joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032f14
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10032fb1
push ebx
push esi
call fcn.10032edd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10032e71
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10032f5e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10032fb0
push edi
push eax
call fcn.10031812
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10032f7e
call fcn.10031860
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10032faf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10032e71
add esp, 0x20
test eax, eax
jne 0x10032f9d
push edi
call fcn.10031860
jmp 0x10032fa5
push ebx
call fcn.10031860
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1003321e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ba20
push 0x1003ba18
push str.FlsAlloc
push 0x1f
call fcn.1003313a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10033252
push dword [ebp + 8]
mov ecx, esi
call dword [0x10039150]
call esi
jmp 0x10033258
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1003329c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ba30
push 0x1003ba28
push str.FlsGetValue
push 0x21
call fcn.1003313a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100332d3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10039150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100332db
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ba38
push 0x1003ba30
push str.FlsSetValue
push 0x22
call fcn.1003313a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10033315
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10039150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10038820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003884d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003884d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5d64733e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..reloc
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x54535e53
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0xec110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0xec11b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0xec1160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0xec11a8
mov esi, dword [ebp - 4]
jns 0xec1187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0xec1197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0xec1169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0xec1140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xec11d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0xec1024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0xec1254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0xec1214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xec2597
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82e20], 1
mov ecx, 0x793a
jne 0xec261e
or dword [0xf82e20], 1
lea eax, [ecx - 0x1b]
mov edx, eax
add eax, 0x47
mov word [0xf7c9d4], ax
mov word [0xf7c9c8], dx
add edx, 0x4f
lea eax, [ecx + 0x24]
mov word [0xf7c9d6], ax
add eax, 0xfffffff1
mov word [0xf7c9d8], ax
mov word [0xf7c9ca], dx
lea edx, [ecx + 0x45]
lea eax, [ecx + 0x1d]
mov word [0xf7c9da], ax
mov word [0xf7c9cc], dx
add edx, 0xfffffff8
add eax, 0xfffffff3
mov word [0xf7c9dc], ax
lea eax, [ecx + 0x2b]
mov word [0xf7c9de], ax
mov eax, ecx
mov word [0xf7c9ce], dx
mov dword [0xf7c9d0], 0x791f796a
mov word [0xf7c9e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf7c9c8]
add eax, 2
mov word [eax + 0xf7d072], dx
cmp eax, 0x1a
jb 0xec2620
mov eax, 0xf7d074
ret

Function at 0xec263e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82e18], 1
jne 0xec266c
or dword [0xf82e18], 1
mov dword [0xf7c9f0], 0x5e555706
mov dword [0xf7c9f4], 0x55f564f
mov dword [0xf7c9f8], 0x3a040505
xor eax, eax
mov cl, byte [eax + 0xf7c9f0]
xor cl, 0x3a
mov byte [eax + 0xf7d09c], cl
inc eax
cmp eax, 0xc
jb 0xec266e
mov eax, 0xf7d09c
ret

