joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90d5c7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988664], 1
jne 0x90d674
or dword [0x988664], 1
mov eax, 0xbcb9
mov word [0x987a80], ax
inc eax
mov word [0x987a82], ax
mov ecx, 0xbcb4
push ebx
mov eax, ecx
mov word [0x987a84], ax
add eax, 0xfffffff4
push esi
mov word [0x987a86], ax
lea esi, [ecx - 6]
mov eax, esi
mov word [0x987a88], ax
add eax, 4
mov word [0x987a8a], ax
lea edx, [ecx - 0x10]
mov eax, edx
mov word [0x987a8c], ax
dec eax
mov ebx, eax
mov word [0x987a8e], bx
mov word [0x987a90], bx
mov ebx, ecx
mov word [0x987a92], bx
add ebx, 0xb
mov word [0x987aa0], ax
lea eax, [ecx + 0x3d]
pop esi
mov word [0x987a94], bx
mov dword [0x987a96], 0xbcaebca5
mov word [0x987a9a], dx
mov dword [0x987a9c], 0xbcb4bca2
mov word [0x987aa2], ax
pop ebx
xor eax, eax
mov ecx, 0xbcf1
xor cx, word [eax + 0x987a80]
add eax, 2
mov word [eax + 0x988246], cx
cmp eax, 0x24
jb 0x90d676
mov eax, 0x988248
ret

Function at 0x90d697
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988660], 1
mov edx, 0xbcf1
jne 0x90d709
or dword [0x988660], 1
lea eax, [edx - 0x38]
mov word [0x987aa4], ax
inc eax
mov word [0x987aa6], ax
lea ecx, [edx - 0x3d]
mov eax, ecx
mov word [0x987aa8], ax
add eax, 0xfffffff4
mov word [0x987aaa], ax
lea eax, [edx - 0x43]
mov word [0x987aac], ax
add eax, 0xfffffff6
mov word [0x987aae], ax
lea eax, [edx - 0x4f]
push esi
mov esi, eax
mov eax, edx
mov word [0x987ab0], si
mov word [0x987ab2], cx
mov dword [0x987ab4], 0xbca2bca3
mov word [0x987ab8], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x987aa4]
add eax, 2
mov word [eax + 0x98826a], cx
cmp eax, 0x16
jb 0x90d70b
mov eax, 0x98826c
ret

Function at 0x90d729
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98865c], 1
jne 0x90d7e7
or dword [0x98865c], 1
push ebx
mov eax, 0xbcb9
mov word [0x987abc], ax
inc eax
mov word [0x987abe], ax
push esi
mov esi, 0xbcb4
mov eax, esi
mov word [0x987ac0], ax
add eax, 0xfffffff4
mov word [0x987ac2], ax
lea edx, [esi - 6]
lea ecx, [esi - 2]
mov eax, edx
mov word [0x987ac4], ax
mov eax, ecx
mov word [0x987ac6], ax
add eax, 0xfffffff2
mov word [0x987ac8], ax
lea eax, [esi - 0x11]
mov ebx, eax
add eax, 0x1c
mov esi, eax
lea eax, [edx + 9]
mov word [0x987adc], ax
inc eax
mov word [0x987ade], ax
lea eax, [edx + 8]
mov word [0x987ad0], si
mov word [0x987ae0], ax
add eax, 0x3b
pop esi
mov word [0x987aca], bx
mov dword [0x987acc], 0xbcb4bca3
mov dword [0x987ad2], 0xbcaebca5
mov word [0x987ad6], cx
mov dword [0x987ad8], 0xbcbfbcbe
mov word [0x987ae2], ax
pop ebx
xor eax, eax
mov ecx, 0xbcf1
xor cx, word [eax + 0x987abc]
add eax, 2
mov word [eax + 0x988282], cx
cmp eax, 0x28
jb 0x90d7e9
mov eax, 0x988284
ret
Function at 0x90d80a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988658], 1
jne 0x90d8b9
or dword [0x988658], 1
mov eax, 0xbcb9
mov word [0x987ae4], ax
inc eax
mov word [0x987ae6], ax
mov edx, 0xbcb4
mov eax, edx
mov word [0x987ae8], ax
add eax, 0xfffffff4
mov word [0x987aea], ax
lea ecx, [edx - 6]
mov eax, ecx
mov word [0x987aec], ax
add eax, 4
mov word [0x987aee], ax
lea eax, [edx + 9]
mov word [0x987af0], ax
add eax, 0xfffffff3
mov word [0x987af2], ax
lea eax, [edx - 0x12]
push edi
mov edi, eax
add eax, 0x1c
mov ecx, eax
mov word [0x987b02], ax
lea eax, [edx - 0xf]
mov word [0x987b04], ax
add eax, 0x4c
mov word [0x987af4], di
mov word [0x987af6], di
mov dword [0x987af8], 0xbca2bcb4
mov dword [0x987afc], 0xbca3bcae
mov word [0x987b00], cx
mov word [0x987b06], ax
pop edi
xor eax, eax
mov ecx, 0xbcf1
xor cx, word [eax + 0x987ae4]
add eax, 2
mov word [eax + 0x9882aa], cx
cmp eax, 0x24
jb 0x90d8bb
mov eax, 0x9882ac
ret

