joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24155c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c65c0], 1
jne 0x2415c2
or dword [0x2c65c0], 1
mov dword [0x2c490c], 0x161d090e
mov dword [0x2c4910], 0x12210c1f
mov dword [0x2c4914], 0xa161917
mov dword [0x2c4918], 0xc1b0d0b
mov dword [0x2c491c], 0x1f0a1f1a
mov dword [0x2c4920], 0x21110a21
mov dword [0x2c4924], 0x170c0a0d
mov word [0x2c4928], 0x1910
mov byte [0x2c492a], 0x7e
xor eax, eax
mov cl, byte [eax + 0x2c490c]
xor cl, 0x7e
mov byte [eax + 0x2c4a40], cl
inc eax
cmp eax, 0x1f
jb 0x2415c4
mov eax, 0x2c4a40
ret

Function at 0x2415df
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c65bc], 1
jne 0x241646
or dword [0x2c65bc], 1
mov dword [0x2c492c], 0x16191712
mov dword [0x2c4930], 0x1b0d0b0a
mov dword [0x2c4934], 0xa1f1a0c
mov dword [0x2c4938], 0x1b0d211f
mov dword [0x2c493c], 0x1f08210a
mov dword [0x2c4940], 0x101f170c
mov dword [0x2c4944], 0xa0d210a
mov dword [0x2c4948], 0x1910170c
mov byte [0x2c494c], 0x7e
xor eax, eax
mov cl, byte [eax + 0x2c492c]
xor cl, 0x7e
mov byte [eax + 0x2c4a60], cl
inc eax
cmp eax, 0x21
jb 0x241648
mov eax, 0x2c4a60
ret

Function at 0x24194c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2921c4
call fcn.00290f48
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x2990a8]
test byte [0x2c659c], 1
mov edi, eax
jne 0x241999
or dword [0x2c659c], 1
mov dword [0x2c4b00], 0xe9eee9f7
mov dword [0x2c4b04], 0xaef4e5ee
mov dword [0x2c4b08], 0x80ecece4
xor ecx, ecx
mov al, byte [ecx + 0x2c4b00]
xor al, 0x80
mov byte [ecx + 0x2c4db4], al
inc ecx
cmp ecx, 0xc
jb 0x24199b
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x2c4db4
call dword [0x2990d4]
push eax
push 0x1b00
call dword [0x29912c]
test eax, eax
jne 0x2419e7
call fcn.00241a5d
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0022d1ce
pop ecx
pop ecx
jmp 0x241a4c
test byte [0x2c6594], 1
jne 0x241a07
or dword [0x2c6594], 1
mov word [0x2c4b28], 0xa0ba
mov byte [0x2c4b2a], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4b28]
xor cl, 0x80
mov byte [eax + 0x2c4ddc], cl
inc eax
cmp eax, 3
jb 0x241a09
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x2c4ddc
push eax
call fcn.0022d1ce
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0022d581
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00224c23
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x241a5d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6598], 1
jne 0x241ab2
or dword [0x2c6598], 1
mov dword [0x2c4b0c], 0xe1c6a8a0
mov dword [0x2c4b10], 0xe4e5ece9
mov dword [0x2c4b14], 0xa0eff4a0
mov dword [0x2c4b18], 0xedf2efe6
mov dword [0x2c4b1c], 0xe5a0f4e1
mov dword [0x2c4b20], 0xf2eff2f2
mov word [0x2c4b24], 0x80a9
xor eax, eax
mov cl, byte [eax + 0x2c4b0c]
xor cl, 0x80
mov byte [eax + 0x2c4dc0], cl
inc eax
cmp eax, 0x1a
jb 0x241ab4
mov eax, 0x2c4dc0
ret
Function at 0x241bd8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6590], 1
jne 0x241c21
or dword [0x2c6590], 1
mov dword [0x2c4b2c], 0xc8eee9d7
mov dword [0x2c4b30], 0xcff0f4f4
mov dword [0x2c4b34], 0xa8eee5f0
mov dword [0x2c4b38], 0xe1e6a0a9
mov dword [0x2c4b3c], 0xe4e5ece9
mov byte [0x2c4b40], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4b2c]
xor cl, 0x80
mov byte [eax + 0x2c4de0], cl
inc eax
cmp eax, 0x15
jb 0x241c23
mov eax, 0x2c4de0
ret