Function at 0xec2689
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82e14], 1
mov edx, 0x793a
jne 0xec2749
push esi
lea ecx, [edx - 0x22]
mov eax, ecx
mov word [0xf7c9fc], ax
add eax, 2
or dword [0xf82e14], 1
mov word [0xf7c9fe], ax
lea eax, [edx - 0x23]
mov esi, eax
mov word [0xf7ca00], si
mov word [0xf7ca02], ax
add eax, 0x42
mov word [0xf7ca04], ax
lea eax, [edx + 0xe]
mov esi, eax
mov word [0xf7ca06], si
add esi, 0x13
mov word [0xf7ca08], si
lea esi, [edx + 0xf]
mov word [0xf7ca0a], si
add esi, 9
mov word [0xf7ca0c], si
lea esi, [edx + 0x2b]
mov word [0xf7ca0e], si
mov esi, eax
mov word [0xf7ca10], si
add esi, 0x17
add eax, 6
mov word [0xf7ca12], si
lea esi, [edx + 0x10]
mov word [0xf7ca1a], ax
mov eax, edx
mov word [0xf7ca14], si
mov dword [0xf7ca16], 0x79487955
mov dword [0xf7ca1c], 0x79187907
mov word [0xf7ca20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xf7c9fc]
add eax, 2
mov word [eax + 0xf7d0a6], cx
cmp eax, 0x26
jb 0xec274b
mov eax, 0xf7d0a8
ret
Function at 0xec282c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0xf82e10], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x793a
jne 0xec286a
or dword [0xf82e10], 1
lea eax, [ecx + 0x13]
mov word [0xf7ca24], ax
add eax, 0xb
mov word [0xf7ca26], ax
mov eax, ecx
mov word [0xf7ca28], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xf7ca24]
add eax, 2
mov word [eax + 0xf7d0ce], dx
cmp eax, 6
jb 0xec286e
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0xec2891
mov eax, dword [eax]
push 0xf7d0d0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00f23857
add esp, 0xc
test eax, eax
jne 0xec295c
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00ec35bf
push dword [esp + 0x10]
call fcn.00ec2965
push eax
call fcn.00f23db1
push dword [esp + 0x18]
call fcn.00f2433c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00f26f10
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0xf5208c]
test eax, eax
jne 0xec294a
call dword [0xf520a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00eea8dc
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0xec292e
mov eax, dword [eax]
push eax
call fcn.00ec29a5
push eax
call fcn.00f24080
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.00ec4cef
jmp 0xec295c
push dword [esp + 0x18]
mov esi, dword [0xf520bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xec2965
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82e0c], 1
jne 0xec2988
or dword [0xf82e0c], 1
mov dword [0xf7ca2c], 0x747f3037
mov word [0xf7ca30], 0x3a7e
xor eax, eax
mov cl, byte [eax + 0xf7ca2c]
xor cl, 0x3a
mov byte [eax + 0xf7d0d8], cl
inc eax
cmp eax, 6
jb 0xec298a
mov eax, 0xf7d0d8
ret

Function at 0xec29a5
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82e08], 1
jne 0xec2a2c
or dword [0xf82e08], 1
mov dword [0xf7ca34], 0x56535b7c
mov dword [0xf7ca38], 0x4e1a5e5f
mov dword [0xf7ca3c], 0x48591a55
mov dword [0xf7ca40], 0x5f4e5b5f
mov dword [0xf7ca44], 0x5b48591a
mov dword [0xf7ca48], 0x481a5249
mov dword [0xf7ca4c], 0x48554a5f
mov dword [0xf7ca50], 0x1a485f4e
mov dword [0xf7ca54], 0x5955484a
mov dword [0xf7ca58], 0x49495f
mov dword [0xf7ca5c], 0x30491f1a
mov byte [0xf7ca60], 0x3a
mov cl, byte [eax + 0xf7ca34]
xor cl, 0x3a
mov byte [eax + 0xf7d0e0], cl
inc eax
cmp eax, 0x2d
jb 0xec2a2c
mov eax, 0xf7d0e0
ret
Function at 0xec3af4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82da8], 1
jne 0xec3b2b
or dword [0xf82da8], 1
mov dword [0xf7cce0], 0x4f5e5577
mov dword [0xf7cce4], 0x1a005f56
mov dword [0xf7cce8], 0x3037491f
mov byte [0xf7ccec], 0x3a
mov cl, byte [eax + 0xf7cce0]
xor cl, 0x3a
mov byte [eax + 0xf7d38c], cl
inc eax
cmp eax, 0xd
jb 0xec3b2b
mov eax, 0xf7d38c
ret

Function at 0xec3b46
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82da4], 1
jne 0xec3b87
or dword [0xf82da4], 1
mov dword [0xf7ccf0], 0x5f48526e
mov dword [0xf7ccf4], 0x1a005e5b
mov dword [0xf7ccf8], 0x421f420a
mov dword [0xf7ccfc], 0x30373037
mov byte [0xf7cd00], 0x3a
mov cl, byte [eax + 0xf7ccf0]
xor cl, 0x3a
mov byte [eax + 0xf7d39c], cl
inc eax
cmp eax, 0x11
jb 0xec3b87
mov eax, 0xf7d39c
ret

