joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b8715
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x23c9a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.001dc7b2
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.001dab7d
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.001b4e23
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.001baca0
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x1b87a2
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.001df7af
add esp, 0x10
test al, al
jne 0x1b87e7
call fcn.001b885e
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.002139b5
push 0x25ec28
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.0021d8c5
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.001baca0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x1b8827
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x1b8806
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.001ba0f5
lea esi, [esp + 0x20]
call fcn.001bac87
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.001b4ce5
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1b885e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c34], 1
jne 0x1b88a7
or dword [0x272c34], 1
mov dword [0x26df1c], 0xb4a2b093
mov dword [0x26df20], 0xb5f1e5e7
mov dword [0x26df24], 0xb5beb2b4
mov dword [0x26df28], 0xb0b7f1b4
mov dword [0x26df2c], 0xb5b4bdb8
mov byte [0x26df30], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26df1c]
xor cl, 0xd1
mov byte [eax + 0x26e514], cl
inc eax
cmp eax, 0x15
jb 0x1b88a9
mov eax, 0x26e514
ret

Function at 0x1b8f9e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c30], 1
jne 0x1b8ff3
or dword [0x272c30], 1
mov dword [0x26df34], 0xbda4be92
mov dword [0x26df38], 0xbebff1b5
mov dword [0x26df3c], 0xa1bef1a5
mov dword [0x26df40], 0xb2f1bfb4
mov dword [0x26df44], 0xb9a2b0a3
mov dword [0x26df48], 0xbca4b5f1
mov word [0x26df4c], 0xd1a1
xor eax, eax
mov cl, byte [eax + 0x26df34]
xor cl, 0xd1
mov byte [eax + 0x26e52c], cl
inc eax
cmp eax, 0x1a
jb 0x1b8ff5
mov eax, 0x26e52c
ret
Function at 0x1b9010
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c28], 1
jne 0x1b9033
or dword [0x272c28], 1
mov dword [0x26df54], 0xb6bebdfe
mov word [0x26df58], 0xd1fe
xor eax, eax
mov cl, byte [eax + 0x26df54]
xor cl, 0xd1
mov byte [eax + 0x26e54c], cl
inc eax
cmp eax, 6
jb 0x1b9035
mov eax, 0x26e54c
ret

Function at 0x1b9050
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c24], 1
jne 0x1b90cb
or dword [0x272c24], 1
mov dword [0x26df5c], 0xa1a5a5b9
mov dword [0x26df60], 0xb0fefeeb
mov dword [0x26df64], 0xa8bdb0bf
mov dword [0x26df68], 0xa2b2b8a5
mov dword [0x26df6c], 0xa5b4b6ff
mov dword [0x26df70], 0xbfa6beb5
mov dword [0x26df74], 0xa5a2b4a5
mov dword [0x26df78], 0xbcbeb2ff
mov dword [0x26df7c], 0xfee3a7fe
mov dword [0x26df80], 0xfeb6bebd
mov byte [0x26df84], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26df5c]
xor cl, 0xd1
mov byte [eax + 0x26e554], cl
inc eax
cmp eax, 0x29
jb 0x1b90cd
mov eax, 0x26e554
ret

Function at 0x1b90e8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c20], 1
jne 0x1b9113
or dword [0x272c20], 1
mov dword [0x26df88], 0xa2f7ecb2
mov dword [0x26df8c], 0xeca5f7ec
mov byte [0x26df90], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26df88]
xor cl, 0xd1
mov byte [eax + 0x26e580], cl
inc eax
cmp eax, 9
jb 0x1b9115
mov eax, 0x26e580
ret

Function at 0x1b9130
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c10], 1
jne 0x1b91b8
or dword [0x272c10], 1
mov dword [0x26dfa4], 0xa5bfbe92
mov dword [0x26dfa8], 0xfca5bfb4
mov dword [0x26dfac], 0xb4a1a885
mov dword [0x26dfb0], 0xa1b0f1eb
mov dword [0x26dfb4], 0xb2b8bda1
mov dword [0x26dfb8], 0xbeb8a5b0
mov dword [0x26dfbc], 0xfca9febf
mov dword [0x26dfc0], 0xfca6a6a6
mov dword [0x26dfc4], 0xbca3beb7
mov dword [0x26dfc8], 0xbda3a4fc
mov dword [0x26dfcc], 0xbeb2bfb4
mov dword [0x26dfd0], 0xd1b5b4b5
xor eax, eax
mov cl, byte [eax + 0x26dfa4]
xor cl, 0xd1
mov byte [eax + 0x26e59c], cl
inc eax
cmp eax, 0x30
jb 0x1b91ba
mov eax, 0x26e59c
ret

Function at 0x1b91d5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c0c], 1
jne 0x1b9200
or dword [0x272c0c], 1
mov dword [0x26dfd4], 0x85829e81
mov dword [0x26dfd8], 0xf1bea5f1
mov byte [0x26dfdc], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26dfd4]
xor cl, 0xd1
mov byte [eax + 0x26e5cc], cl
inc eax
cmp eax, 9
jb 0x1b9202
mov eax, 0x26e5cc
ret

Function at 0x1b921d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c08], 1
jne 0x1b9266
or dword [0x272c08], 1
mov dword [0x26dfe0], 0xb8b0b7f1
mov dword [0x26dfe4], 0xf1b5b4bd
mov dword [0x26dfe8], 0xb9a5b8a6
mov dword [0x26dfec], 0xb0a5a2f1
mov dword [0x26dff0], 0xf1a2a4a5
mov byte [0x26dff4], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26dfe0]
xor cl, 0xd1
mov byte [eax + 0x26e5d8], cl
inc eax
cmp eax, 0x15
jb 0x1b9268
mov eax, 0x26e5d8
ret
Function at 0x1b929d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x23b22a
call fcn.00239c88
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x1b944e
cmp dword [ebp + 0x10], ebx
je 0x1b944e
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.001ba5e8
push eax
push 0x25cb68
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.001b5479
push 0x25cb64
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.001b54af
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.001b4e23
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.001b4e23
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x1b93a9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.001ba5e8
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.001ba60a
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1b935d
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.001be0b4
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.001b4e23
inc bl
jne 0x1b9415
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.001b4e23
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x1b9324
test byte [0x272c00], 1
jne 0x1b93d6
or dword [0x272c00], 1
mov dword [0x26e004], 0xf1a5be9f
mov dword [0x26e008], 0xbfa4beb7
mov word [0x26e00c], 0xd1b5
xor eax, eax
mov cl, byte [eax + 0x26e004]
xor cl, 0xd1
mov byte [eax + 0x26e5fc], cl
inc eax
cmp eax, 0xa
jb 0x1b93d8
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x26e5fc
call fcn.002139b5
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x25ec28
lea eax, [ebp - 0x44]
push eax
call fcn.0021d8c5
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.001ba60a
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.001b4e23
push 1
lea esi, [ebp - 0x2c]
call fcn.001b4e23
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.001b9473
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.002139b5
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x25ec28
lea eax, [ebp - 0x38]
jmp 0x1b940f

Function at 0x1b9473
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272c04], 1
jne 0x1b94a0
or dword [0x272c04], 1
mov dword [0x26dff8], 0xf1a5be9f
mov dword [0x26dffc], 0xbfa4beb7
mov word [0x26e000], 0xd1b5
xor eax, eax
mov cl, byte [eax + 0x26dff8]
xor cl, 0xd1
mov byte [eax + 0x26e5f0], cl
inc eax
cmp eax, 0xa
jb 0x1b94a2
mov eax, 0x26e5f0
ret
Function at 0x1b9c57
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bfc], 1
mov ecx, 0xcfd1
jne 0x1b9ce1
or dword [0x272bfc], 1
lea eax, [ecx - 0x1f]
mov word [0x26e010], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0x26e012], dx
lea edx, [ecx - 0x21]
mov word [0x26e014], dx
add edx, 0xfffffff2
mov word [0x26e016], dx
lea edx, [ecx - 0x18]
mov word [0x26e018], dx
add edx, 0xffffffd5
mov word [0x26e01a], dx
mov edx, eax
mov word [0x26e01c], dx
lea edx, [ecx - 0x1d]
lea eax, [ecx - 0x2c]
mov word [0x26e01e], dx
mov word [0x26e026], ax
add edx, 0xffffffed
mov eax, ecx
mov word [0x26e020], dx
mov dword [0x26e022], 0xcfa3cfbe
mov word [0x26e028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x26e010]
add eax, 2
mov word [eax + 0x26e606], dx
cmp eax, 0x1a
jb 0x1b9ce3
mov eax, 0x26e608
ret

Function at 0x1b9d01
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bf8], 1
jne 0x1b9d2c
or dword [0x272bf8], 1
mov dword [0x26e02c], 0xbfa3b4ba
mov dword [0x26e030], 0xe3e2bdb4
mov byte [0x26e034], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26e02c]
xor cl, 0xd1
mov byte [eax + 0x26e624], cl
inc eax
cmp eax, 9
jb 0x1b9d2e
mov eax, 0x26e624
ret

Function at 0x1b9d49
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bf4], 1
jne 0x1b9db2
or dword [0x272bf4], 1
mov dword [0x26e038], 0x81a5b482
mov dword [0x26e03c], 0xb4b2bea3
mov dword [0x26e040], 0xa284a2a2
mov dword [0x26e044], 0xbe9ca3b4
mov dword [0x26e048], 0xa994b4b5
mov dword [0x26e04c], 0xa5a1b4b2
mov dword [0x26e050], 0x81bfbeb8
mov dword [0x26e054], 0xb2b8bdbe
mov word [0x26e058], 0xd1a8
xor eax, eax
mov cl, byte [eax + 0x26e038]
xor cl, 0xd1
mov byte [eax + 0x26e630], cl
inc eax
cmp eax, 0x22
jb 0x1b9db4
mov eax, 0x26e630
ret

Function at 0x1b9dcf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bf0], 1
jne 0x1b9e38
or dword [0x272bf0], 1
mov dword [0x26e05c], 0x81a5b496
mov dword [0x26e060], 0xb4b2bea3
mov dword [0x26e064], 0xa284a2a2
mov dword [0x26e068], 0xbe9ca3b4
mov dword [0x26e06c], 0xa994b4b5
mov dword [0x26e070], 0xa5a1b4b2
mov dword [0x26e074], 0x81bfbeb8
mov dword [0x26e078], 0xb2b8bdbe
mov word [0x26e07c], 0xd1a8
xor eax, eax
mov cl, byte [eax + 0x26e05c]
xor cl, 0xd1
mov byte [eax + 0x26e654], cl
inc eax
cmp eax, 0x22
jb 0x1b9e3a
mov eax, 0x26e654
ret

Function at 0x1b9e55
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bec], 1
jne 0x1b9eab
or dword [0x272bec], 1
mov dword [0x26e080], 0xf1b4bd9e
mov dword [0x26e084], 0xa5b8bfb8
mov dword [0x26e088], 0xb8bdb0b8
mov dword [0x26e08c], 0xb8a5b0ab
mov dword [0x26e090], 0xb7f1bfbe
mov dword [0x26e094], 0xb4bdb8b0
mov dword [0x26e098], 0xd1f1ebb5
xor eax, eax
mov cl, byte [eax + 0x26e080]
xor cl, 0xd1
mov byte [eax + 0x26e678], cl
inc eax
cmp eax, 0x1c
jb 0x1b9ead
mov eax, 0x26e678
ret
Function at 0x1b9ec8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272be8], 1
mov ecx, 0xcfd1
jne 0x1b9ef7
or dword [0x272be8], 1
lea eax, [ecx - 0x21]
mov word [0x26e09c], ax
add eax, 0x33
mov word [0x26e09e], ax
mov eax, ecx
mov word [0x26e0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x26e09c]
add eax, 2
mov word [eax + 0x26e692], dx
cmp eax, 6
jb 0x1b9ef9
mov eax, 0x26e694
ret

Function at 0x1b9f17
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272be0], 1
jne 0x1b9f87
or dword [0x272be0], 1
mov dword [0x26e0ac], 0xbdb8b097
mov dword [0x26e0b0], 0xa5f1b5b4
mov dword [0x26e0b4], 0xbfb8f1be
mov dword [0x26e0b8], 0xb0b8a5b8
mov dword [0x26e0bc], 0xb4abb8bd
mov dword [0x26e0c0], 0xa7bfb4f1
mov dword [0x26e0c4], 0xbfbea3b8
mov dword [0x26e0c8], 0xa5bfb4bc
mov word [0x26e0cc], 0xf1eb
mov byte [0x26e0ce], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26e0ac]
xor cl, 0xd1
mov byte [eax + 0x26e6a4], cl
inc eax
cmp eax, 0x23
jb 0x1b9f89
mov eax, 0x26e6a4
ret

Function at 0x1b9fa4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bd8], 1
jne 0x1b9fef
or dword [0x272bd8], 1
mov dword [0x26e0d8], 0xb0b9bf84
mov dword [0x26e0dc], 0xb4bdb5bf
mov dword [0x26e0e0], 0xa9b4f1b5
mov dword [0x26e0e4], 0xa5a1b4b2
mov dword [0x26e0e8], 0xebbfbeb8
mov word [0x26e0ec], 0xd1f1
xor eax, eax
mov cl, byte [eax + 0x26e0d8]
xor cl, 0xd1
mov byte [eax + 0x26e6d0], cl
inc eax
cmp eax, 0x16
jb 0x1b9ff1
mov eax, 0x26e6d0
ret

Function at 0x1ba00c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bd4], 1
jne 0x1ba05f
or dword [0x272bd4], 1
mov dword [0x26e0f0], 0xb0b9bf84
mov dword [0x26e0f4], 0xb4bdb5bf
mov dword [0x26e0f8], 0xa9b4f1b5
mov dword [0x26e0fc], 0xa5a1b4b2
mov dword [0x26e100], 0xebbfbeb8
mov dword [0x26e104], 0xdba2f4f1
mov byte [0x26e108], 0xd1
xor eax, eax
mov cl, byte [eax + 0x26e0f0]
xor cl, 0xd1
mov byte [eax + 0x26e6e8], cl
inc eax
cmp eax, 0x19
jb 0x1ba061
mov eax, 0x26e6e8
ret

Function at 0x1ba07c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bd0], 1
jne 0x1ba0b4
or dword [0x272bd0], 1
mov dword [0x26e10c], 0xb3a4a582
mov dword [0x26e110], 0xb8a9b4f1
mov dword [0x26e114], 0xf4f9f1a5
mov dword [0x26e118], 0xd1dbf8b5
xor eax, eax
mov cl, byte [eax + 0x26e10c]
xor cl, 0xd1
mov byte [eax + 0x26e704], cl
inc eax
cmp eax, 0x10
jb 0x1ba0b6
mov eax, 0x26e704
ret
Function at 0x1bbaaa
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x23aa3b
call fcn.00239c88
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x1bbb8e
cmp byte [edi + 0x49], bl
je 0x1bbb8e
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1bbae1
xor al, al
jmp 0x1bbb90
push esi
lea esi, [ebp - 0x2c]
call fcn.001bb5a3
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1bbb31
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x1bbb36
dec eax
je 0x1bbb3a
dec eax
dec eax
je 0x1bbb8a
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.001b4ce5
mov al, bl
pop esi
jmp 0x1bbb90
mov edx, dword [ebp - 0x2c]
jmp 0x1bbafb
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1bbb46
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x1bbb6c
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1bbb59
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0021578e
add esp, 0x10
cmp esi, eax
jne 0x1bbb1e
cmp byte [edi + 0x49], 0
je 0x1bbb8a
test esi, esi
jne 0x1bbaed
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.001bb67c
jmp 0x1bbaed
mov bl, 1
jmp 0x1bbb20
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1c03f0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bcc], 1
jne 0x1c0464
or dword [0x272bcc], 1
mov dword [0x26e724], 0xb8a1bb97
mov dword [0x26e728], 0xbbbaf4b0
mov dword [0x26e72c], 0xb1b3f4a0
mov dword [0x26e730], 0xbdb0f4a0
mov dword [0x26e734], 0xb0bda4a7
mov dword [0x26e738], 0xf4b2bbf4
mov dword [0x26e73c], 0xbca0b1b9
mov dword [0x26e740], 0xf3f4b0bb
mov dword [0x26e744], 0xb8b8b5b7
mov dword [0x26e748], 0xd4f4eef3
xor eax, eax
mov cl, byte [eax + 0x26e724]
xor cl, 0xd4
mov byte [eax + 0x26e868], cl
inc eax
cmp eax, 0x28
jb 0x1c0466
mov eax, 0x26e868
ret

Function at 0x1c0481
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bc8], 1
jne 0x1c04e8
or dword [0x272bc8], 1
mov dword [0x26e74c], 0xb8bdb592
mov dword [0x26e750], 0xa0f4b0b1
mov dword [0x26e754], 0xbabdf4bb
mov dword [0x26e758], 0xb1bfbba2
mov dword [0x26e75c], 0xa0b1b9f4
mov dword [0x26e760], 0xf4b0bbbc
mov dword [0x26e764], 0xb8b5b7f3
mov dword [0x26e768], 0xf4eef3b8
mov byte [0x26e76c], 0xd4
xor eax, eax
mov cl, byte [eax + 0x26e74c]
xor cl, 0xd4
mov byte [eax + 0x26e890], cl
inc eax
cmp eax, 0x21
jb 0x1c04ea
mov eax, 0x26e890
ret
Function at 0x1c0505
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bc4], 1
jne 0x1c0565
or dword [0x272bc4], 1
mov dword [0x26e770], 0xbba684de
mov dword [0x26e774], 0xb8b6b5b6
mov dword [0x26e778], 0xa1b0f4ad
mov dword [0x26e77c], 0xbba0f4b1
mov dword [0x26e780], 0xa6b7a7f4
mov dword [0x26e784], 0xf4a0a4bd
mov dword [0x26e788], 0xbba6a6b1
mov dword [0x26e78c], 0xd4f4eea6
xor eax, eax
mov cl, byte [eax + 0x26e770]
xor cl, 0xd4
mov byte [eax + 0x26e8b4], cl
inc eax
cmp eax, 0x20
jb 0x1c0567
mov eax, 0x26e8b4
ret

Function at 0x1c0b2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x1c0c72
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x272bc0], 1
jne 0x1c0b8f
or dword [0x272bc0], 1
mov eax, 0xcfa7
mov word [0x26e790], ax
add eax, 0xa
mov word [0x26e792], ax
mov eax, 0xcfba
mov word [0x26e794], ax
add eax, 0xfffffff6
mov word [0x26e796], ax
mov eax, 0xcfd4
mov word [0x26e798], ax
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x26e790]
add eax, 2
mov word [eax + 0x26e8d2], cx
cmp eax, 0xa
jb 0x1c0b91
mov eax, dword [ebx + edi]
mov ecx, 0x26e8d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1c0bd8
test dx, dx
je 0x1c0bd4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1c0bd8
add eax, esi
add ecx, esi
test dx, dx
jne 0x1c0bb4
xor eax, eax
jmp 0x1c0bdd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1c0be9
mov dword [edi], 0x385
jmp 0x1c0c61
call fcn.001c0c82
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1c0c15
test dx, dx
je 0x1c0c11
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1c0c15
add ecx, esi
add eax, esi
test dx, dx
jne 0x1c0bf1
xor eax, eax
jmp 0x1c0c1a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1c0c26
mov dword [edi], 0x386
jmp 0x1c0c61
call fcn.001c0d55
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1c0c52
test dx, dx
je 0x1c0c4e
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1c0c52
add ecx, esi
add eax, esi
test dx, dx
jne 0x1c0c2e
xor eax, eax
jmp 0x1c0c57
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1c0c7b
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x1c0b4c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x1c0c74
Function at 0x1c0c82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bbc], 1
jne 0x1c0d32
or dword [0x272bbc], 1
mov eax, 0xcfb5
mov word [0x26e79c], ax
add eax, 0xfffffffb
mov ecx, eax
mov word [0x26e7a0], ax
mov eax, 0xcf91
mov word [0x26e7a2], ax
add eax, 0x11
mov word [0x26e7a4], ax
mov eax, 0xcfb1
mov word [0x26e79e], cx
mov ecx, eax
lea edx, [eax + 9]
mov word [0x26e7a6], cx
mov ecx, edx
push edi
mov word [0x26e7a8], cx
add ecx, 0xffffffe6
mov edi, ecx
mov word [0x26e7aa], di
lea edi, [eax - 0x19]
mov word [0x26e7ac], di
add edi, 0x25
mov ecx, eax
add eax, 0xfffffff5
mov word [0x26e7ba], ax
lea eax, [ecx + 0x23]
mov word [0x26e7ae], di
mov dword [0x26e7b0], 0xcfa0cfa7
mov word [0x26e7b4], cx
mov dword [0x26e7b6], 0xcfb1cfba
mov word [0x26e7bc], ax
pop edi
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x26e79c]
add eax, 2
mov word [eax + 0x26e8de], cx
cmp eax, 0x22
jb 0x1c0d34
mov eax, 0x26e8e0
ret

Function at 0x1c0d55
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bb8], 1
mov ecx, 0xcfd4
jne 0x1c0daf
or dword [0x272bb8], 1
lea eax, [ecx - 0x32]
mov word [0x26e7c0], ax
add eax, 0xf
mov word [0x26e7c2], ax
lea eax, [ecx - 0x2e]
mov word [0x26e7c4], ax
inc eax
mov word [0x26e7c6], ax
lea eax, [ecx - 0x17]
mov word [0x26e7c8], ax
add eax, 0xfffffffe
mov word [0x26e7ca], ax
lea eax, [ecx - 0x1a]
mov word [0x26e7cc], ax
mov eax, ecx
mov word [0x26e7ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x26e7c0]
add eax, 2
mov word [eax + 0x26e902], dx
cmp eax, 0x10
jb 0x1c0db1
mov eax, 0x26e904
ret

Function at 0x1c176e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bb4], 1
mov edx, 0xcfd4
jne 0x1c17d1
or dword [0x272bb4], 1
lea ecx, [edx - 0x23]
mov eax, ecx
mov word [0x26e7d0], ax
add eax, 0xfffffff5
push esi
mov esi, eax
lea eax, [edx - 0x3c]
mov word [0x26e7da], ax
add eax, 0x25
mov word [0x26e7dc], ax
mov eax, edx
mov word [0x26e7d2], si
mov word [0x26e7d4], si
mov dword [0x26e7d6], 0xcfa6cfbb
mov dword [0x26e7de], 0xcfb1cfba
mov word [0x26e7e2], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x26e7d0]
add eax, 2
mov word [eax + 0x26e912], cx
cmp eax, 0x14
jb 0x1c17d3
mov eax, 0x26e914
ret

Function at 0x1c17f1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x272bb0], 1
jne 0x1c188d
or dword [0x272bb0], 1
mov edx, 0xcfb1
mov eax, edx
mov word [0x26e7e4], ax
add eax, 0xfffffff5
mov ecx, eax
mov word [0x26e7e6], cx
mov word [0x26e7e8], cx
lea ecx, [edx + 0xa]
mov word [0x26e7ea], cx
mov ecx, eax
mov word [0x26e7ec], cx
lea ecx, [edx - 0x1a]
mov word [0x26e7ee], cx
add ecx, 0x25
mov word [0x26e7f0], cx
lea ecx, [edx + 4]
push edi
mov edi, ecx
mov word [0x26e7f2], di
mov edi, eax
mov word [0x26e7f6], cx
mov word [0x26e7fe], ax
add ecx, 2
lea eax, [edx + 0x23]
mov word [0x26e7f4], di
mov word [0x26e7f8], cx
mov dword [0x26e7fa], 0xcfb1cfa0
mov word [0x26e800], ax
pop edi
xor eax, eax
mov ecx, 0xcfd4
xor cx, word [eax + 0x26e7e4]
add eax, 2
mov word [eax + 0x26e926], cx
cmp eax, 0x1e
jb 0x1c188f
mov eax, 0x26e928
ret