Function at 0x241e5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c658c], 1
jne 0x241eb1
or dword [0x2c658c], 1
mov dword [0x2c4b44], 0xc8eee9d7
mov dword [0x2c4b48], 0xc3f0f4f4
mov dword [0x2c4b4c], 0xebe3e1f2
mov dword [0x2c4b50], 0xa8ecf2d5
mov dword [0x2c4b54], 0xe1e6a0a9
mov dword [0x2c4b58], 0xe4e5ece9
mov byte [0x2c4b5c], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4b44]
xor cl, 0x80
mov byte [eax + 0x2c4df8], cl
inc eax
cmp eax, 0x19
jb 0x241eb3
mov eax, 0x2c4df8
ret

Function at 0x241ece
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6588], 1
jne 0x241f1a
or dword [0x2c6588], 1
mov dword [0x2c4b60], 0xc8eee9d7
mov dword [0x2c4b64], 0xc3f0f4f4
mov dword [0x2c4b68], 0xe5eeeeef
mov dword [0x2c4b6c], 0xa9a8f4e3
mov dword [0x2c4b70], 0xe9e1e6a0
mov dword [0x2c4b74], 0x80e4e5ec
xor eax, eax
mov cl, byte [eax + 0x2c4b60]
xor cl, 0x80
mov byte [eax + 0x2c4e14], cl
inc eax
cmp eax, 0x18
jb 0x241f1c
mov eax, 0x2c4e14
ret
Function at 0x24254a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6584], 1
jne 0x242623
or dword [0x2c6584], 1
mov dword [0x2c4b78], 0xf5f1e5d2
mov dword [0x2c4b7c], 0xa0f4f3e5
mov dword [0x2c4b80], 0xa0ecf2f5
mov dword [0x2c4b84], 0xe4e5f3f5
mov dword [0x2c4b88], 0xe4a0e1a0
mov dword [0x2c4b8c], 0xe5e6e6e9
mov dword [0x2c4b90], 0xf4eee5f2
mov dword [0x2c4b94], 0xe8e3f3a0
mov dword [0x2c4b98], 0xa0e5ede5
mov dword [0x2c4b9c], 0xeee1e8f4
mov dword [0x2c4ba0], 0xe5e8f4a0
mov dword [0x2c4ba4], 0xeeefe3a0
mov dword [0x2c4ba8], 0xf4e3e5ee
mov dword [0x2c4bac], 0xa0eeefe9
mov dword [0x2c4bb0], 0xa0f3e1f7
mov dword [0x2c4bb4], 0xf4e9eee9
mov dword [0x2c4bb8], 0xe9ece1e9
mov dword [0x2c4bbc], 0xa0e4e5fa
mov dword [0x2c4bc0], 0xe8f4e9f7
mov byte [0x2c4bc4], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4b78]
xor cl, 0x80
mov byte [eax + 0x2c4e30], cl
inc eax
cmp eax, 0x4d
jb 0x242625
mov eax, 0x2c4e30
ret

Function at 0x242640
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6580], 1
jne 0x24271c
or dword [0x2c6580], 1
mov dword [0x2c4bc8], 0xf5f1e5d2
mov dword [0x2c4bcc], 0xa0f4f3e5
mov dword [0x2c4bd0], 0xa0ecf2f5
mov dword [0x2c4bd4], 0xe4e5f3f5
mov dword [0x2c4bd8], 0xe4a0e1a0
mov dword [0x2c4bdc], 0xe5e6e6e9
mov dword [0x2c4be0], 0xf4eee5f2
mov dword [0x2c4be4], 0xf3efe8a0
mov dword [0x2c4be8], 0xe1eea0f4
mov dword [0x2c4bec], 0xf4a0e5ed
mov dword [0x2c4bf0], 0xa0eee1e8
mov dword [0x2c4bf4], 0xa0e5e8f4
mov dword [0x2c4bf8], 0xeeeeefe3
mov dword [0x2c4bfc], 0xe9f4e3e5
mov dword [0x2c4c00], 0xf7a0eeef
mov dword [0x2c4c04], 0xe9a0f3e1
mov dword [0x2c4c08], 0xe9f4e9ee
mov dword [0x2c4c0c], 0xfae9ece1
mov dword [0x2c4c10], 0xf7a0e4e5
mov dword [0x2c4c14], 0x80e8f4e9
xor eax, eax
mov cl, byte [eax + 0x2c4bc8]
xor cl, 0x80
mov byte [eax + 0x2c4e80], cl
inc eax
cmp eax, 0x50
jb 0x24271e
mov eax, 0x2c4e80
ret