Function at 0x90dc87
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988640], 1
jne 0x90dcdc
or dword [0x988640], 1
mov dword [0x987b90], 0xb29694a3
mov dword [0x987b94], 0x85909483
mov dword [0x987b98], 0x8894ba94
mov dword [0x987b9c], 0xd8d989b4
mov dword [0x987ba0], 0x989097d1
mov dword [0x987ba4], 0xcb95949d
mov word [0x987ba8], 0xf1d1
xor eax, eax
mov cl, byte [eax + 0x987b90]
xor cl, 0xf1
mov byte [eax + 0x988308], cl
inc eax
cmp eax, 0x1a
jb 0x90dcde
mov eax, 0x988308
ret

Function at 0x90ddbe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98863c], 1
jne 0x90de24
or dword [0x98863c], 1
mov dword [0x987bac], 0x9c849fb4
mov dword [0x987bb0], 0x85908394
mov dword [0x987bb4], 0xd19f9e98
mov dword [0x987bb8], 0x94959f98
mov dword [0x987bbc], 0x849ed189
mov dword [0x987bc0], 0x979ed185
mov dword [0x987bc4], 0x9f9083d1
mov word [0x987bc8], 0x9496
mov byte [0x987bca], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987bac]
xor cl, 0xf1
mov byte [eax + 0x988324], cl
inc eax
cmp eax, 0x1f
jb 0x90de26
mov eax, 0x988324
ret

Function at 0x90de41
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988638], 1
jne 0x90de8d
or dword [0x988638], 1
mov dword [0x987bcc], 0xb49694a3
mov dword [0x987bd0], 0xba9c849f
mov dword [0x987bd4], 0x89b48894
mov dword [0x987bd8], 0x97d1d8d9
mov dword [0x987bdc], 0x949d9890
mov dword [0x987be0], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987bcc]
xor cl, 0xf1
mov byte [eax + 0x988344], cl
inc eax
cmp eax, 0x18
jb 0x90de8f
mov eax, 0x988344
ret

Function at 0x90dff5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988634], 1
jne 0x90e02a
or dword [0x988634], 1
mov dword [0x987be4], 0x9d9d84bf
mov dword [0x987be8], 0x9f9e92d1
mov dword [0x987bec], 0x85899485
mov byte [0x987bf0], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987be4]
xor cl, 0xf1
mov byte [eax + 0x98835c], cl
inc eax
cmp eax, 0xd
jb 0x90e02c
mov eax, 0x98835c
ret
Function at 0x90e047
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988630], 1
jne 0x90e093
or dword [0x988630], 1
mov dword [0x987bf4], 0xbe9694a3
mov dword [0x987bf8], 0xba9f9481
mov dword [0x987bfc], 0x89b48894
mov dword [0x987c00], 0x97d1d8d9
mov dword [0x987c04], 0x949d9890
mov dword [0x987c08], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987bf4]
xor cl, 0xf1
mov byte [eax + 0x98836c], cl
inc eax
cmp eax, 0x18
jb 0x90e095
mov eax, 0x98836c
ret

