joyce8/EMBER2024-capa huggingface dataset:
Function at 0x23929d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2bb22a
call fcn.002b9c88
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x23944e
cmp dword [ebp + 0x10], ebx
je 0x23944e
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0023a5e8
push eax
push 0x2dcb68
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.00235479
push 0x2dcb64
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.002354af
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.00234e23
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00234e23
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x2393a9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0023a5e8
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0023a60a
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x23935d
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0023e0b4
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.00234e23
inc bl
jne 0x239415
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.00234e23
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x239324
test byte [0x2f2c00], 1
jne 0x2393d6
or dword [0x2f2c00], 1
mov dword [0x2ee004], 0xf1a5be9f
mov dword [0x2ee008], 0xbfa4beb7
mov word [0x2ee00c], 0xd1b5
xor eax, eax
mov cl, byte [eax + 0x2ee004]
xor cl, 0xd1
mov byte [eax + 0x2ee5fc], cl
inc eax
cmp eax, 0xa
jb 0x2393d8
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x2ee5fc
call fcn.002939b5
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x2dec28
lea eax, [ebp - 0x44]
push eax
call fcn.0029d8c5
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0023a60a
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.00234e23
push 1
lea esi, [ebp - 0x2c]
call fcn.00234e23
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.00239473
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.002939b5
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x2dec28
lea eax, [ebp - 0x38]
jmp 0x23940f

Function at 0x239473
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2c04], 1
jne 0x2394a0
or dword [0x2f2c04], 1
mov dword [0x2edff8], 0xf1a5be9f
mov dword [0x2edffc], 0xbfa4beb7
mov word [0x2ee000], 0xd1b5
xor eax, eax
mov cl, byte [eax + 0x2edff8]
xor cl, 0xd1
mov byte [eax + 0x2ee5f0], cl
inc eax
cmp eax, 0xa
jb 0x2394a2
mov eax, 0x2ee5f0
ret
Function at 0x239c57
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bfc], 1
mov ecx, 0xcfd1
jne 0x239ce1
or dword [0x2f2bfc], 1
lea eax, [ecx - 0x1f]
mov word [0x2ee010], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0x2ee012], dx
lea edx, [ecx - 0x21]
mov word [0x2ee014], dx
add edx, 0xfffffff2
mov word [0x2ee016], dx
lea edx, [ecx - 0x18]
mov word [0x2ee018], dx
add edx, 0xffffffd5
mov word [0x2ee01a], dx
mov edx, eax
mov word [0x2ee01c], dx
lea edx, [ecx - 0x1d]
lea eax, [ecx - 0x2c]
mov word [0x2ee01e], dx
mov word [0x2ee026], ax
add edx, 0xffffffed
mov eax, ecx
mov word [0x2ee020], dx
mov dword [0x2ee022], 0xcfa3cfbe
mov word [0x2ee028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2ee010]
add eax, 2
mov word [eax + 0x2ee606], dx
cmp eax, 0x1a
jb 0x239ce3
mov eax, 0x2ee608
ret

Function at 0x239d01
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bf8], 1
jne 0x239d2c
or dword [0x2f2bf8], 1
mov dword [0x2ee02c], 0xbfa3b4ba
mov dword [0x2ee030], 0xe3e2bdb4
mov byte [0x2ee034], 0xd1
xor eax, eax
mov cl, byte [eax + 0x2ee02c]
xor cl, 0xd1
mov byte [eax + 0x2ee624], cl
inc eax
cmp eax, 9
jb 0x239d2e
mov eax, 0x2ee624
ret

Function at 0x239d49
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bf4], 1
jne 0x239db2
or dword [0x2f2bf4], 1
mov dword [0x2ee038], 0x81a5b482
mov dword [0x2ee03c], 0xb4b2bea3
mov dword [0x2ee040], 0xa284a2a2
mov dword [0x2ee044], 0xbe9ca3b4
mov dword [0x2ee048], 0xa994b4b5
mov dword [0x2ee04c], 0xa5a1b4b2
mov dword [0x2ee050], 0x81bfbeb8
mov dword [0x2ee054], 0xb2b8bdbe
mov word [0x2ee058], 0xd1a8
xor eax, eax
mov cl, byte [eax + 0x2ee038]
xor cl, 0xd1
mov byte [eax + 0x2ee630], cl
inc eax
cmp eax, 0x22
jb 0x239db4
mov eax, 0x2ee630
ret

Function at 0x239dcf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bf0], 1
jne 0x239e38
or dword [0x2f2bf0], 1
mov dword [0x2ee05c], 0x81a5b496
mov dword [0x2ee060], 0xb4b2bea3
mov dword [0x2ee064], 0xa284a2a2
mov dword [0x2ee068], 0xbe9ca3b4
mov dword [0x2ee06c], 0xa994b4b5
mov dword [0x2ee070], 0xa5a1b4b2
mov dword [0x2ee074], 0x81bfbeb8
mov dword [0x2ee078], 0xb2b8bdbe
mov word [0x2ee07c], 0xd1a8
xor eax, eax
mov cl, byte [eax + 0x2ee05c]
xor cl, 0xd1
mov byte [eax + 0x2ee654], cl
inc eax
cmp eax, 0x22
jb 0x239e3a
mov eax, 0x2ee654
ret

Function at 0x239e55
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bec], 1
jne 0x239eab
or dword [0x2f2bec], 1
mov dword [0x2ee080], 0xf1b4bd9e
mov dword [0x2ee084], 0xa5b8bfb8
mov dword [0x2ee088], 0xb8bdb0b8
mov dword [0x2ee08c], 0xb8a5b0ab
mov dword [0x2ee090], 0xb7f1bfbe
mov dword [0x2ee094], 0xb4bdb8b0
mov dword [0x2ee098], 0xd1f1ebb5
xor eax, eax
mov cl, byte [eax + 0x2ee080]
xor cl, 0xd1
mov byte [eax + 0x2ee678], cl
inc eax
cmp eax, 0x1c
jb 0x239ead
mov eax, 0x2ee678
ret
Function at 0x239ec8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2be8], 1
mov ecx, 0xcfd1
jne 0x239ef7
or dword [0x2f2be8], 1
lea eax, [ecx - 0x21]
mov word [0x2ee09c], ax
add eax, 0x33
mov word [0x2ee09e], ax
mov eax, ecx
mov word [0x2ee0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2ee09c]
add eax, 2
mov word [eax + 0x2ee692], dx
cmp eax, 6
jb 0x239ef9
mov eax, 0x2ee694
ret

Function at 0x239f17
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2be0], 1
jne 0x239f87
or dword [0x2f2be0], 1
mov dword [0x2ee0ac], 0xbdb8b097
mov dword [0x2ee0b0], 0xa5f1b5b4
mov dword [0x2ee0b4], 0xbfb8f1be
mov dword [0x2ee0b8], 0xb0b8a5b8
mov dword [0x2ee0bc], 0xb4abb8bd
mov dword [0x2ee0c0], 0xa7bfb4f1
mov dword [0x2ee0c4], 0xbfbea3b8
mov dword [0x2ee0c8], 0xa5bfb4bc
mov word [0x2ee0cc], 0xf1eb
mov byte [0x2ee0ce], 0xd1
xor eax, eax
mov cl, byte [eax + 0x2ee0ac]
xor cl, 0xd1
mov byte [eax + 0x2ee6a4], cl
inc eax
cmp eax, 0x23
jb 0x239f89
mov eax, 0x2ee6a4
ret

Function at 0x239fa4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bd8], 1
jne 0x239fef
or dword [0x2f2bd8], 1
mov dword [0x2ee0d8], 0xb0b9bf84
mov dword [0x2ee0dc], 0xb4bdb5bf
mov dword [0x2ee0e0], 0xa9b4f1b5
mov dword [0x2ee0e4], 0xa5a1b4b2
mov dword [0x2ee0e8], 0xebbfbeb8
mov word [0x2ee0ec], 0xd1f1
xor eax, eax
mov cl, byte [eax + 0x2ee0d8]
xor cl, 0xd1
mov byte [eax + 0x2ee6d0], cl
inc eax
cmp eax, 0x16
jb 0x239ff1
mov eax, 0x2ee6d0
ret

Function at 0x23a00c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bd4], 1
jne 0x23a05f
or dword [0x2f2bd4], 1
mov dword [0x2ee0f0], 0xb0b9bf84
mov dword [0x2ee0f4], 0xb4bdb5bf
mov dword [0x2ee0f8], 0xa9b4f1b5
mov dword [0x2ee0fc], 0xa5a1b4b2
mov dword [0x2ee100], 0xebbfbeb8
mov dword [0x2ee104], 0xdba2f4f1
mov byte [0x2ee108], 0xd1
xor eax, eax
mov cl, byte [eax + 0x2ee0f0]
xor cl, 0xd1
mov byte [eax + 0x2ee6e8], cl
inc eax
cmp eax, 0x19
jb 0x23a061
mov eax, 0x2ee6e8
ret

Function at 0x23a07c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bd0], 1
jne 0x23a0b4
or dword [0x2f2bd0], 1
mov dword [0x2ee10c], 0xb3a4a582
mov dword [0x2ee110], 0xb8a9b4f1
mov dword [0x2ee114], 0xf4f9f1a5
mov dword [0x2ee118], 0xd1dbf8b5
xor eax, eax
mov cl, byte [eax + 0x2ee10c]
xor cl, 0xd1
mov byte [eax + 0x2ee704], cl
inc eax
cmp eax, 0x10
jb 0x23a0b6
mov eax, 0x2ee704
ret
Function at 0x23baaa
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2baa3b
call fcn.002b9c88
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x23bb8e
cmp byte [edi + 0x49], bl
je 0x23bb8e
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x23bae1
xor al, al
jmp 0x23bb90
push esi
lea esi, [ebp - 0x2c]
call fcn.0023b5a3
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x23bb31
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x23bb36
dec eax
je 0x23bb3a
dec eax
dec eax
je 0x23bb8a
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00234ce5
mov al, bl
pop esi
jmp 0x23bb90
mov edx, dword [ebp - 0x2c]
jmp 0x23bafb
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x23bb46
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x23bb6c
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x23bb59
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0029578e
add esp, 0x10
cmp esi, eax
jne 0x23bb1e
cmp byte [edi + 0x49], 0
je 0x23bb8a
test esi, esi
jne 0x23baed
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0023b67c
jmp 0x23baed
mov bl, 1
jmp 0x23bb20
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x2403f0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bcc], 1
jne 0x240464
or dword [0x2f2bcc], 1
mov dword [0x2ee724], 0xb8a1bb97
mov dword [0x2ee728], 0xbbbaf4b0
mov dword [0x2ee72c], 0xb1b3f4a0
mov dword [0x2ee730], 0xbdb0f4a0
mov dword [0x2ee734], 0xb0bda4a7
mov dword [0x2ee738], 0xf4b2bbf4
mov dword [0x2ee73c], 0xbca0b1b9
mov dword [0x2ee740], 0xf3f4b0bb
mov dword [0x2ee744], 0xb8b8b5b7
mov dword [0x2ee748], 0xd4f4eef3
xor eax, eax
mov cl, byte [eax + 0x2ee724]
xor cl, 0xd4
mov byte [eax + 0x2ee868], cl
inc eax
cmp eax, 0x28
jb 0x240466
mov eax, 0x2ee868
ret

Function at 0x240481
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bc8], 1
jne 0x2404e8
or dword [0x2f2bc8], 1
mov dword [0x2ee74c], 0xb8bdb592
mov dword [0x2ee750], 0xa0f4b0b1
mov dword [0x2ee754], 0xbabdf4bb
mov dword [0x2ee758], 0xb1bfbba2
mov dword [0x2ee75c], 0xa0b1b9f4
mov dword [0x2ee760], 0xf4b0bbbc
mov dword [0x2ee764], 0xb8b5b7f3
mov dword [0x2ee768], 0xf4eef3b8
mov byte [0x2ee76c], 0xd4
xor eax, eax
mov cl, byte [eax + 0x2ee74c]
xor cl, 0xd4
mov byte [eax + 0x2ee890], cl
inc eax
cmp eax, 0x21
jb 0x2404ea
mov eax, 0x2ee890
ret
Function at 0x240505
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bc4], 1
jne 0x240565
or dword [0x2f2bc4], 1
mov dword [0x2ee770], 0xbba684de
mov dword [0x2ee774], 0xb8b6b5b6
mov dword [0x2ee778], 0xa1b0f4ad
mov dword [0x2ee77c], 0xbba0f4b1
mov dword [0x2ee780], 0xa6b7a7f4
mov dword [0x2ee784], 0xf4a0a4bd
mov dword [0x2ee788], 0xbba6a6b1
mov dword [0x2ee78c], 0xd4f4eea6
xor eax, eax
mov cl, byte [eax + 0x2ee770]
xor cl, 0xd4
mov byte [eax + 0x2ee8b4], cl
inc eax
cmp eax, 0x20
jb 0x240567
mov eax, 0x2ee8b4
ret

Function at 0x240b2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x240c72
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x2f2bc0], 1
jne 0x240b8f
or dword [0x2f2bc0], 1
mov eax, 0xcfa7
mov word [0x2ee790], ax
add eax, 0xa
mov word [0x2ee792], ax
mov eax, 0xcfba
mov word [0x2ee794], ax
add eax, 0xfffffff6
mov word [0x2ee796], ax
mov eax, 0xcfd4
mov word [0x2ee798], ax
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x2ee790]
add eax, 2
mov word [eax + 0x2ee8d2], cx
cmp eax, 0xa
jb 0x240b91
mov eax, dword [ebx + edi]
mov ecx, 0x2ee8d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x240bd8
test dx, dx
je 0x240bd4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x240bd8
add eax, esi
add ecx, esi
test dx, dx
jne 0x240bb4
xor eax, eax
jmp 0x240bdd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x240be9
mov dword [edi], 0x385
jmp 0x240c61
call fcn.00240c82
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x240c15
test dx, dx
je 0x240c11
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x240c15
add ecx, esi
add eax, esi
test dx, dx
jne 0x240bf1
xor eax, eax
jmp 0x240c1a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x240c26
mov dword [edi], 0x386
jmp 0x240c61
call fcn.00240d55
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x240c52
test dx, dx
je 0x240c4e
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x240c52
add ecx, esi
add eax, esi
test dx, dx
jne 0x240c2e
xor eax, eax
jmp 0x240c57
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x240c7b
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x240b4c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x240c74
Function at 0x240c82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bbc], 1
jne 0x240d32
or dword [0x2f2bbc], 1
mov eax, 0xcfb5
mov word [0x2ee79c], ax
add eax, 0xfffffffb
mov ecx, eax
mov word [0x2ee7a0], ax
mov eax, 0xcf91
mov word [0x2ee7a2], ax
add eax, 0x11
mov word [0x2ee7a4], ax
mov eax, 0xcfb1
mov word [0x2ee79e], cx
mov ecx, eax
lea edx, [eax + 9]
mov word [0x2ee7a6], cx
mov ecx, edx
push edi
mov word [0x2ee7a8], cx
add ecx, 0xffffffe6
mov edi, ecx
mov word [0x2ee7aa], di
lea edi, [eax - 0x19]
mov word [0x2ee7ac], di
add edi, 0x25
mov ecx, eax
add eax, 0xfffffff5
mov word [0x2ee7ba], ax
lea eax, [ecx + 0x23]
mov word [0x2ee7ae], di
mov dword [0x2ee7b0], 0xcfa0cfa7
mov word [0x2ee7b4], cx
mov dword [0x2ee7b6], 0xcfb1cfba
mov word [0x2ee7bc], ax
pop edi
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x2ee79c]
add eax, 2
mov word [eax + 0x2ee8de], cx
cmp eax, 0x22
jb 0x240d34
mov eax, 0x2ee8e0
ret

Function at 0x240d55
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bb8], 1
mov ecx, 0xcfd4
jne 0x240daf
or dword [0x2f2bb8], 1
lea eax, [ecx - 0x32]
mov word [0x2ee7c0], ax
add eax, 0xf
mov word [0x2ee7c2], ax
lea eax, [ecx - 0x2e]
mov word [0x2ee7c4], ax
inc eax
mov word [0x2ee7c6], ax
lea eax, [ecx - 0x17]
mov word [0x2ee7c8], ax
add eax, 0xfffffffe
mov word [0x2ee7ca], ax
lea eax, [ecx - 0x1a]
mov word [0x2ee7cc], ax
mov eax, ecx
mov word [0x2ee7ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2ee7c0]
add eax, 2
mov word [eax + 0x2ee902], dx
cmp eax, 0x10
jb 0x240db1
mov eax, 0x2ee904
ret

Function at 0x24176e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bb4], 1
mov edx, 0xcfd4
jne 0x2417d1
or dword [0x2f2bb4], 1
lea ecx, [edx - 0x23]
mov eax, ecx
mov word [0x2ee7d0], ax
add eax, 0xfffffff5
push esi
mov esi, eax
lea eax, [edx - 0x3c]
mov word [0x2ee7da], ax
add eax, 0x25
mov word [0x2ee7dc], ax
mov eax, edx
mov word [0x2ee7d2], si
mov word [0x2ee7d4], si
mov dword [0x2ee7d6], 0xcfa6cfbb
mov dword [0x2ee7de], 0xcfb1cfba
mov word [0x2ee7e2], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x2ee7d0]
add eax, 2
mov word [eax + 0x2ee912], cx
cmp eax, 0x14
jb 0x2417d3
mov eax, 0x2ee914
ret

Function at 0x2417f1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bb0], 1
jne 0x24188d
or dword [0x2f2bb0], 1
mov edx, 0xcfb1
mov eax, edx
mov word [0x2ee7e4], ax
add eax, 0xfffffff5
mov ecx, eax
mov word [0x2ee7e6], cx
mov word [0x2ee7e8], cx
lea ecx, [edx + 0xa]
mov word [0x2ee7ea], cx
mov ecx, eax
mov word [0x2ee7ec], cx
lea ecx, [edx - 0x1a]
mov word [0x2ee7ee], cx
add ecx, 0x25
mov word [0x2ee7f0], cx
lea ecx, [edx + 4]
push edi
mov edi, ecx
mov word [0x2ee7f2], di
mov edi, eax
mov word [0x2ee7f6], cx
mov word [0x2ee7fe], ax
add ecx, 2
lea eax, [edx + 0x23]
mov word [0x2ee7f4], di
mov word [0x2ee7f8], cx
mov dword [0x2ee7fa], 0xcfb1cfa0
mov word [0x2ee800], ax
pop edi
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x2ee7e4]
add eax, 2
mov word [eax + 0x2ee926], cx
cmp eax, 0x1e
jb 0x24188f
mov eax, 0x2ee928
ret
Function at 0x2418b0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2bac], 1
jne 0x241911
or dword [0x2f2bac], 1
mov edx, 0xcfb1
mov eax, edx
mov word [0x2ee804], ax
add eax, 0xfffffff5
mov ecx, eax
mov word [0x2ee806], cx
mov word [0x2ee808], cx
push edi
lea ecx, [edx + 0xa]
mov edi, ecx
mov word [0x2ee80c], ax
lea eax, [edx + 0x23]
mov word [0x2ee80a], di
mov dword [0x2ee80e], 0xcfbbcf97
mov dword [0x2ee812], 0xcfb1cfb0
mov word [0x2ee816], ax
pop edi
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x2ee804]
add eax, 2
mov word [eax + 0x2ee946], cx
cmp eax, 0x14
jb 0x241913
mov eax, 0x2ee948
ret