Function at 0x242739
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c657c], 1
jne 0x242811
or dword [0x2c657c], 1
mov dword [0x2c4c18], 0xf5f1e5d2
mov dword [0x2c4c1c], 0xa0f4f3e5
mov dword [0x2c4c20], 0xa0ecf2f5
mov dword [0x2c4c24], 0xe4e5f3f5
mov dword [0x2c4c28], 0xe4a0e1a0
mov dword [0x2c4c2c], 0xe5e6e6e9
mov dword [0x2c4c30], 0xf4eee5f2
mov dword [0x2c4c34], 0xf2eff0a0
mov dword [0x2c4c38], 0xe8f4a0f4
mov dword [0x2c4c3c], 0xf4a0eee1
mov dword [0x2c4c40], 0xe3a0e5e8
mov dword [0x2c4c44], 0xe5eeeeef
mov dword [0x2c4c48], 0xefe9f4e3
mov dword [0x2c4c4c], 0xe1f7a0ee
mov dword [0x2c4c50], 0xeee9a0f3
mov dword [0x2c4c54], 0xe1e9f4e9
mov dword [0x2c4c58], 0xe5fae9ec
mov dword [0x2c4c5c], 0xe9f7a0e4
mov word [0x2c4c60], 0xe8f4
mov byte [0x2c4c62], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4c18]
xor cl, 0x80
mov byte [eax + 0x2c4ed0], cl
inc eax
cmp eax, 0x4b
jb 0x242813
mov eax, 0x2c4ed0
ret
Function at 0x24282e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6578], 1
jne 0x242884
or dword [0x2c6578], 1
mov dword [0x2c4c64], 0xc8eee9d7
mov dword [0x2c4c68], 0xcff0f4f4
mov dword [0x2c4c6c], 0xd2eee5f0
mov dword [0x2c4c70], 0xe5f5f1e5
mov dword [0x2c4c74], 0xa9a8f4f3
mov dword [0x2c4c78], 0xe9e1e6a0
mov dword [0x2c4c7c], 0x80e4e5ec
xor eax, eax
mov cl, byte [eax + 0x2c4c64]
xor cl, 0x80
mov byte [eax + 0x2c4f1c], cl
inc eax
cmp eax, 0x1c
jb 0x242886
mov eax, 0x2c4f1c
ret

Function at 0x2428a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6574], 1
jne 0x242970
or dword [0x2c6574], 1
mov dword [0x2c4c80], 0xc8eee9d7
mov dword [0x2c4c84], 0xd3f0f4f4
mov dword [0x2c4c88], 0xf0cff4e5
mov dword [0x2c4c8c], 0xeeefe9f4
mov dword [0x2c4c90], 0xcec9d7a8
mov dword [0x2c4c94], 0xd0d4d4c8
mov dword [0x2c4c98], 0xd4d0cfdf
mov dword [0x2c4c9c], 0xdfcecfc9
mov dword [0x2c4ca0], 0xd5c3c5d3
mov dword [0x2c4ca4], 0xd9d4c9d2
mov dword [0x2c4ca8], 0xc1ccc6df
mov dword [0x2c4cac], 0xa0a9d3c7
mov dword [0x2c4cb0], 0xf2a0eeef
mov dword [0x2c4cb4], 0xe5f5f1e5
mov dword [0x2c4cb8], 0xe8a0f4f3
mov dword [0x2c4cbc], 0xece4eee1
mov dword [0x2c4cc0], 0xe1e6a0e5
mov dword [0x2c4cc4], 0xe4e5ece9
mov byte [0x2c4cc8], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4c80]
xor cl, 0x80
mov byte [eax + 0x2c4f38], cl
inc eax
cmp eax, 0x49
jb 0x242972
mov eax, 0x2c4f38
ret