Function at 0x90e0b0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98862c], 1
jne 0x90e10c
or dword [0x98862c], 1
mov dword [0x987c0c], 0xa09694a3
mov dword [0x987c10], 0x88839484
mov dword [0x987c14], 0x9e979fb8
mov dword [0x987c18], 0xd98894ba
mov dword [0x987c1c], 0x9097d1d8
mov dword [0x987c20], 0x95949d98
mov word [0x987c24], 0xd1cb
mov byte [0x987c26], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987c0c]
xor cl, 0xf1
mov byte [eax + 0x988384], cl
inc eax
cmp eax, 0x1b
jb 0x90e10e
mov eax, 0x988384
ret

Function at 0x90e1ff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988628], 1
jne 0x90e265
or dword [0x988628], 1
mov dword [0x987c28], 0x9c849fb4
mov dword [0x987c2c], 0x85908394
mov dword [0x987c30], 0xd19f9e98
mov dword [0x987c34], 0x94959f98
mov dword [0x987c38], 0x849ed189
mov dword [0x987c3c], 0x979ed185
mov dword [0x987c40], 0x9f9083d1
mov word [0x987c44], 0x9496
mov byte [0x987c46], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987c28]
xor cl, 0xf1
mov byte [eax + 0x9883a0], cl
inc eax
cmp eax, 0x1f
jb 0x90e267
mov eax, 0x9883a0
ret

Function at 0x90e282
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988624], 1
jne 0x90e2de
or dword [0x988624], 1
mov dword [0x987c48], 0xa09694a3
mov dword [0x987c4c], 0x88839484
mov dword [0x987c50], 0x9e979fb8
mov dword [0x987c54], 0xd98894ba
mov dword [0x987c58], 0x9097d1d8
mov dword [0x987c5c], 0x95949d98
mov word [0x987c60], 0xd1cb
mov byte [0x987c62], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987c48]
xor cl, 0xf1
mov byte [eax + 0x9883c0], cl
inc eax
cmp eax, 0x1b
jb 0x90e2e0
mov eax, 0x9883c0
ret

Function at 0x90e440
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988620], 1
jne 0x90e475
or dword [0x988620], 1
mov dword [0x987c64], 0x9d9d84bf
mov dword [0x987c68], 0x9f9e92d1
mov dword [0x987c6c], 0x85899485
mov byte [0x987c70], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987c64]
xor cl, 0xf1
mov byte [eax + 0x9883dc], cl
inc eax
cmp eax, 0xd
jb 0x90e477
mov eax, 0x9883dc
ret

Function at 0x90e492
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98861c], 1
jne 0x90e4de
or dword [0x98861c], 1
mov dword [0x987c74], 0xbe9694a3
mov dword [0x987c78], 0xba9f9481
mov dword [0x987c7c], 0x89b48894
mov dword [0x987c80], 0x97d1d8d9
mov dword [0x987c84], 0x949d9890
mov dword [0x987c88], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987c74]
xor cl, 0xf1
mov byte [eax + 0x9883ec], cl
inc eax
cmp eax, 0x18
jb 0x90e4e0
mov eax, 0x9883ec
ret
Function at 0x90e4fb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988618], 1
jne 0x90e557
or dword [0x988618], 1
mov dword [0x987c8c], 0xa09694a3
mov dword [0x987c90], 0x88839484
mov dword [0x987c94], 0x9e979fb8
mov dword [0x987c98], 0xd98894ba
mov dword [0x987c9c], 0x9097d1d8
mov dword [0x987ca0], 0x95949d98
mov word [0x987ca4], 0xd1cb
mov byte [0x987ca6], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987c8c]
xor cl, 0xf1
mov byte [eax + 0x988404], cl
inc eax
cmp eax, 0x1b
jb 0x90e559
mov eax, 0x988404
ret