Function at 0xec3ba2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82da0], 1
jne 0xec3be0
or dword [0xf82da0], 1
mov dword [0xf7cd04], 0x5f59427f
mov dword [0xf7cd08], 0x55534e4a
mov dword [0xf7cd0c], 0x5e1f1a54
mov word [0xf7cd10], 0x3037
mov byte [0xf7cd12], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7cd04]
xor cl, 0x3a
mov byte [eax + 0xf7d3b0], cl
inc eax
cmp eax, 0xf
jb 0xec3be2
mov eax, 0xf7d3b0
ret

Function at 0xec3bfd
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d9c], 1
jne 0xec3c3d
or dword [0xf82d9c], 1
mov dword [0xf7cd14], 0x5b595576
mov dword [0xf7cd18], 0x5455534e
mov dword [0xf7cd1c], 0x4a1f1a00
mov word [0xf7cd20], 0x3037
mov byte [0xf7cd22], 0x3a
mov cl, byte [eax + 0xf7cd14]
xor cl, 0x3a
mov byte [eax + 0xf7d3c0], cl
inc eax
cmp eax, 0xf
jb 0xec3c3d
mov eax, 0xf7d3c0
ret

Function at 0xec3c58
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d98], 1
jne 0xec3c9b
or dword [0xf82d98], 1
mov dword [0xf7cd24], 0x5f4a436e
mov dword [0xf7cd28], 0x491f1a00
mov dword [0xf7cd2c], 0x420a121a
mov dword [0xf7cd30], 0x3713421f
mov word [0xf7cd34], 0x3a30
mov cl, byte [eax + 0xf7cd24]
xor cl, 0x3a
mov byte [eax + 0xf7d3d0], cl
inc eax
cmp eax, 0x12
jb 0xec3c9b
mov eax, 0xf7d3d0
ret

Function at 0xec3cb6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d94], 1
jne 0xec3d40
or dword [0xf82d94], 1
mov dword [0xf7cd38], 0x5b4e5f7e
mov dword [0xf7cd3c], 0x495653
mov dword [0xf7cd40], 0x53486e1a
mov dword [0xf7cd44], 0x4e1a5e5f
mov dword [0xf7cd48], 0x5f481a55
mov dword [0xf7cd4c], 0x5c1a5e5b
mov dword [0xf7cd50], 0x1a575548
mov dword [0xf7cd54], 0x55575f57
mov dword [0xf7cd58], 0x5b1a4348
mov dword [0xf7cd5c], 0x5f485e5e
mov dword [0xf7cd60], 0x1f1a4949
mov dword [0xf7cd64], 0x3a30374a
mov cl, byte [eax + 0xf7cd38]
xor cl, 0x3a
mov byte [eax + 0xf7d3e4], cl
inc eax
cmp eax, 0x30
jb 0xec3d40
mov eax, 0xf7d3e4
ret
Function at 0xec3d5b
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d90], 1
jne 0xec3def
or dword [0xf82d90], 1
mov dword [0xf7cd68], 0x5b4e5f7e
mov dword [0xf7cd6c], 0x495653
mov dword [0xf7cd70], 0x53486e1a
mov dword [0xf7cd74], 0x4e1a5e5f
mov dword [0xf7cd78], 0x484d1a55
mov dword [0xf7cd7c], 0x1a5f4e53
mov dword [0xf7cd80], 0x571a554e
mov dword [0xf7cd84], 0x4855575f
mov dword [0xf7cd88], 0x5e5b1a43
mov dword [0xf7cd8c], 0x495f485e
mov dword [0xf7cd90], 0x4a1f1a49
mov word [0xf7cd94], 0x3037
mov byte [0xf7cd96], 0x3a
mov cl, byte [eax + 0xf7cd68]
xor cl, 0x3a
mov byte [eax + 0xf7d414], cl
inc eax
cmp eax, 0x2f
jb 0xec3def
mov eax, 0xf7d414
ret

Function at 0xec3e0a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d8c], 1
jne 0xec3e9f
or dword [0xf82d8c], 1
mov dword [0xf7cd98], 0x5b4e5f7e
mov dword [0xf7cd9c], 0x495653
mov dword [0xf7cda0], 0x53486e1a
mov dword [0xf7cda4], 0x4e1a5e5f
mov dword [0xf7cda8], 0x425f1a55
mov dword [0xf7cdac], 0x4e4f595f
mov dword [0xf7cdb0], 0x5f571a5f
mov dword [0xf7cdb4], 0x43485557
mov dword [0xf7cdb8], 0x1a4e5b1a
mov dword [0xf7cdbc], 0x485e5e5b
mov dword [0xf7cdc0], 0x1a49495f
mov dword [0xf7cdc4], 0x30374a1f
mov byte [0xf7cdc8], 0x3a
mov cl, byte [eax + 0xf7cd98]
xor cl, 0x3a
mov byte [eax + 0xf7d444], cl
inc eax
cmp eax, 0x31
jb 0xec3e9f
mov eax, 0xf7d444
ret

Function at 0xec3eba
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d88], 1
jne 0xec3ef3
or dword [0xf82d88], 1
mov dword [0xf7cdcc], 0x5d5b567c
mov dword [0xf7cdd0], 0xa1a0049
mov dword [0xf7cdd4], 0x37421f42
mov word [0xf7cdd8], 0x3a30
mov cl, byte [eax + 0xf7cdcc]
xor cl, 0x3a
mov byte [eax + 0xf7d478], cl
inc eax
cmp eax, 0xe
jb 0xec3ef3
mov eax, 0xf7d478
ret

Function at 0xec3f0e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d84], 1
jne 0xec3f47
or dword [0xf82d84], 1
mov dword [0xf7cddc], 0x5b485b6a
mov dword [0xf7cde0], 0x5f4e5f57
mov dword [0xf7cde4], 0x37004948
mov word [0xf7cde8], 0x3a30
mov cl, byte [eax + 0xf7cddc]
xor cl, 0x3a
mov byte [eax + 0xf7d488], cl
inc eax
cmp eax, 0xe
jb 0xec3f47
mov eax, 0xf7d488
ret

Function at 0xec3f62
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d80], 1
jne 0xec3fad
or dword [0xf82d80], 1
mov dword [0xf7cdec], 0x485b6a33
mov dword [0xf7cdf0], 0x4e5f575b
mov dword [0xf7cdf4], 0x1f61485f
mov dword [0xf7cdf8], 0x1a00675e
mov dword [0xf7cdfc], 0x30374a1f
mov byte [0xf7ce00], 0x3a
mov cl, byte [eax + 0xf7cdec]
xor cl, 0x3a
mov byte [eax + 0xf7d498], cl
inc eax
cmp eax, 0x15
jb 0xec3fad
mov eax, 0xf7d498
ret

Function at 0xec3fc8
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d7c], 1
jne 0xec4002
or dword [0xf82d7c], 1
mov dword [0xf7ce04], 0x1a727f69
mov dword [0xf7ce08], 0x565b547b
mov dword [0xf7ce0c], 0x49534943
mov dword [0xf7ce10], 0x3a303700
mov cl, byte [eax + 0xf7ce04]
xor cl, 0x3a
mov byte [eax + 0xf7d4b0], cl
inc eax
cmp eax, 0x10
jb 0xec4002
mov eax, 0xf7d4b0
ret
Function at 0xec401d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d78], 1
jne 0xec4067
or dword [0xf82d78], 1
mov dword [0xf7ce14], 0x50587533
mov dword [0xf7ce18], 0x1a4e595f
mov dword [0xf7ce1c], 0x5f4a434e
mov dword [0xf7ce20], 0x491f1a00
mov word [0xf7ce24], 0x3037
mov byte [0xf7ce26], 0x3a
mov cl, byte [eax + 0xf7ce14]
xor cl, 0x3a
mov byte [eax + 0xf7d4c0], cl
inc eax
cmp eax, 0x13
jb 0xec4067
mov eax, 0xf7d4c0
ret

Function at 0xec4082
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d74], 1
jne 0xec40eb
or dword [0xf82d74], 1
mov dword [0xf7ce28], 0x535b7c33
mov dword [0xf7ce2c], 0x1a5e5f56
mov dword [0xf7ce30], 0x5c1a554e
mov dword [0xf7ce34], 0x55565655
mov dword [0xf7ce38], 0x554a1a4d
mov dword [0xf7ce3c], 0x5f4e5453
mov dword [0xf7ce40], 0x52591a48
mov dword [0xf7ce44], 0x3754535b
mov word [0xf7ce48], 0x3a30
xor eax, eax
mov cl, byte [eax + 0xf7ce28]
xor cl, 0x3a
mov byte [eax + 0xf7d4d4], cl
inc eax
cmp eax, 0x22
jb 0xec40ed
mov eax, 0xf7d4d4
ret

Function at 0xec4108
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d70], 1
jne 0xec412b
or dword [0xf82d70], 1
mov dword [0xf7ce4c], 0x5e4e497a
mov word [0xf7ce50], 0x3a7a
xor eax, eax
mov cl, byte [eax + 0xf7ce4c]
xor cl, 0x3a
mov byte [eax + 0xf7d4f8], cl
inc eax
cmp eax, 6
jb 0xec412d
mov eax, 0xf7d4f8
ret

Function at 0xec4148
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d6c], 1
jne 0xec417f
or dword [0xf82d6c], 1
mov dword [0xf7ce54], 0x4e544f48
mov dword [0xf7ce58], 0x655f5753
mov dword [0xf7ce5c], 0x5548485f
mov word [0xf7ce60], 0x3a48
xor eax, eax
mov cl, byte [eax + 0xf7ce54]
xor cl, 0x3a
mov byte [eax + 0xf7d500], cl
inc eax
cmp eax, 0xe
jb 0xec4181
mov eax, 0xf7d500
ret

Function at 0xec419c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d68], 1
jne 0xec41ca
or dword [0xf82d68], 1
mov dword [0xf7ce64], 0x5d545b48
mov dword [0xf7ce68], 0x485f655f
mov dword [0xf7ce6c], 0x3a485548
xor eax, eax
mov cl, byte [eax + 0xf7ce64]
xor cl, 0x3a
mov byte [eax + 0xf7d510], cl
inc eax
cmp eax, 0xc
jb 0xec41cc
mov eax, 0xf7d510
ret

Function at 0xec41e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d64], 1
jne 0xec4225
or dword [0xf82d64], 1
mov dword [0xf7ce70], 0x485f4c55
mov dword [0xf7ce74], 0x4d55565c
mov dword [0xf7ce78], 0x48485f65
mov word [0xf7ce7c], 0x4855
mov byte [0xf7ce7e], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7ce70]
xor cl, 0x3a
mov byte [eax + 0xf7d51c], cl
inc eax
cmp eax, 0xf
jb 0xec4227
mov eax, 0xf7d51c
ret

Function at 0xec4242
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d60], 1
jne 0xec427a
or dword [0xf82d60], 1
mov dword [0xf7ce80], 0x5f5e544f
mov dword [0xf7ce84], 0x55565c48
mov dword [0xf7ce88], 0x485f654d
mov dword [0xf7ce8c], 0x3a485548
xor eax, eax
mov cl, byte [eax + 0xf7ce80]
xor cl, 0x3a
mov byte [eax + 0xf7d52c], cl
inc eax
cmp eax, 0x10
jb 0xec427c
mov eax, 0xf7d52c
ret
Function at 0xec4297
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d5c], 1
jne 0xec42c5
or dword [0xf82d5c], 1
mov dword [0xf7ce90], 0x535d5556
mov dword [0xf7ce94], 0x485f6559
mov dword [0xf7ce98], 0x3a485548
xor eax, eax
mov cl, byte [eax + 0xf7ce90]
xor cl, 0x3a
mov byte [eax + 0xf7d53c], cl
inc eax
cmp eax, 0xc
jb 0xec42c7
mov eax, 0xf7d53c
ret