Function at 0x24298d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6570], 1
jne 0x242a5b
or dword [0x2c6570], 1
mov dword [0x2c4cd0], 0xc8eee9d7
mov dword [0x2c4cd4], 0xd3f0f4f4
mov dword [0x2c4cd8], 0xf0cff4e5
mov dword [0x2c4cdc], 0xeeefe9f4
mov dword [0x2c4ce0], 0xcec9d7a8
mov dword [0x2c4ce4], 0xd0d4d4c8
mov dword [0x2c4ce8], 0xd4d0cfdf
mov dword [0x2c4cec], 0xdfcecfc9
mov dword [0x2c4cf0], 0xc4cec5d3
mov dword [0x2c4cf4], 0xcdc9d4df
mov dword [0x2c4cf8], 0xd4d5cfc5
mov dword [0x2c4cfc], 0xeeefa0a9
mov dword [0x2c4d00], 0xf1e5f2a0
mov dword [0x2c4d04], 0xf4f3e5f5
mov dword [0x2c4d08], 0xeee1e8a0
mov dword [0x2c4d0c], 0xa0e5ece4
mov dword [0x2c4d10], 0xece9e1e6
mov word [0x2c4d14], 0xe4e5
mov byte [0x2c4d16], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4cd0]
xor cl, 0x80
mov byte [eax + 0x2c4f88], cl
inc eax
cmp eax, 0x47
jb 0x242a5d
mov eax, 0x2c4f88
ret

Function at 0x242a78
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c656c], 1
jne 0x242ae1
or dword [0x2c656c], 1
mov dword [0x2c4d18], 0xc8eee9d7
mov dword [0x2c4d1c], 0xc1f0f4f4
mov dword [0x2c4d20], 0xe5d2e4e4
mov dword [0x2c4d24], 0xf3e5f5f1
mov dword [0x2c4d28], 0xe1e5c8f4
mov dword [0x2c4d2c], 0xf3f2e5e4
mov dword [0x2c4d30], 0xe6a0a9a8
mov dword [0x2c4d34], 0xe5ece9e1
mov word [0x2c4d38], 0x80e4
xor eax, eax
mov cl, byte [eax + 0x2c4d18]
xor cl, 0x80
mov byte [eax + 0x2c4fd0], cl
inc eax
cmp eax, 0x22
jb 0x242ae3
mov eax, 0x2c4fd0
ret
Function at 0x242afe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6568], 1
jne 0x242b51
or dword [0x2c6568], 1
mov dword [0x2c4d3c], 0xf0f4f4c8
mov dword [0x2c4d40], 0xe4eee5d3
mov dword [0x2c4d44], 0xf5f1e5d2
mov dword [0x2c4d48], 0xa8f4f3e5
mov dword [0x2c4d4c], 0xe1e6a0a9
mov dword [0x2c4d50], 0xe4e5ece9
mov byte [0x2c4d54], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4d3c]
xor cl, 0x80
mov byte [eax + 0x2c4ff4], cl
inc eax
cmp eax, 0x19
jb 0x242b53
mov eax, 0x2c4ff4
ret

Function at 0x242b6e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6564], 1
jne 0x242bc0
or dword [0x2c6564], 1
mov dword [0x2c4d58], 0xf0f4f4c8
mov dword [0x2c4d5c], 0xf2e5f5d1
mov dword [0x2c4d60], 0xe6eec9f9
mov dword [0x2c4d64], 0xa0a9a8ef
mov dword [0x2c4d68], 0xece9e1e6
mov word [0x2c4d6c], 0xe4e5
mov byte [0x2c4d6e], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4d58]
xor cl, 0x80
mov byte [eax + 0x2c5010], cl
inc eax
cmp eax, 0x17
jb 0x242bc2
mov eax, 0x2c5010
ret
Function at 0x2432fd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c655c], 1
jne 0x24336d
or dword [0x2c655c], 1
mov dword [0x2c4d74], 0xc8eee9d7
mov dword [0x2c4d78], 0xd1f0f4f4
mov dword [0x2c4d7c], 0xf9f2e5f5
mov dword [0x2c4d80], 0xe1f4e1c4
mov dword [0x2c4d84], 0xe9e1f6c1
mov dword [0x2c4d88], 0xece2e1ec
mov dword [0x2c4d8c], 0xa0a9a8e5
mov dword [0x2c4d90], 0xece9e1e6
mov word [0x2c4d94], 0xe4e5
mov byte [0x2c4d96], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c4d74]
xor cl, 0x80
mov byte [eax + 0x2c502c], cl
inc eax
cmp eax, 0x23
jb 0x24336f
mov eax, 0x2c502c
ret