Function at 0x241934
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2ba8], 1
mov edx, 0xcfd4
jne 0x2419b1
or dword [0x2f2ba8], 1
lea ecx, [edx - 0x23]
mov eax, ecx
mov word [0x2ee818], ax
add eax, 0xfffffff5
push esi
mov esi, eax
lea eax, [edx - 0x3b]
mov word [0x2ee822], ax
mov eax, ecx
mov word [0x2ee824], ax
add eax, 0xfffffff6
mov word [0x2ee81a], si
mov word [0x2ee81c], si
mov esi, eax
mov word [0x2ee828], ax
lea eax, [edx - 0x1f]
mov word [0x2ee82a], ax
mov eax, edx
mov word [0x2ee826], si
mov dword [0x2ee81e], 0xcfa6cfbb
mov dword [0x2ee82c], 0xcfb1cfb3
mov word [0x2ee830], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x2ee818]
add eax, 2
mov word [eax + 0x2ee95a], cx
cmp eax, 0x1a
jb 0x2419b3
mov eax, 0x2ee95c
ret

Function at 0x2419d1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2ba4], 1
mov ecx, 0xcfd4
jne 0x241a30
or dword [0x2f2ba4], 1
lea eax, [ecx - 0x23]
mov word [0x2ee834], ax
add eax, 0xfffffff5
mov edx, eax
mov word [0x2ee836], dx
mov word [0x2ee838], dx
lea edx, [ecx - 0x19]
mov word [0x2ee83a], dx
mov edx, eax
lea eax, [ecx - 0x1c]
mov word [0x2ee842], ax
mov eax, ecx
mov word [0x2ee83c], dx
mov dword [0x2ee83e], 0xcfa6cf81
mov word [0x2ee844], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2ee834]
add eax, 2
mov word [eax + 0x2ee976], dx
cmp eax, 0x12
jb 0x241a32
mov eax, 0x2ee978
ret

Function at 0x2420d5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2ba0], 1
jne 0x2420ff
or dword [0x2f2ba0], 1
mov dword [0x2ee848], 0xb8a1bae8
mov word [0x2ee84c], 0xeab8
mov byte [0x2ee84e], 0xd4
xor eax, eax
mov cl, byte [eax + 0x2ee848]
xor cl, 0xd4
mov byte [eax + 0x2ee98c], cl
inc eax
cmp eax, 7
jb 0x242101
mov eax, 0x2ee98c
ret

Function at 0x24211c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2b9c], 1
jne 0x242146
or dword [0x2f2b9c], 1
mov dword [0x2ee850], 0xb8a1bae8
mov word [0x2ee854], 0xeab8
mov byte [0x2ee856], 0xd4
xor eax, eax
mov cl, byte [eax + 0x2ee850]
xor cl, 0xd4
mov byte [eax + 0x2ee994], cl
inc eax
cmp eax, 7
jb 0x242148
mov eax, 0x2ee994
ret

Function at 0x242163
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2b94], 1
jne 0x242187
or dword [0x2f2b94], 1
mov dword [0x2ee85c], 0xbbb78ff4
mov dword [0x2ee860], 0xd4e9b1b0
xor eax, eax
mov cl, byte [eax + 0x2ee85c]
xor cl, 0xd4
mov byte [eax + 0x2ee9a0], cl
inc eax
cmp eax, 8
jb 0x242189
mov eax, 0x2ee9a0
ret
Function at 0x242ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x31
pop ecx
mov esi, 0x2c2ac8
mov edi, 0x2f2f40
push 0x2c2b8c
rep movsd dword es:[edi], dword [esi]
call fcn.0027a630
pop ecx
pop edi
pop esi
cmp eax, 0xffffffff
jne 0x242f06
xor al, al
ret
push 0x2c2bf8
call fcn.0027a580
pop ecx
cmp eax, 0xffffffff
je 0x242f03
push 0x2c2d00
call fcn.00278ff0
pop ecx
cmp eax, 0xffffffff
je 0x242f03
test byte [0x2f2b88], 1
jne 0x242f47
or dword [0x2f2b88], 1
mov dword [0x2ee9c0], 0xe7b7bea5
mov byte [0x2ee9c4], 0xd6
xor eax, eax
mov cl, byte [eax + 0x2ee9c0]
xor cl, 0xd6
mov byte [eax + 0x2eea8c], cl
inc eax
cmp eax, 5
jb 0x242f49
push 0x2eea8c
call fcn.0027a6a0
pop ecx
mov dword [0x2e8928], eax
test eax, eax
js 0x242f03
call fcn.00242fd2
push eax
call fcn.00279060
pop ecx
mov dword [0x2e892c], eax
test eax, eax
js 0x242f03
test byte [0x2f2b80], 1
jne 0x242fa5
or dword [0x2f2b80], 1
mov dword [0x2ee9d0], 0xd6a5b3b7
xor eax, eax
mov cl, byte [eax + 0x2ee9d0]
xor cl, 0xd6
mov byte [eax + 0x2eea9c], cl
inc eax
cmp eax, 4
jb 0x242fa7
push 0x2eea9c
call fcn.0027a5f0
test eax, eax
mov dword [0x2e8930], eax
pop ecx
setns al
ret

Function at 0x242fd2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2b84], 1
jne 0x242ff6
or dword [0x2f2b84], 1
mov dword [0x2ee9c8], 0xa2a4b9b0
mov dword [0x2ee9cc], 0xd6b7b8a3
xor eax, eax
mov cl, byte [eax + 0x2ee9c8]
xor cl, 0xd6
mov byte [eax + 0x2eea94], cl
inc eax
cmp eax, 8
jb 0x242ff8
mov eax, 0x2eea94
ret

Function at 0x243276
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2b7c], 1
jne 0x2432b4
or dword [0x2f2b7c], 1
mov dword [0x2ee9d4], 0xbff6a6bb
mov dword [0x2ee9d8], 0xf6a2bfb8
mov dword [0x2ee9dc], 0xbabfb7b0
mov word [0x2ee9e0], 0xb2b3
mov byte [0x2ee9e2], 0xd6
xor eax, eax
mov cl, byte [eax + 0x2ee9d4]
xor cl, 0xd6
mov byte [eax + 0x2eeaa0], cl
inc eax
cmp eax, 0xf
jb 0x2432b6
mov eax, 0x2eeaa0
ret

Function at 0x2432d1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2b78], 1
jne 0x24330f
or dword [0x2f2b78], 1
mov dword [0x2ee9e4], 0xbff6a6bb
mov dword [0x2ee9e8], 0xf6a2bfb8
mov dword [0x2ee9ec], 0xbabfb7b0
mov word [0x2ee9f0], 0xb2b3
mov byte [0x2ee9f2], 0xd6
xor eax, eax
mov cl, byte [eax + 0x2ee9e4]
xor cl, 0xd6
mov byte [eax + 0x2eeab0], cl
inc eax
cmp eax, 0xf
jb 0x243311
mov eax, 0x2eeab0
ret

Function at 0x24332c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2b74], 1
jne 0x24336a
or dword [0x2f2b74], 1
mov dword [0x2ee9f4], 0x89a2b3a5
mov dword [0x2ee9f8], 0xf6a2b8bf
mov dword [0x2ee9fc], 0xbabfb7b0
mov word [0x2eea00], 0xb2b3
mov byte [0x2eea02], 0xd6
xor eax, eax
mov cl, byte [eax + 0x2ee9f4]
xor cl, 0xd6
mov byte [eax + 0x2eeac0], cl
inc eax
cmp eax, 0xf
jb 0x24336c
mov eax, 0x2eeac0
ret