Function at 0xec42e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d58], 1
jne 0xec4317
or dword [0xf82d58], 1
mov dword [0xf7ce9c], 0x5b57555e
mov dword [0xf7cea0], 0x5f655453
mov dword [0xf7cea4], 0x48554848
mov byte [0xf7cea8], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7ce9c]
xor cl, 0x3a
mov byte [eax + 0xf7d548], cl
inc eax
cmp eax, 0xd
jb 0xec4319
mov eax, 0xf7d548
ret

Function at 0xec4334
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d54], 1
jne 0xec4373
or dword [0xf82d54], 1
mov dword [0xf7ceac], 0x5b4c5453
mov dword [0xf7ceb0], 0x655e5356
mov dword [0xf7ceb4], 0x4f5d485b
mov dword [0xf7ceb8], 0x4e545f57
mov byte [0xf7cebc], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7ceac]
xor cl, 0x3a
mov byte [eax + 0xf7d558], cl
inc eax
cmp eax, 0x11
jb 0xec4375
mov eax, 0xf7d558
ret

Function at 0xec4390
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d50], 1
jne 0xec43c5
or dword [0xf82d50], 1
mov dword [0xf7cec0], 0x5d545f56
mov dword [0xf7cec4], 0x5f65524e
mov dword [0xf7cec8], 0x48554848
mov byte [0xf7cecc], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7cec0]
xor cl, 0x3a
mov byte [eax + 0xf7d56c], cl
inc eax
cmp eax, 0xd
jb 0xec43c7
mov eax, 0xf7d56c
ret

Function at 0xec43e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d4c], 1
jne 0xec4417
or dword [0xf82d4c], 1
mov dword [0xf7ced0], 0x654e4f55
mov dword [0xf7ced4], 0x48655c55
mov dword [0xf7ced8], 0x5f5d545b
mov byte [0xf7cedc], 0x3a
xor eax, eax
mov cl, byte [eax + 0xf7ced0]
xor cl, 0x3a
mov byte [eax + 0xf7d57c], cl
inc eax
cmp eax, 0xd
jb 0xec4419
mov eax, 0xf7d57c
ret

Function at 0xec4434
Capabilities:
Encode data using xor

Disassembly:
test byte [0xf82d48], 1
jne 0xec4461
or dword [0xf82d48], 1
mov dword [0xf7cee0], 0x5f59425f
mov dword [0xf7cee4], 0x55534e4a
mov word [0xf7cee8], 0x3a54
xor eax, eax
mov cl, byte [eax + 0xf7cee0]
xor cl, 0x3a
mov byte [eax + 0xf7d58c], cl
inc eax
cmp eax, 0xa
jb 0xec4463
mov eax, 0xf7d58c
ret

Function at 0xec447e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xf82d44], 1
jne 0xec44df
or dword [0xf82d44], 1
mov dword [0xf7ceec], 0x5e4e4933
mov dword [0xf7cef0], 0x425f0000
mov dword [0xf7cef4], 0x4e4a5f59
mov dword [0xf7cef8], 0x545553
mov dword [0xf7cefc], 0x5b524d00
mov dword [0xf7cf00], 0x13124e
mov dword [0xf7cf04], 0x37491f1a
mov word [0xf7cf08], 0x3a30
mov cl, byte [eax + 0xf7ceec]
xor cl, 0x3a
mov byte [eax + 0xf7d598], cl
inc eax
cmp eax, 0x1e
jb 0xec44df
mov eax, 0xf7d598
ret