Function at 0x24338a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6558], 1
jne 0x2433df
or dword [0x2c6558], 1
mov dword [0x2c4d98], 0xe5f4eec9
mov dword [0x2c4d9c], 0xf4e5eef2
mov dword [0x2c4da0], 0xe4e1e5d2
mov dword [0x2c4da4], 0xe5ece9c6
mov dword [0x2c4da8], 0xe6a0a9a8
mov dword [0x2c4dac], 0xe5ece9e1
mov word [0x2c4db0], 0x80e4
xor eax, eax
mov cl, byte [eax + 0x2c4d98]
xor cl, 0x80
mov byte [eax + 0x2c5050], cl
inc eax
cmp eax, 0x1a
jb 0x2433e1
mov eax, 0x2c5050
ret

Function at 0x2441df
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c653c], 1
jne 0x244266
or dword [0x2c653c], 1
mov dword [0x2c5088], 0xf5a0eec1
mov dword [0x2c508c], 0xe3e5f2ee
mov dword [0x2c5090], 0xe9eee7ef
mov dword [0x2c5094], 0xa0e4e5fa
mov dword [0x2c5098], 0xe5ebeff4
mov dword [0x2c509c], 0xe1f7a0ee
mov dword [0x2c50a0], 0xefe6a0f3
mov dword [0x2c50a4], 0xa0e4eef5
mov dword [0x2c50a8], 0xe3a0f4e1
mov dword [0x2c50ac], 0xe1f2e1e8
mov dword [0x2c50b0], 0xf2e5f4e3
mov word [0x2c50b4], 0x80a0
xor eax, eax
mov cl, byte [eax + 0x2c5088]
xor cl, 0x80
mov byte [eax + 0x2c51d8], cl
inc eax
cmp eax, 0x2e
jb 0x244268
mov eax, 0x2c51d8
ret
Function at 0x2446ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6538], 1
jne 0x244708
or dword [0x2c6538], 1
mov dword [0x2c50b8], 0xf3f3e9cd
mov dword [0x2c50bc], 0xa0e7eee9
mov dword [0x2c50c0], 0xe5eca0e1
mov dword [0x2c50c4], 0xf0a0f4e6
mov dword [0x2c50c8], 0xeee5f2e1
mov dword [0x2c50cc], 0xf3e5e8f4
mov word [0x2c50d0], 0xf3e9
mov byte [0x2c50d2], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c50b8]
xor cl, 0x80
mov byte [eax + 0x2c5208], cl
inc eax
cmp eax, 0x1b
jb 0x24470a
mov eax, 0x2c5208
ret

Function at 0x244725
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6534], 1
jne 0x24478e
or dword [0x2c6534], 1
mov dword [0x2c50d4], 0xa0f4efce
mov dword [0x2c50d8], 0xf5efeee5
mov dword [0x2c50dc], 0xefa0e8e7
mov dword [0x2c50e0], 0xe1f2e5f0
mov dword [0x2c50e4], 0xa0f3e4ee
mov dword [0x2c50e8], 0xe5a0eee9
mov dword [0x2c50ec], 0xe5f2f0f8
mov dword [0x2c50f0], 0xefe9f3f3
mov word [0x2c50f4], 0x80ee
xor eax, eax
mov cl, byte [eax + 0x2c50d4]
xor cl, 0x80
mov byte [eax + 0x2c5224], cl
inc eax
cmp eax, 0x22
jb 0x244790
mov eax, 0x2c5224
ret