Function at 0x90e805
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988614], 1
mov ecx, 0xbcf1
jne 0x90e873
or dword [0x988614], 1
lea eax, [ecx - 0x18]
mov word [0x987ca8], ax
add eax, 0xffffffdc
mov word [0x987caa], ax
lea eax, [ecx - 0x5d]
mov word [0x987cac], ax
add eax, 3
mov word [0x987cae], ax
lea eax, [ecx - 0x61]
mov word [0x987cb0], ax
add eax, 0xfffffff4
mov word [0x987cb2], ax
lea eax, [ecx - 0x54]
mov word [0x987cb4], ax
add eax, 0xffffffe8
mov word [0x987cb6], ax
lea eax, [ecx - 0x19]
mov word [0x987cb8], ax
mov eax, ecx
mov word [0x987cba], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x987ca8]
add eax, 2
mov word [eax + 0x98841e], dx
cmp eax, 0x14
jb 0x90e875
mov eax, 0x988420
ret

Function at 0x90e893
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988610], 1
mov ecx, 0xbcf1
jne 0x90e901
or dword [0x988610], 1
lea eax, [ecx - 0x18]
mov word [0x987cbc], ax
add eax, 0xffffffbc
mov word [0x987cbe], ax
lea eax, [ecx - 0x5d]
mov word [0x987cc0], ax
add eax, 3
mov word [0x987cc2], ax
lea eax, [ecx - 0x61]
mov word [0x987cc4], ax
add eax, 0xfffffff4
mov word [0x987cc6], ax
lea eax, [ecx - 0x54]
mov word [0x987cc8], ax
add eax, 0xffffffe8
mov word [0x987cca], ax
lea eax, [ecx - 0x19]
mov word [0x987ccc], ax
mov eax, ecx
mov word [0x987cce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x987cbc]
add eax, 2
mov word [eax + 0x988432], dx
cmp eax, 0x14
jb 0x90e903
mov eax, 0x988434
ret

Function at 0x90e921
Capabilities:
Encode data using xor

Disassembly:
test byte [0x98860c], 1
jne 0x90e96d
or dword [0x98860c], 1
mov dword [0x987cd0], 0xbe9694a3
mov dword [0x987cd4], 0xba9f9481
mov dword [0x987cd8], 0x89b48894
mov dword [0x987cdc], 0x97d1d8d9
mov dword [0x987ce0], 0x949d9890
mov dword [0x987ce4], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987cd0]
xor cl, 0xf1
mov byte [eax + 0x988448], cl
inc eax
cmp eax, 0x18
jb 0x90e96f
mov eax, 0x988448
ret

Function at 0x90e98a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988608], 1
jne 0x90e9e6
or dword [0x988608], 1
mov dword [0x987ce8], 0xa09694a3
mov dword [0x987cec], 0x88839484
mov dword [0x987cf0], 0x849d90a7
mov dword [0x987cf4], 0xd989b494
mov dword [0x987cf8], 0x9097d1d8
mov dword [0x987cfc], 0x95949d98
mov word [0x987d00], 0xd1cb
mov byte [0x987d02], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987ce8]
xor cl, 0xf1
mov byte [eax + 0x988460], cl
inc eax
cmp eax, 0x1b
jb 0x90e9e8
mov eax, 0x988460
ret
Function at 0x90ea03
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988604], 1
jne 0x90ea5f
or dword [0x988604], 1
mov dword [0x987d04], 0xa09694a3
mov dword [0x987d08], 0x88839484
mov dword [0x987d0c], 0x849d90a7
mov dword [0x987d10], 0xd989b494
mov dword [0x987d14], 0x9097d1d8
mov dword [0x987d18], 0x95949d98
mov word [0x987d1c], 0xd1cb
mov byte [0x987d1e], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987d04]
xor cl, 0xf1
mov byte [eax + 0x98847c], cl
inc eax
cmp eax, 0x1b
jb 0x90ea61
mov eax, 0x98847c
ret

