne 0xbb4224
or dword [0xc58d4c], 1
mov dword [0xc52e80], 0x27262c37
mov dword [0xc52e84], 0x2d2e2430
mov dword [0xc52e88], 0x30271d35
mov dword [0xc52e8c], 0x42302d30
xor eax, eax
mov cl, byte [eax + 0xc52e80]
xor cl, 0x42
mov byte [eax + 0xc5352c], cl
inc eax
cmp eax, 0x10
jb 0xbb4226
mov eax, 0xc5352c
ret
Function at 0xbb4241
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d48], 1
jne 0xbb426f
or dword [0xc58d48], 1
mov dword [0xc52e90], 0x2b252d2e
mov dword [0xc52e94], 0x30271d21
mov dword [0xc52e98], 0x42302d30
xor eax, eax
mov cl, byte [eax + 0xc52e90]
xor cl, 0x42
mov byte [eax + 0xc5353c], cl
inc eax
cmp eax, 0xc
jb 0xbb4271
mov eax, 0xc5353c
ret

Function at 0xbb428c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d44], 1
jne 0xbb42c1
or dword [0xc58d44], 1
mov dword [0xc52e9c], 0x232f2d26
mov dword [0xc52ea0], 0x271d2c2b
mov dword [0xc52ea4], 0x302d3030
mov byte [0xc52ea8], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52e9c]
xor cl, 0x42
mov byte [eax + 0xc53548], cl
inc eax
cmp eax, 0xd
jb 0xbb42c3
mov eax, 0xc53548
ret

Function at 0xbb42de
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d40], 1
jne 0xbb431d
or dword [0xc58d40], 1
mov dword [0xc52eac], 0x23342c2b
mov dword [0xc52eb0], 0x1d262b2e
mov dword [0xc52eb4], 0x37253023
mov dword [0xc52eb8], 0x362c272f
mov byte [0xc52ebc], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52eac]
xor cl, 0x42
mov byte [eax + 0xc53558], cl
inc eax
cmp eax, 0x11
jb 0xbb431f
mov eax, 0xc53558
ret

Function at 0xbb433a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d3c], 1
jne 0xbb436f
or dword [0xc58d3c], 1
mov dword [0xc52ec0], 0x252c272e
mov dword [0xc52ec4], 0x271d2a36
mov dword [0xc52ec8], 0x302d3030
mov byte [0xc52ecc], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52ec0]
xor cl, 0x42
mov byte [eax + 0xc5356c], cl
inc eax
cmp eax, 0xd
jb 0xbb4371
mov eax, 0xc5356c
ret

Function at 0xbb438c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d38], 1
jne 0xbb43c1
or dword [0xc58d38], 1
mov dword [0xc52ed0], 0x1d36372d
mov dword [0xc52ed4], 0x301d242d
mov dword [0xc52ed8], 0x27252c23
mov byte [0xc52edc], 0x42
xor eax, eax
mov cl, byte [eax + 0xc52ed0]
xor cl, 0x42
mov byte [eax + 0xc5357c], cl
inc eax
cmp eax, 0xd
jb 0xbb43c3
mov eax, 0xc5357c
ret

Function at 0xbb43de
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d34], 1
jne 0xbb440b
or dword [0xc58d34], 1
mov dword [0xc52ee0], 0x27213a27
mov dword [0xc52ee4], 0x2d2b3632
mov word [0xc52ee8], 0x422c
xor eax, eax
mov cl, byte [eax + 0xc52ee0]
xor cl, 0x42
mov byte [eax + 0xc5358c], cl
inc eax
cmp eax, 0xa
jb 0xbb440d
mov eax, 0xc5358c
ret

Function at 0xbb4428
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc58d30], 1
jne 0xbb4487
or dword [0xc58d30], 1
mov dword [0xc52eec], 0x2636314b
mov dword [0xc52ef0], 0x3a277878
mov dword [0xc52ef4], 0x36322721
mov dword [0xc52ef8], 0x782c2d2b
mov dword [0xc52efc], 0x232a3578
mov dword [0xc52f00], 0x786b6a36
mov dword [0xc52f04], 0x4f316762
mov word [0xc52f08], 0x4248
xor eax, eax
mov cl, byte [eax + 0xc52eec]
xor cl, 0x42
mov byte [eax + 0xc53598], cl
inc eax
cmp eax, 0x1e
jb 0xbb4489
mov eax, 0xc53598
ret