joyce8/EMBER2024-capa huggingface dataset:
Function at 0x308fab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c28], 1
jne 0x308fce
or dword [0x3c2c28], 1
mov dword [0x3bdf54], 0x70787b38
mov word [0x3bdf58], 0x1738
xor eax, eax
mov cl, byte [eax + 0x3bdf54]
xor cl, 0x17
mov byte [eax + 0x3be54c], cl
inc eax
cmp eax, 6
jb 0x308fd0
mov eax, 0x3be54c
ret

Function at 0x308fee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c24], 1
jne 0x309069
or dword [0x3c2c24], 1
mov dword [0x3bdf5c], 0x6763637f
mov dword [0x3bdf60], 0x7638382d
mov dword [0x3bdf64], 0x6e7b7679
mov dword [0x3bdf68], 0x64747e63
mov dword [0x3bdf6c], 0x63727039
mov dword [0x3bdf70], 0x79607873
mov dword [0x3bdf74], 0x63647263
mov dword [0x3bdf78], 0x7a787439
mov dword [0x3bdf7c], 0x38256138
mov dword [0x3bdf80], 0x3870787b
mov byte [0x3bdf84], 0x17
xor eax, eax
mov cl, byte [eax + 0x3bdf5c]
xor cl, 0x17
mov byte [eax + 0x3be554], cl
inc eax
cmp eax, 0x29
jb 0x30906b
mov eax, 0x3be554
ret

Function at 0x309086
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c20], 1
jne 0x3090b1
or dword [0x3c2c20], 1
mov dword [0x3bdf88], 0x64312a74
mov dword [0x3bdf8c], 0x2a63312a
mov byte [0x3bdf90], 0x17
xor eax, eax
mov cl, byte [eax + 0x3bdf88]
xor cl, 0x17
mov byte [eax + 0x3be580], cl
inc eax
cmp eax, 9
jb 0x3090b3
mov eax, 0x3be580
ret

Function at 0x3090ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c10], 1
jne 0x309156
or dword [0x3c2c10], 1
mov dword [0x3bdfa4], 0x63797854
mov dword [0x3bdfa8], 0x3a637972
mov dword [0x3bdfac], 0x72676e43
mov dword [0x3bdfb0], 0x6776372d
mov dword [0x3bdfb4], 0x747e7b67
mov dword [0x3bdfb8], 0x787e6376
mov dword [0x3bdfbc], 0x3a6f3879
mov dword [0x3bdfc0], 0x3a606060
mov dword [0x3bdfc4], 0x7a657871
mov dword [0x3bdfc8], 0x7b65623a
mov dword [0x3bdfcc], 0x78747972
mov dword [0x3bdfd0], 0x17737273
xor eax, eax
mov cl, byte [eax + 0x3bdfa4]
xor cl, 0x17
mov byte [eax + 0x3be59c], cl
inc eax
cmp eax, 0x30
jb 0x309158
mov eax, 0x3be59c
ret

Function at 0x309173
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c0c], 1
jne 0x30919e
or dword [0x3c2c0c], 1
mov dword [0x3bdfd4], 0x43445847
mov dword [0x3bdfd8], 0x37786337
mov byte [0x3bdfdc], 0x17
xor eax, eax
mov cl, byte [eax + 0x3bdfd4]
xor cl, 0x17
mov byte [eax + 0x3be5cc], cl
inc eax
cmp eax, 9
jb 0x3091a0
mov eax, 0x3be5cc
ret