Function at 0x90ebdb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988600], 1
jne 0x90ec27
or dword [0x988600], 1
mov dword [0x987d20], 0xbe9694a3
mov dword [0x987d24], 0xba9f9481
mov dword [0x987d28], 0x89b48894
mov dword [0x987d2c], 0x97d1d8d9
mov dword [0x987d30], 0x949d9890
mov dword [0x987d34], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987d20]
xor cl, 0xf1
mov byte [eax + 0x988498], cl
inc eax
cmp eax, 0x18
jb 0x90ec29
mov eax, 0x988498
ret

Function at 0x90ec44
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885fc], 1
jne 0x90ecaa
or dword [0x9885fc], 1
mov dword [0x987d38], 0xa29694a3
mov dword [0x987d3c], 0x90a78594
mov dword [0x987d40], 0xb494849d
mov dword [0x987d44], 0x8582d989
mov dword [0x987d48], 0x969f9883
mov dword [0x987d4c], 0x9097d1d8
mov dword [0x987d50], 0x95949d98
mov word [0x987d54], 0xd1cb
mov byte [0x987d56], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987d38]
xor cl, 0xf1
mov byte [eax + 0x9884b0], cl
inc eax
cmp eax, 0x1f
jb 0x90ecac
mov eax, 0x9884b0
ret

Function at 0x90ee16
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885f8], 1
jne 0x90ee62
or dword [0x9885f8], 1
mov dword [0x987d58], 0xbe9694a3
mov dword [0x987d5c], 0xba9f9481
mov dword [0x987d60], 0x89b48894
mov dword [0x987d64], 0x97d1d8d9
mov dword [0x987d68], 0x949d9890
mov dword [0x987d6c], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987d58]
xor cl, 0xf1
mov byte [eax + 0x9884d0], cl
inc eax
cmp eax, 0x18
jb 0x90ee64
mov eax, 0x9884d0
ret

Function at 0x90ee7f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885f4], 1
jne 0x90eede
or dword [0x9885f4], 1
mov dword [0x987d70], 0xa29694a3
mov dword [0x987d74], 0x90a78594
mov dword [0x987d78], 0xb494849d
mov dword [0x987d7c], 0x8695d989
mov dword [0x987d80], 0xd895839e
mov dword [0x987d84], 0x989097d1
mov dword [0x987d88], 0xcb95949d
mov word [0x987d8c], 0xf1d1
xor eax, eax
mov cl, byte [eax + 0x987d70]
xor cl, 0xf1
mov byte [eax + 0x9884e8], cl
inc eax
cmp eax, 0x1e
jb 0x90eee0
mov eax, 0x9884e8
ret

Function at 0x90f04b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885f0], 1
jne 0x90f0c5
or dword [0x9885f0], 1
mov dword [0x987d90], 0x858284bc
mov dword [0x987d94], 0x948182d1
mov dword [0x987d98], 0x88979892
mov dword [0x987d9c], 0x9fd190d1
mov dword [0x987da0], 0x94dc9f9e
mov dword [0x987da4], 0x8885819c
mov dword [0x987da8], 0x938482d1
mov dword [0x987dac], 0xd188949a
mov dword [0x987db0], 0x98838582
mov word [0x987db4], 0x969f
mov byte [0x987db6], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987d90]
xor cl, 0xf1
mov byte [eax + 0x988508], cl
inc eax
cmp eax, 0x27
jb 0x90f0c7
mov eax, 0x988508
ret
Function at 0x90f0e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885ec], 1
jne 0x90f12e
or dword [0x9885ec], 1
mov dword [0x987db8], 0xbe9694a3
mov dword [0x987dbc], 0xba9f9481
mov dword [0x987dc0], 0x89b48894
mov dword [0x987dc4], 0x97d1d8d9
mov dword [0x987dc8], 0x949d9890
mov dword [0x987dcc], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987db8]
xor cl, 0xf1
mov byte [eax + 0x988530], cl
inc eax
cmp eax, 0x18
jb 0x90f130
mov eax, 0x988530
ret