Function at 0x2447ab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6530], 1
jne 0x24480b
or dword [0x2c6530], 1
mov dword [0x2c50f8], 0xa0efefd4
mov dword [0x2c50fc], 0xf9eee1ed
mov dword [0x2c5100], 0xe5f0efa0
mov dword [0x2c5104], 0xe4eee1f2
mov dword [0x2c5108], 0xeee9a0f3
mov dword [0x2c510c], 0xf0f8e5a0
mov dword [0x2c5110], 0xf3f3e5f2
mov dword [0x2c5114], 0x80eeefe9
xor eax, eax
mov cl, byte [eax + 0x2c50f8]
xor cl, 0x80
mov byte [eax + 0x2c5248], cl
inc eax
cmp eax, 0x20
jb 0x24480d
mov eax, 0x2c5248
ret

Function at 0x244828
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c652c], 1
jne 0x24487e
or dword [0x2c652c], 1
mov dword [0x2c5118], 0xf3f3e9cd
mov dword [0x2c511c], 0xa0e7eee9
mov dword [0x2c5120], 0xe9f2a0e1
mov dword [0x2c5124], 0xa0f4e8e7
mov dword [0x2c5128], 0xe5f2e1f0
mov dword [0x2c512c], 0xe5e8f4ee
mov dword [0x2c5130], 0x80f3e9f3
xor eax, eax
mov cl, byte [eax + 0x2c5118]
xor cl, 0x80
mov byte [eax + 0x2c5268], cl
inc eax
cmp eax, 0x1c
jb 0x244880
mov eax, 0x2c5268
ret

Function at 0x24489b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6528], 1
jne 0x24490c
or dword [0x2c6528], 1
mov dword [0x2c5134], 0xf2e1eed5
mov dword [0x2c5138], 0xf0efa0f9
mov dword [0x2c513c], 0xf4e1f2e5
mov dword [0x2c5140], 0xeda0f2ef
mov dword [0x2c5144], 0xa0f4f3f5
mov dword [0x2c5148], 0xe5f6e1e8
mov dword [0x2c514c], 0xe5eeefa0
mov dword [0x2c5150], 0xe5f0efa0
mov dword [0x2c5154], 0xe4eee1f2
mov byte [0x2c5158], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c5134]
xor cl, 0x80
mov byte [eax + 0x2c5284], cl
inc eax
cmp eax, 0x25
jb 0x24490e
mov eax, 0x2c5284
ret
Function at 0x244929
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6524], 1
jne 0x2449a3
or dword [0x2c6524], 1
mov dword [0x2c515c], 0xe1eee9c2
mov dword [0x2c5160], 0xefa0f9f2
mov dword [0x2c5164], 0xe1f2e5f0
mov dword [0x2c5168], 0xa0f2eff4
mov dword [0x2c516c], 0xf4f3f5ed
mov dword [0x2c5170], 0xf6e1e8a0
mov dword [0x2c5174], 0xf7f4a0e5
mov dword [0x2c5178], 0xf0efa0ef
mov dword [0x2c517c], 0xeee1f2e5
mov word [0x2c5180], 0xf3e4
mov byte [0x2c5182], 0x80
xor eax, eax
mov cl, byte [eax + 0x2c515c]
xor cl, 0x80
mov byte [eax + 0x2c52ac], cl
inc eax
cmp eax, 0x27
jb 0x2449a5
mov eax, 0x2c52ac
ret

Function at 0x2449c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6520], 1
jne 0x244a29
or dword [0x2c6520], 1
mov dword [0x2c5184], 0xe1eee9c2
mov dword [0x2c5188], 0xefa0f9f2
mov dword [0x2c518c], 0xe1f2e5f0
mov dword [0x2c5190], 0xa0f2eff4
mov dword [0x2c5194], 0xa0f4efee
mov dword [0x2c5198], 0xecf0ede9
mov dword [0x2c519c], 0xeee5ede5
mov dword [0x2c51a0], 0xbae4e5f4
mov word [0x2c51a4], 0x80a0
xor eax, eax
mov cl, byte [eax + 0x2c5184]
xor cl, 0x80
mov byte [eax + 0x2c52d4], cl
inc eax
cmp eax, 0x22
jb 0x244a2b
mov eax, 0x2c52d4
ret
Function at 0x2463db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x24641d
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x2b0ee0]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x2b0ee0]
inc edx
cmp dword [ebp + 8], 0
jne 0x2463e8
pop esi
not eax
pop ebp
ret

Function at 0x248068
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x24808d
cmp dword [ecx + 0x38], ebx
je 0x24808d
cmp eax, dword [ecx + 0x10]
jae 0x24808d
cmp dword [ecx + 0x14], 1
jne 0x24808d
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x24808f
xor edi, edi
cmp edi, ebx
je 0x248172
cmp esi, ebx
je 0x248172
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00247811
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x24811e
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0026e2e0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x248143
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0026e2e0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x248174
xor eax, eax
pop edi
pop ebx
ret

Function at 0x248ba4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6514], 1
jne 0x248c29
or dword [0x2c6514], 1
mov dword [0x2c5310], 0xede8e0c7
mov dword [0x2c5314], 0xf5a1e5e4
mov dword [0x2c5318], 0xf3e2a1ee
mov dword [0x2c531c], 0xe4f5e0e4
mov dword [0x2c5320], 0xe0f4eda1
mov dword [0x2c5324], 0xe0f5f2a1
mov dword [0x2c5328], 0xa9a1e4f5
mov dword [0x2c532c], 0xeaf3eef6
mov dword [0x2c5330], 0xf5a1f3e4
mov dword [0x2c5334], 0xe0e4f3e9
mov dword [0x2c5338], 0xa1bba8e5
mov byte [0x2c533c], 0x81
xor eax, eax
mov cl, byte [eax + 0x2c5310]
xor cl, 0x81
mov byte [eax + 0x2c53d8], cl
inc eax
cmp eax, 0x2d
jb 0x248c2b
mov eax, 0x2c53d8
ret
Function at 0x248c46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6504], 1
jne 0x248cad
or dword [0x2c6504], 1
mov dword [0x2c534c], 0xe4a1eecf
mov dword [0x2c5350], 0xf3eef3f3
mov dword [0x2c5354], 0xf2e4eca1
mov dword [0x2c5358], 0xe4e6e0f2
mov dword [0x2c535c], 0xf5e4f3a1
mov dword [0x2c5360], 0xe4eff3f4
mov dword [0x2c5364], 0xf8e3a1e5
mov dword [0x2c5368], 0xe3eeeba1
mov byte [0x2c536c], 0x81
xor eax, eax
mov cl, byte [eax + 0x2c534c]
xor cl, 0x81
mov byte [eax + 0x2c5414], cl
inc eax
cmp eax, 0x21
jb 0x248caf
mov eax, 0x2c5414
ret

Function at 0x248cca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c64f8], 1
jne 0x248d33
or dword [0x2c64f8], 1
mov dword [0x2c5398], 0xa1e0f4cd
mov dword [0x2c539c], 0xeef3f3e4
mov dword [0x2c53a0], 0xf4f3a1f3
mov dword [0x2c53a4], 0xefe8efef
mov dword [0x2c53a8], 0xf3e4a1e6
mov dword [0x2c53ac], 0xa1f3eef3
mov dword [0x2c53b0], 0xe5efe0e9
mov dword [0x2c53b4], 0xbbf3e4ed
mov word [0x2c53b8], 0x81a1
xor eax, eax
mov cl, byte [eax + 0x2c5398]
xor cl, 0x81
mov byte [eax + 0x2c5460], cl
inc eax
cmp eax, 0x22
jb 0x248d35
mov eax, 0x2c5460
ret

Function at 0x248d50
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c64f4], 1
jne 0x248da2
or dword [0x2c64f4], 1
mov dword [0x2c53bc], 0xcde0f4ed
mov dword [0x2c53c0], 0xe0eeedde
mov dword [0x2c53c4], 0xf3f5f2e5
mov dword [0x2c53c8], 0xa1e6efe8
mov dword [0x2c53cc], 0xede8e0e7
mov word [0x2c53d0], 0xe5e4
mov byte [0x2c53d2], 0x81
xor eax, eax
mov cl, byte [eax + 0x2c53bc]
xor cl, 0x81
mov byte [eax + 0x2c5484], cl
inc eax
cmp eax, 0x17
jb 0x248da4
mov eax, 0x2c5484
ret