Function at 0x3091bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c08], 1
jne 0x309204
or dword [0x3c2c08], 1
mov dword [0x3bdfe0], 0x7e767137
mov dword [0x3bdfe4], 0x3773727b
mov dword [0x3bdfe8], 0x7f637e60
mov dword [0x3bdfec], 0x76636437
mov dword [0x3bdff0], 0x37646263
mov byte [0x3bdff4], 0x17
xor eax, eax
mov cl, byte [eax + 0x3bdfe0]
xor cl, 0x17
mov byte [eax + 0x3be5d8], cl
inc eax
cmp eax, 0x15
jb 0x309206
mov eax, 0x3be5d8
ret
Function at 0x30923b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38b1da
call fcn.00389c38
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x3093ec
cmp dword [ebp + 0x10], ebx
je 0x3093ec
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0030a586
push eax
push 0x3acb70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.0030547e
push 0x3acb6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.003054b4
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.00304e28
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00304e28
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x309347
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0030a586
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0030a5a8
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x3092fb
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0030e060
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.00304e28
inc bl
jne 0x3093b3
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.00304e28
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x3092c2
test byte [0x3c2c00], 1
jne 0x309374
or dword [0x3c2c00], 1
mov dword [0x3be004], 0x37637859
mov dword [0x3be008], 0x79627871
mov word [0x3be00c], 0x1773
xor eax, eax
mov cl, byte [eax + 0x3be004]
xor cl, 0x17
mov byte [eax + 0x3be5fc], cl
inc eax
cmp eax, 0xa
jb 0x309376
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x3be5fc
call fcn.00363965
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x3aec28
lea eax, [ebp - 0x44]
push eax
call fcn.0036d875
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0030a5a8
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.00304e28
push 1
lea esi, [ebp - 0x2c]
call fcn.00304e28
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.00309411
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.00363965
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x3aec28
lea eax, [ebp - 0x38]
jmp 0x3093ad

Function at 0x309411
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2c04], 1
jne 0x30943e
or dword [0x3c2c04], 1
mov dword [0x3bdff8], 0x37637859
mov dword [0x3bdffc], 0x79627871
mov word [0x3be000], 0x1773
xor eax, eax
mov cl, byte [eax + 0x3bdff8]
xor cl, 0x17
mov byte [eax + 0x3be5f0], cl
inc eax
cmp eax, 0xa
jb 0x309440
mov eax, 0x3be5f0
ret
Function at 0x309bf5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bfc], 1
mov ecx, 0x8317
jne 0x309c7f
or dword [0x3c2bfc], 1
lea eax, [ecx + 0x5d]
mov word [0x3be010], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0x3be012], dx
lea edx, [ecx + 0x5f]
mov word [0x3be014], dx
add edx, 0xffffffee
mov word [0x3be016], dx
lea edx, [ecx + 0x68]
mov word [0x3be018], dx
add edx, 0xffffffc9
mov word [0x3be01a], dx
mov edx, eax
mov word [0x3be01c], dx
lea edx, [ecx + 0x5b]
lea eax, [ecx + 0x4c]
mov word [0x3be01e], dx
mov word [0x3be026], ax
add edx, 0xfffffff5
mov eax, ecx
mov word [0x3be020], dx
mov dword [0x3be022], 0x83658378
mov word [0x3be028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x3be010]
add eax, 2
mov word [eax + 0x3be606], dx
cmp eax, 0x1a
jb 0x309c81
mov eax, 0x3be608
ret

Function at 0x309c9f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bf8], 1
jne 0x309cca
or dword [0x3c2bf8], 1
mov dword [0x3be02c], 0x7965727c
mov dword [0x3be030], 0x25247b72
mov byte [0x3be034], 0x17
xor eax, eax
mov cl, byte [eax + 0x3be02c]
xor cl, 0x17
mov byte [eax + 0x3be624], cl
inc eax
cmp eax, 9
jb 0x309ccc
mov eax, 0x3be624
ret

Function at 0x309ce7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bf4], 1
jne 0x309d50
or dword [0x3c2bf4], 1
mov dword [0x3be038], 0x47637244
mov dword [0x3be03c], 0x72747865
mov dword [0x3be040], 0x64426464
mov dword [0x3be044], 0x785a6572
mov dword [0x3be048], 0x6f527273
mov dword [0x3be04c], 0x63677274
mov dword [0x3be050], 0x4779787e
mov dword [0x3be054], 0x747e7b78
mov word [0x3be058], 0x176e
xor eax, eax
mov cl, byte [eax + 0x3be038]
xor cl, 0x17
mov byte [eax + 0x3be630], cl
inc eax
cmp eax, 0x22
jb 0x309d52
mov eax, 0x3be630
ret

Function at 0x309d6d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bf0], 1
jne 0x309dd6
or dword [0x3c2bf0], 1
mov dword [0x3be05c], 0x47637250
mov dword [0x3be060], 0x72747865
mov dword [0x3be064], 0x64426464
mov dword [0x3be068], 0x785a6572
mov dword [0x3be06c], 0x6f527273
mov dword [0x3be070], 0x63677274
mov dword [0x3be074], 0x4779787e
mov dword [0x3be078], 0x747e7b78
mov word [0x3be07c], 0x176e
xor eax, eax
mov cl, byte [eax + 0x3be05c]
xor cl, 0x17
mov byte [eax + 0x3be654], cl
inc eax
cmp eax, 0x22
jb 0x309dd8
mov eax, 0x3be654
ret

Function at 0x309df3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bec], 1
jne 0x309e49
or dword [0x3c2bec], 1
mov dword [0x3be080], 0x37727b58
mov dword [0x3be084], 0x637e797e
mov dword [0x3be088], 0x7e7b767e
mov dword [0x3be08c], 0x7e63766d
mov dword [0x3be090], 0x71377978
mov dword [0x3be094], 0x727b7e76
mov dword [0x3be098], 0x17372d73
xor eax, eax
mov cl, byte [eax + 0x3be080]
xor cl, 0x17
mov byte [eax + 0x3be678], cl
inc eax
cmp eax, 0x1c
jb 0x309e4b
mov eax, 0x3be678
ret
Function at 0x309e66
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2be8], 1
mov ecx, 0x8317
jne 0x309e95
or dword [0x3c2be8], 1
lea eax, [ecx + 0x5f]
mov word [0x3be09c], ax
add eax, 0xffffffaf
mov word [0x3be09e], ax
mov eax, ecx
mov word [0x3be0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x3be09c]
add eax, 2
mov word [eax + 0x3be692], dx
cmp eax, 6
jb 0x309e97
mov eax, 0x3be694
ret

Function at 0x309eb5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2be0], 1
jne 0x309f25
or dword [0x3c2be0], 1
mov dword [0x3be0ac], 0x7b7e7651
mov dword [0x3be0b0], 0x63377372
mov dword [0x3be0b4], 0x797e3778
mov dword [0x3be0b8], 0x767e637e
mov dword [0x3be0bc], 0x726d7e7b
mov dword [0x3be0c0], 0x61797237
mov dword [0x3be0c4], 0x7978657e
mov dword [0x3be0c8], 0x6379727a
mov word [0x3be0cc], 0x372d
mov byte [0x3be0ce], 0x17
xor eax, eax
mov cl, byte [eax + 0x3be0ac]
xor cl, 0x17
mov byte [eax + 0x3be6a4], cl
inc eax
cmp eax, 0x23
jb 0x309f27
mov eax, 0x3be6a4
ret

Function at 0x309f42
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bd8], 1
jne 0x309f8d
or dword [0x3c2bd8], 1
mov dword [0x3be0d8], 0x767f7942
mov dword [0x3be0dc], 0x727b7379
mov dword [0x3be0e0], 0x6f723773
mov dword [0x3be0e4], 0x63677274
mov dword [0x3be0e8], 0x2d79787e
mov word [0x3be0ec], 0x1737
xor eax, eax
mov cl, byte [eax + 0x3be0d8]
xor cl, 0x17
mov byte [eax + 0x3be6d0], cl
inc eax
cmp eax, 0x16
jb 0x309f8f
mov eax, 0x3be6d0
ret

Function at 0x309faa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bd4], 1
jne 0x309ffd
or dword [0x3c2bd4], 1
mov dword [0x3be0f0], 0x767f7942
mov dword [0x3be0f4], 0x727b7379
mov dword [0x3be0f8], 0x6f723773
mov dword [0x3be0fc], 0x63677274
mov dword [0x3be100], 0x2d79787e
mov dword [0x3be104], 0x1d643237
mov byte [0x3be108], 0x17
xor eax, eax
mov cl, byte [eax + 0x3be0f0]
xor cl, 0x17
mov byte [eax + 0x3be6e8], cl
inc eax
cmp eax, 0x19
jb 0x309fff
mov eax, 0x3be6e8
ret

Function at 0x30a01a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bd0], 1
jne 0x30a052
or dword [0x3c2bd0], 1
mov dword [0x3be10c], 0x75626344
mov dword [0x3be110], 0x7e6f7237
mov dword [0x3be114], 0x323f3763
mov dword [0x3be118], 0x171d3e73
xor eax, eax
mov cl, byte [eax + 0x3be10c]
xor cl, 0x17
mov byte [eax + 0x3be704], cl
inc eax
cmp eax, 0x10
jb 0x30a054
mov eax, 0x3be704
ret
Function at 0x30ba56
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x38a9ed
call fcn.00389c38
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x30bb3a
cmp byte [edi + 0x49], bl
je 0x30bb3a
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x30ba8d
xor al, al
jmp 0x30bb3c
push esi
lea esi, [ebp - 0x2c]
call fcn.0030b54f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x30badd
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x30bae2
dec eax
je 0x30bae6
dec eax
dec eax
je 0x30bb36
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00304cea
mov al, bl
pop esi
jmp 0x30bb3c
mov edx, dword [ebp - 0x2c]
jmp 0x30baa7
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x30baf2
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x30bb18
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x30bb05
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0036573e
add esp, 0x10
cmp esi, eax
jne 0x30baca
cmp byte [edi + 0x49], 0
je 0x30bb36
test esi, esi
jne 0x30ba99
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0030b628
jmp 0x30ba99
mov bl, 1
jmp 0x30bacc
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x310386
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bcc], 1
jne 0x3103fa
or dword [0x3c2bcc], 1
mov dword [0x3be724], 0x746d775b
mov dword [0x3be728], 0x7776387c
mov dword [0x3be72c], 0x7d7f386c
mov dword [0x3be730], 0x717c386c
mov dword [0x3be734], 0x7c71686b
mov dword [0x3be738], 0x387e7738
mov dword [0x3be73c], 0x706c7d75
mov dword [0x3be740], 0x3f387c77
mov dword [0x3be744], 0x7474797b
mov dword [0x3be748], 0x1838223f
xor eax, eax
mov cl, byte [eax + 0x3be724]
xor cl, 0x18
mov byte [eax + 0x3be868], cl
inc eax
cmp eax, 0x28
jb 0x3103fc
mov eax, 0x3be868
ret

Function at 0x310417
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bc8], 1
jne 0x31047e
or dword [0x3c2bc8], 1
mov dword [0x3be74c], 0x7471795e
mov dword [0x3be750], 0x6c387c7d
mov dword [0x3be754], 0x76713877
mov dword [0x3be758], 0x7d73776e
mov dword [0x3be75c], 0x6c7d7538
mov dword [0x3be760], 0x387c7770
mov dword [0x3be764], 0x74797b3f
mov dword [0x3be768], 0x38223f74
mov byte [0x3be76c], 0x18
xor eax, eax
mov cl, byte [eax + 0x3be74c]
xor cl, 0x18
mov byte [eax + 0x3be890], cl
inc eax
cmp eax, 0x21
jb 0x310480
mov eax, 0x3be890
ret
Function at 0x31049b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bc4], 1
jne 0x3104fb
or dword [0x3c2bc4], 1
mov dword [0x3be770], 0x776a4812
mov dword [0x3be774], 0x747a797a
mov dword [0x3be778], 0x6d7c3861
mov dword [0x3be77c], 0x776c387d
mov dword [0x3be780], 0x6a7b6b38
mov dword [0x3be784], 0x386c6871
mov dword [0x3be788], 0x776a6a7d
mov dword [0x3be78c], 0x1838226a
xor eax, eax
mov cl, byte [eax + 0x3be770]
xor cl, 0x18
mov byte [eax + 0x3be8b4], cl
inc eax
cmp eax, 0x20
jb 0x3104fd
mov eax, 0x3be8b4
ret

Function at 0x310ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x310c1d
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x3c2bc0], 1
jne 0x310b3a
or dword [0x3c2bc0], 1
mov eax, 0x836b
mov word [0x3be790], ax
add eax, 0x12
mov word [0x3be792], ax
mov eax, 0x8376
mov word [0x3be794], ax
add eax, 6
mov word [0x3be796], ax
mov eax, 0x8318
mov word [0x3be798], ax
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x3be790]
add eax, 2
mov word [eax + 0x3be8d2], cx
cmp eax, 0xa
jb 0x310b3c
mov eax, dword [ebx + edi]
mov ecx, 0x3be8d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x310b83
test dx, dx
je 0x310b7f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x310b83
add eax, esi
add ecx, esi
test dx, dx
jne 0x310b5f
xor eax, eax
jmp 0x310b88
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x310b94
mov dword [edi], 0x385
jmp 0x310c0c
call fcn.00310c2d
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x310bc0
test dx, dx
je 0x310bbc
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x310bc0
add ecx, esi
add eax, esi
test dx, dx
jne 0x310b9c
xor eax, eax
jmp 0x310bc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x310bd1
mov dword [edi], 0x386
jmp 0x310c0c
call fcn.00310d00
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x310bfd
test dx, dx
je 0x310bf9
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x310bfd
add ecx, esi
add eax, esi
test dx, dx
jne 0x310bd9
xor eax, eax
jmp 0x310c02
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x310c26
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x310af7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x310c1f
Function at 0x310c2d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bbc], 1
jne 0x310cdd
or dword [0x3c2bbc], 1
mov eax, 0x8379
mov word [0x3be79c], ax
add eax, 3
mov ecx, eax
mov word [0x3be7a0], ax
mov eax, 0x835d
mov word [0x3be7a2], ax
add eax, 0x11
mov word [0x3be7a4], ax
mov eax, 0x837d
mov word [0x3be79e], cx
mov ecx, eax
lea edx, [eax - 7]
mov word [0x3be7a6], cx
mov ecx, edx
push edi
mov word [0x3be7a8], cx
add ecx, 0xfffffff6
mov edi, ecx
mov word [0x3be7aa], di
lea edi, [eax - 0x29]
mov word [0x3be7ac], di
add edi, 0x1d
mov ecx, eax
add eax, 0xffffffed
mov word [0x3be7ba], ax
lea eax, [ecx - 0x65]
mov word [0x3be7ae], di
mov dword [0x3be7b0], 0x836c836b
mov word [0x3be7b4], cx
mov dword [0x3be7b6], 0x837d8376
mov word [0x3be7bc], ax
pop edi
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x3be79c]
add eax, 2
mov word [eax + 0x3be8de], cx
cmp eax, 0x22
jb 0x310cdf
mov eax, 0x3be8e0
ret

Function at 0x310d00
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bb8], 1
mov ecx, 0x8318
jne 0x310d5a
or dword [0x3c2bb8], 1
lea eax, [ecx + 0x56]
mov word [0x3be7c0], ax
add eax, 0xf
mov word [0x3be7c2], ax
lea eax, [ecx + 0x52]
mov word [0x3be7c4], ax
inc eax
mov word [0x3be7c6], ax
lea eax, [ecx + 0x59]
mov word [0x3be7c8], ax
add eax, 6
mov word [0x3be7ca], ax
lea eax, [ecx + 0x5e]
mov word [0x3be7cc], ax
mov eax, ecx
mov word [0x3be7ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x3be7c0]
add eax, 2
mov word [eax + 0x3be902], dx
cmp eax, 0x10
jb 0x310d5c
mov eax, 0x3be904
ret

Function at 0x311719
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bb4], 1
mov edx, 0x8318
jne 0x31177c
or dword [0x3c2bb4], 1
lea ecx, [edx + 0x65]
mov eax, ecx
mov word [0x3be7d0], ax
add eax, 0xffffffed
push esi
mov esi, eax
lea eax, [edx + 0x3c]
mov word [0x3be7da], ax
add eax, 0x1d
mov word [0x3be7dc], ax
mov eax, edx
mov word [0x3be7d2], si
mov word [0x3be7d4], si
mov dword [0x3be7d6], 0x836a8377
mov dword [0x3be7de], 0x837d8376
mov word [0x3be7e2], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x3be7d0]
add eax, 2
mov word [eax + 0x3be912], cx
cmp eax, 0x14
jb 0x31177e
mov eax, 0x3be914
ret

Function at 0x31179c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bb0], 1
jne 0x311838
or dword [0x3c2bb0], 1
mov edx, 0x837d
mov eax, edx
mov word [0x3be7e4], ax
add eax, 0xffffffed
mov ecx, eax
mov word [0x3be7e6], cx
mov word [0x3be7e8], cx
lea ecx, [edx - 6]
mov word [0x3be7ea], cx
mov ecx, eax
mov word [0x3be7ec], cx
lea ecx, [edx - 0x22]
mov word [0x3be7ee], cx
add ecx, 0x15
mov word [0x3be7f0], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x3be7f2], di
mov edi, eax
mov word [0x3be7f6], cx
mov word [0x3be7fe], ax
add ecx, 2
lea eax, [edx - 0x65]
mov word [0x3be7f4], di
mov word [0x3be7f8], cx
mov dword [0x3be7fa], 0x837d836c
mov word [0x3be800], ax
pop edi
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x3be7e4]
add eax, 2
mov word [eax + 0x3be926], cx
cmp eax, 0x1e
jb 0x31183a
mov eax, 0x3be928
ret
Function at 0x31185b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2bac], 1
jne 0x3118bc
or dword [0x3c2bac], 1
mov edx, 0x837d
mov eax, edx
mov word [0x3be804], ax
add eax, 0xffffffed
mov ecx, eax
mov word [0x3be806], cx
mov word [0x3be808], cx
push edi
lea ecx, [edx - 6]
mov edi, ecx
mov word [0x3be80c], ax
lea eax, [edx - 0x65]
mov word [0x3be80a], di
mov dword [0x3be80e], 0x8377835b
mov dword [0x3be812], 0x837d837c
mov word [0x3be816], ax
pop edi
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x3be804]
add eax, 2
mov word [eax + 0x3be946], cx
cmp eax, 0x14
jb 0x3118be
mov eax, 0x3be948
ret

Function at 0x3118df
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2ba8], 1
mov edx, 0x8318
jne 0x31195c
or dword [0x3c2ba8], 1
lea ecx, [edx + 0x65]
mov eax, ecx
mov word [0x3be818], ax
add eax, 0xffffffed
push esi
mov esi, eax
lea eax, [edx + 0x3d]
mov word [0x3be822], ax
mov eax, ecx
mov word [0x3be824], ax
add eax, 0xffffffee
mov word [0x3be81a], si
mov word [0x3be81c], si
mov esi, eax
mov word [0x3be828], ax
lea eax, [edx + 0x61]
mov word [0x3be82a], ax
mov eax, edx
mov word [0x3be826], si
mov dword [0x3be81e], 0x836a8377
mov dword [0x3be82c], 0x837d837f
mov word [0x3be830], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x3be818]
add eax, 2
mov word [eax + 0x3be95a], cx
cmp eax, 0x1a
jb 0x31195e
mov eax, 0x3be95c
ret

Function at 0x31197c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2ba4], 1
mov ecx, 0x8318
jne 0x3119db
or dword [0x3c2ba4], 1
lea eax, [ecx + 0x65]
mov word [0x3be834], ax
add eax, 0xffffffed
mov edx, eax
mov word [0x3be836], dx
mov word [0x3be838], dx
lea edx, [ecx + 0x5f]
mov word [0x3be83a], dx
mov edx, eax
lea eax, [ecx + 0x5c]
mov word [0x3be842], ax
mov eax, ecx
mov word [0x3be83c], dx
mov dword [0x3be83e], 0x836a834d
mov word [0x3be844], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x3be834]
add eax, 2
mov word [eax + 0x3be976], dx
cmp eax, 0x12
jb 0x3119dd
mov eax, 0x3be978
ret

Function at 0x312083
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2ba0], 1
jne 0x3120ad
or dword [0x3c2ba0], 1
mov dword [0x3be848], 0x746d7624
mov word [0x3be84c], 0x2674
mov byte [0x3be84e], 0x18
xor eax, eax
mov cl, byte [eax + 0x3be848]
xor cl, 0x18
mov byte [eax + 0x3be98c], cl
inc eax
cmp eax, 7
jb 0x3120af
mov eax, 0x3be98c
ret

Function at 0x3120ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2b9c], 1
jne 0x3120f4
or dword [0x3c2b9c], 1
mov dword [0x3be850], 0x746d7624
mov word [0x3be854], 0x2674
mov byte [0x3be856], 0x18
xor eax, eax
mov cl, byte [eax + 0x3be850]
xor cl, 0x18
mov byte [eax + 0x3be994], cl
inc eax
cmp eax, 7
jb 0x3120f6
mov eax, 0x3be994
ret

Function at 0x312111
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2b94], 1
jne 0x312135
or dword [0x3c2b94], 1
mov dword [0x3be85c], 0x777b4338
mov dword [0x3be860], 0x18257d7c
xor eax, eax
mov cl, byte [eax + 0x3be85c]
xor cl, 0x18
mov byte [eax + 0x3be9a0], cl
inc eax
cmp eax, 8
jb 0x312137
mov eax, 0x3be9a0
ret