Function at 0x90f14b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885e8], 1
jne 0x90f19d
or dword [0x9885e8], 1
mov dword [0x987dd0], 0x94b5b9a2
mov dword [0x987dd4], 0x9485949d
mov dword [0x987dd8], 0xd98894ba
mov dword [0x987ddc], 0x9097d1d8
mov dword [0x987de0], 0x95949d98
mov word [0x987de4], 0xd1cb
mov byte [0x987de6], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987dd0]
xor cl, 0xf1
mov byte [eax + 0x988548], cl
inc eax
cmp eax, 0x17
jb 0x90f19f
mov eax, 0x988548
ret

Function at 0x90f2ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885e4], 1
jne 0x90f338
or dword [0x9885e4], 1
mov dword [0x987de8], 0xbe9694a3
mov dword [0x987dec], 0xba9f9481
mov dword [0x987df0], 0x89b48894
mov dword [0x987df4], 0x97d1d8d9
mov dword [0x987df8], 0x949d9890
mov dword [0x987dfc], 0xf1d1cb95
xor eax, eax
mov cl, byte [eax + 0x987de8]
xor cl, 0xf1
mov byte [eax + 0x988560], cl
inc eax
cmp eax, 0x18
jb 0x90f33a
mov eax, 0x988560
ret

Function at 0x90f355
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885e0], 1
jne 0x90f3a8
or dword [0x9885e0], 1
mov dword [0x987e00], 0x94b5b9a2
mov dword [0x987e04], 0x9485949d
mov dword [0x987e08], 0x849d90a7
mov dword [0x987e0c], 0xd1d8d994
mov dword [0x987e10], 0x9d989097
mov dword [0x987e14], 0xd1cb9594
mov byte [0x987e18], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987e00]
xor cl, 0xf1
mov byte [eax + 0x988578], cl
inc eax
cmp eax, 0x19
jb 0x90f3aa
mov eax, 0x988578
ret

Function at 0x90f681
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9885dc], 1
jne 0x90f73c
or dword [0x9885dc], 1
mov dword [0x987e20], 0xb5b2b3b0
mov dword [0x987e24], 0xb9b6b7b4
mov dword [0x987e28], 0xbdbabbb8
mov dword [0x987e2c], 0xa1bebfbc
mov dword [0x987e30], 0xa5a2a3a0
mov dword [0x987e34], 0xa9a6a7a4
mov dword [0x987e38], 0x9390aba8
mov dword [0x987e3c], 0x97949592
mov dword [0x987e40], 0x9b989996
mov dword [0x987e44], 0x9f9c9d9a
mov dword [0x987e48], 0x8380819e
mov dword [0x987e4c], 0x87848582
mov dword [0x987e50], 0x8b888986
mov dword [0x987e54], 0xc2c3c0c1
mov dword [0x987e58], 0xc6c7c4c5
mov dword [0x987e5c], 0xdedac8c9
mov byte [0x987e60], 0xf1
xor eax, eax
mov cl, byte [eax + 0x987e20]
xor cl, 0xf1
mov byte [eax + 0x988598], cl
inc eax
cmp eax, 0x41
jb 0x90f73e
mov eax, 0x988598
ret
Function at 0x90f7e9
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0x90f813
mov dword [esi], eax
xor al, al
jmp 0x90f8eb
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0x9829b8]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0x90f88f
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0x90f83d
cmp edx, dword [ebp + 8]
jae 0x90f8de
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0x90f8a3
movzx edi, byte [edi + 1]
jmp 0x90f8a5
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0x90f8d2
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0x90f8d4
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x911630
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x911720
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x911739
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x911792
cmp eax, edx
jae 0x91177e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x911770
lea edx, [esi + 0x20]
push esi
call fcn.00911130
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x9117af
jmp 0x9117a0
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x9117a0
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.00911130
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x911ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x912014
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x912014
test eax, eax
js 0x912014
mov eax, dword [esi + 0x234]
push eax
call fcn.00915ec0
add esp, 4
test eax, eax
jne 0x912019
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x911f1a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x911f75
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x911f6e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x911f34
push ebx
push esi
call fcn.00915e30
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x911f32
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x911f78
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x91200d
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x912003
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x911fc0
push edi
push esi
call fcn.00915e30
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x911f90
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret