joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaf7e56
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb7acca
call fcn.00b79c88
sub esp, 0x64
test byte [0xbb2c5c], 1
jne 0xaf7e83
or dword [0xbb2c5c], 1
mov word [0xbade04], 0x244c
mov byte [0xbade06], 0x69
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0xbade04]
xor cl, 0x69
mov byte [eax + 0xbae3fc], cl
inc eax
cmp eax, 3
jb 0xaf7e8a
mov esi, 0xbae3fc
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xaf7eb6
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00af4c72
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.00afd090
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00af4d08
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0xaf7efd
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.00b3f778
pop ecx
pop ecx
cmp eax, ebx
je 0xaf7f4e
cmp eax, 3
jne 0xaf7f3b
call fcn.00af8055
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00b539b5
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0xb9ec40
lea eax, [ebp - 0x1c]
push eax
call fcn.00b5d8c5
cmp eax, 4
jne 0xaf7f47
call fcn.00af8108
jmp 0xaf7f17
call fcn.00af81bb
jmp 0xaf7f17
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.00b411ae
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0xaf8005
push ebx
call fcn.00af823f
push eax
push 0xffffffffffffffff
push esi
call fcn.00b3ff0f
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00af4ce7
mov byte [ebp - 4], 3
cmp edi, 2
jne 0xaf7fbd
call fcn.00af8286
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.00afd101
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.00af5bec
jmp 0xaf7f2d
cmp edi, 4
jne 0xaf7fdc
call fcn.00af82e5
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.00afd101
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0xaf7fb0
cmp edi, 6
jne 0xaf7ffb
call fcn.00af834a
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.00afd101
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0xaf7fb0
call fcn.00af83ce
jmp 0xaf7f17
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.00b4056a
pop ecx
pop ecx
test eax, eax
je 0xaf8026
push ebx
push edi
push esi
call fcn.00b4072e
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.00b40364
sub edi, eax
push edi
push esi
call fcn.00b4037a
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00af4d08
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xaf8055
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c58], 1
jne 0xaf80ed
or dword [0xbb2c58], 1
mov dword [0xbade08], 0x500082f
mov dword [0xbade0c], 0x1d490d0c
mov dword [0xbade10], 0x1f0c4906
mov dword [0xbade14], 0x81c0508
mov dword [0xbade18], 0xb490c1d
mov dword [0xbade1c], 0x1a1d0606
mov dword [0xbade20], 0x19081b1d
mov dword [0xbade24], 0x81b0f49
mov dword [0xbade28], 0x70c040e
mov dword [0xbade2c], 0x1a49451d
mov dword [0xbade30], 0x81d0710
mov dword [0xbade34], 0x1b0c4911
mov dword [0xbade38], 0x691b061b
mov cl, byte [eax + 0xbade08]
xor cl, 0x69
mov byte [eax + 0xbae400], cl
inc eax
cmp eax, 0x34
jb 0xaf80ed
mov eax, 0xbae400
ret

Function at 0xaf8108
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c54], 1
jne 0xaf81a0
or dword [0xbb2c54], 1
mov dword [0xbade3c], 0x500082f
mov dword [0xbade40], 0x1d490d0c
mov dword [0xbade44], 0x1f0c4906
mov dword [0xbade48], 0x81c0508
mov dword [0xbade4c], 0xb490c1d
mov dword [0xbade50], 0x1a1d0606
mov dword [0xbade54], 0x19081b1d
mov dword [0xbade58], 0x81b0f49
mov dword [0xbade5c], 0x70c040e
mov dword [0xbade60], 0x449451d
mov dword [0xbade64], 0x1b06040c
mov dword [0xbade68], 0x1b0c4910
mov dword [0xbade6c], 0x691b061b
mov cl, byte [eax + 0xbade3c]
xor cl, 0x69
mov byte [eax + 0xbae434], cl
inc eax
cmp eax, 0x34
jb 0xaf81a0
mov eax, 0xbae434
ret

Function at 0xaf81bb
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c50], 1
jne 0xaf8224
or dword [0xbb2c50], 1
mov dword [0xbade70], 0x702073c
mov dword [0xbade74], 0x49071e06
mov dword [0xbade78], 0x61b1b0c
mov dword [0xbade7c], 0x700491b
mov dword [0xbade80], 0x81c0549
mov dword [0xbade84], 0x6053625
mov dword [0xbade88], 0x1d1a0d08
mov dword [0xbade8c], 0xe07001b
mov byte [0xbade90], 0x69
mov cl, byte [eax + 0xbade70]
xor cl, 0x69
mov byte [eax + 0xbae468], cl
inc eax
cmp eax, 0x21
jb 0xaf8224
mov eax, 0xbae468
ret

Function at 0xaf823f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c4c], 1
jne 0xaf8269
or dword [0xbb2c4c], 1
mov dword [0xbade94], 0x7060755
mov word [0xbade98], 0x570c
mov byte [0xbade9a], 0x69
xor eax, eax
mov cl, byte [eax + 0xbade94]
xor cl, 0x69
mov byte [eax + 0xbae48c], cl
inc eax
cmp eax, 7
jb 0xaf826b
mov eax, 0xbae48c
ret

Function at 0xaf8286
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c48], 1
jne 0xaf82ca
or dword [0xbb2c48], 1
mov dword [0xbade9c], 0x49081c25
mov dword [0xbadea0], 0x1d071c1b
mov dword [0xbadea4], 0x490c0400
mov dword [0xbadea8], 0x61b1b0c
mov dword [0xbadeac], 0x6949531b
mov cl, byte [eax + 0xbade9c]
xor cl, 0x69
mov byte [eax + 0xbae494], cl
inc eax
cmp eax, 0x14
jb 0xaf82ca
mov eax, 0xbae494
ret
Function at 0xaf82e5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c44], 1
jne 0xaf832d
or dword [0xbb2c44], 1
mov dword [0xbadeb0], 0x49081c25
mov dword [0xbadeb4], 0x6040c04
mov dword [0xbadeb8], 0xc49101b
mov dword [0xbadebc], 0x1b061b1b
mov word [0xbadec0], 0x4953
mov byte [0xbadec2], 0x69
xor eax, eax
mov cl, byte [eax + 0xbadeb0]
xor cl, 0x69
mov byte [eax + 0xbae4a8], cl
inc eax
cmp eax, 0x13
jb 0xaf832f
mov eax, 0xbae4a8
ret

Function at 0xaf834a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c40], 1
jne 0xaf83b3
or dword [0xbb2c40], 1
mov dword [0xbadec4], 0x49081c25
mov dword [0xbadec8], 0x61b1b0c
mov dword [0xbadecc], 0x700491b
mov dword [0xbaded0], 0xc0d001a
mov dword [0xbaded4], 0x1b1b0c49
mov dword [0xbaded8], 0x1491b06
mov dword [0xbadedc], 0x50d0708
mov dword [0xbadee0], 0x49531b0c
mov byte [0xbadee4], 0x69
mov cl, byte [eax + 0xbadec4]
xor cl, 0x69
mov byte [eax + 0xbae4bc], cl
inc eax
cmp eax, 0x21
jb 0xaf83b3
mov eax, 0xbae4bc
ret

Function at 0xaf83ce
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c3c], 1
jne 0xaf842c
or dword [0xbb2c3c], 1
mov dword [0xbadee8], 0x702073c
mov dword [0xbadeec], 0x49071e06
mov dword [0xbadef0], 0x61b1b0c
mov dword [0xbadef4], 0x700491b
mov dword [0xbadef8], 0x81c0549
mov dword [0xbadefc], 0x80a1936
mov word [0xbadf00], 0x505
mov byte [0xbadf02], 0x69
mov cl, byte [eax + 0xbadee8]
xor cl, 0x69
mov byte [eax + 0xbae4e0], cl
inc eax
cmp eax, 0x1b
jb 0xaf842c
mov eax, 0xbae4e0
ret

Function at 0xaf8668
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c38], 1
jne 0xaf86b3
or dword [0xbb2c38], 1
mov dword [0xbadf04], 0xc1a082b
mov dword [0xbadf08], 0xd495d5f
mov dword [0xbadf0c], 0xd060a0c
mov dword [0xbadf10], 0x80f490c
mov dword [0xbadf14], 0xd0c0500
mov byte [0xbadf18], 0x69
mov cl, byte [eax + 0xbadf04]
xor cl, 0x69
mov byte [eax + 0xbae4fc], cl
inc eax
cmp eax, 0x15
jb 0xaf86b3
mov eax, 0xbae4fc
ret
Function at 0xaf86ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xb7c9a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.00b1c7a7
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.00b1ab72
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.00af4e46
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.00afac58
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0xaf875b
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.00b1f7a5
add esp, 0x10
test al, al
jne 0xaf87a0
call fcn.00af8817
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00b539b5
push 0xb9ec40
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00b5d8c5
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.00afac58
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0xaf87e0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0xaf87bf
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.00afa0ad
lea esi, [esp + 0x20]
call fcn.00afac3f
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00af4d08
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xaf8817
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c34], 1
jne 0xaf8862
or dword [0xbb2c34], 1
mov dword [0xbadf1c], 0xc1a082b
mov dword [0xbadf20], 0xd495d5f
mov dword [0xbadf24], 0xd060a0c
mov dword [0xbadf28], 0x80f490c
mov dword [0xbadf2c], 0xd0c0500
mov byte [0xbadf30], 0x69
mov cl, byte [eax + 0xbadf1c]
xor cl, 0x69
mov byte [eax + 0xbae514], cl
inc eax
cmp eax, 0x15
jb 0xaf8862
mov eax, 0xbae514
ret

Function at 0xaf8f55
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c30], 1
jne 0xaf8faa
or dword [0xbb2c30], 1
mov dword [0xbadf34], 0x51c062a
mov dword [0xbadf38], 0x607490d
mov dword [0xbadf3c], 0x1906491d
mov dword [0xbadf40], 0xa49070c
mov dword [0xbadf44], 0x11a081b
mov dword [0xbadf48], 0x41c0d49
mov word [0xbadf4c], 0x6919
xor eax, eax
mov cl, byte [eax + 0xbadf34]
xor cl, 0x69
mov byte [eax + 0xbae52c], cl
inc eax
cmp eax, 0x1a
jb 0xaf8fac
mov eax, 0xbae52c
ret
Function at 0xaf8fc7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c28], 1
jne 0xaf8fea
or dword [0xbb2c28], 1
mov dword [0xbadf54], 0xe060546
mov word [0xbadf58], 0x6946
xor eax, eax
mov cl, byte [eax + 0xbadf54]
xor cl, 0x69
mov byte [eax + 0xbae54c], cl
inc eax
cmp eax, 6
jb 0xaf8fec
mov eax, 0xbae54c
ret

Function at 0xaf9007
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c24], 1
jne 0xaf9084
or dword [0xbb2c24], 1
mov dword [0xbadf5c], 0x191d1d01
mov dword [0xbadf60], 0x8464653
mov dword [0xbadf64], 0x10050807
mov dword [0xbadf68], 0x1a0a001d
mov dword [0xbadf6c], 0x1d0c0e47
mov dword [0xbadf70], 0x71e060d
mov dword [0xbadf74], 0x1d1a0c1d
mov dword [0xbadf78], 0x4060a47
mov dword [0xbadf7c], 0x465b1f46
mov dword [0xbadf80], 0x460e0605
mov byte [0xbadf84], 0x69
mov cl, byte [eax + 0xbadf5c]
xor cl, 0x69
mov byte [eax + 0xbae554], cl
inc eax
cmp eax, 0x29
jb 0xaf9084
mov eax, 0xbae554
ret

Function at 0xaf909f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c20], 1
jne 0xaf90ca
or dword [0xbb2c20], 1
mov dword [0xbadf88], 0x1a4f540a
mov dword [0xbadf8c], 0x541d4f54
mov byte [0xbadf90], 0x69
xor eax, eax
mov cl, byte [eax + 0xbadf88]
xor cl, 0x69
mov byte [eax + 0xbae580], cl
inc eax
cmp eax, 9
jb 0xaf90cc
mov eax, 0xbae580
ret

Function at 0xaf90e7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c10], 1
jne 0xaf9171
or dword [0xbb2c10], 1
mov dword [0xbadfa4], 0x1d07062a
mov dword [0xbadfa8], 0x441d070c
mov dword [0xbadfac], 0xc19103d
mov dword [0xbadfb0], 0x19084953
mov dword [0xbadfb4], 0xa000519
mov dword [0xbadfb8], 0x6001d08
mov dword [0xbadfbc], 0x44114607
mov dword [0xbadfc0], 0x441e1e1e
mov dword [0xbadfc4], 0x41b060f
mov dword [0xbadfc8], 0x51b1c44
mov dword [0xbadfcc], 0x60a070c
mov dword [0xbadfd0], 0x690d0c0d
mov cl, byte [eax + 0xbadfa4]
xor cl, 0x69
mov byte [eax + 0xbae59c], cl
inc eax
cmp eax, 0x30
jb 0xaf9171
mov eax, 0xbae59c
ret

Function at 0xaf918c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c0c], 1
jne 0xaf91b7
or dword [0xbb2c0c], 1
mov dword [0xbadfd4], 0x3d3a2639
mov dword [0xbadfd8], 0x49061d49
mov byte [0xbadfdc], 0x69
xor eax, eax
mov cl, byte [eax + 0xbadfd4]
xor cl, 0x69
mov byte [eax + 0xbae5cc], cl
inc eax
cmp eax, 9
jb 0xaf91b9
mov eax, 0xbae5cc
ret

Function at 0xaf91d4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2c08], 1
jne 0xaf921f
or dword [0xbb2c08], 1
mov dword [0xbadfe0], 0x80f49
mov dword [0xbadfe4], 0x490d0c05
mov dword [0xbadfe8], 0x11d001e
mov dword [0xbadfec], 0x81d1a49
mov dword [0xbadff0], 0x491a1c1d
mov byte [0xbadff4], 0x69
mov cl, byte [eax + 0xbadfe0]
xor cl, 0x69
mov byte [eax + 0xbae5d8], cl
inc eax
cmp eax, 0x15
jb 0xaf921f
mov eax, 0xbae5d8
ret
Function at 0xaf9254
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb7b218
call fcn.00b79c88
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0xaf9405
cmp dword [ebp + 0x10], ebx
je 0xaf9405
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.00afa5a0
push eax
push 0xb9cb68
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.00af549c
push 0xb9cb64
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00af54d2
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.00af4e46
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00af4e46
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0xaf9360
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.00afa5a0
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.00afa5c2
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0xaf9314
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.00afe0b6
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.00af4e46
inc bl
jne 0xaf93cc
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.00af4e46
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0xaf92db
test byte [0xbb2c00], 1
jne 0xaf938d
or dword [0xbb2c00], 1
mov dword [0xbae004], 0x491d0627
mov dword [0xbae008], 0x71c060f
mov word [0xbae00c], 0x690d
xor eax, eax
mov cl, byte [eax + 0xbae004]
xor cl, 0x69
mov byte [eax + 0xbae5fc], cl
inc eax
cmp eax, 0xa
jb 0xaf938f
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0xbae5fc
call fcn.00b539b5
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0xb9ec40
lea eax, [ebp - 0x44]
push eax
call fcn.00b5d8c5
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.00afa5c2
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.00af4e46
push 1
lea esi, [ebp - 0x2c]
call fcn.00af4e46
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.00af942a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.00b539b5
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0xb9ec40
lea eax, [ebp - 0x38]
jmp 0xaf93c6

Function at 0xaf942a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2c04], 1
jne 0xaf9457
or dword [0xbb2c04], 1
mov dword [0xbadff8], 0x491d0627
mov dword [0xbadffc], 0x71c060f
mov word [0xbae000], 0x690d
xor eax, eax
mov cl, byte [eax + 0xbadff8]
xor cl, 0x69
mov byte [eax + 0xbae5f0], cl
inc eax
cmp eax, 0xa
jb 0xaf9459
mov eax, 0xbae5f0
ret
Function at 0xaf9c0e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2bfc], 1
mov ecx, 0xd869
jne 0xaf9c98
or dword [0xbb2bfc], 1
lea eax, [ecx - 0x5f]
mov word [0xbae010], ax
add eax, 0x11
mov edx, eax
mov word [0xbae012], dx
lea edx, [ecx - 0x61]
mov word [0xbae014], dx
add edx, 0x12
mov word [0xbae016], dx
lea edx, [ecx - 0x68]
mov word [0xbae018], dx
add edx, 0x35
mov word [0xbae01a], dx
mov edx, eax
mov word [0xbae01c], dx
lea edx, [ecx - 0x5d]
lea eax, [ecx - 0x4c]
mov word [0xbae01e], dx
mov word [0xbae026], ax
add edx, 0xd
mov eax, ecx
mov word [0xbae020], dx
mov dword [0xbae022], 0xd81bd806
mov word [0xbae028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbae010]
add eax, 2
mov word [eax + 0xbae606], dx
cmp eax, 0x1a
jb 0xaf9c9a
mov eax, 0xbae608
ret

Function at 0xaf9cb8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2bf8], 1
jne 0xaf9ce3
or dword [0xbb2bf8], 1
mov dword [0xbae02c], 0x71b0c02
mov dword [0xbae030], 0x5b5a050c
mov byte [0xbae034], 0x69
xor eax, eax
mov cl, byte [eax + 0xbae02c]
xor cl, 0x69
mov byte [eax + 0xbae624], cl
inc eax
cmp eax, 9
jb 0xaf9ce5
mov eax, 0xbae624
ret

Function at 0xaf9d00
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2bf4], 1
jne 0xaf9d6b
or dword [0xbb2bf4], 1
mov dword [0xbae038], 0x391d0c3a
mov dword [0xbae03c], 0xc0a061b
mov dword [0xbae040], 0x1a3c1a1a
mov dword [0xbae044], 0x6241b0c
mov dword [0xbae048], 0x112c0c0d
mov dword [0xbae04c], 0x1d190c0a
mov dword [0xbae050], 0x39070600
mov dword [0xbae054], 0xa000506
mov word [0xbae058], 0x6910
mov cl, byte [eax + 0xbae038]
xor cl, 0x69
mov byte [eax + 0xbae630], cl
inc eax
cmp eax, 0x22
jb 0xaf9d6b
mov eax, 0xbae630
ret

Function at 0xaf9d86
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2bf0], 1
jne 0xaf9df1
or dword [0xbb2bf0], 1
mov dword [0xbae05c], 0x391d0c2e
mov dword [0xbae060], 0xc0a061b
mov dword [0xbae064], 0x1a3c1a1a
mov dword [0xbae068], 0x6241b0c
mov dword [0xbae06c], 0x112c0c0d
mov dword [0xbae070], 0x1d190c0a
mov dword [0xbae074], 0x39070600
mov dword [0xbae078], 0xa000506
mov word [0xbae07c], 0x6910
mov cl, byte [eax + 0xbae05c]
xor cl, 0x69
mov byte [eax + 0xbae654], cl
inc eax
cmp eax, 0x22
jb 0xaf9df1
mov eax, 0xbae654
ret

Function at 0xaf9e0c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2bec], 1
jne 0xaf9e64
or dword [0xbb2bec], 1
mov dword [0xbae080], 0x490c0526
mov dword [0xbae084], 0x1d000700
mov dword [0xbae088], 0x50800
mov dword [0xbae08c], 0x1d0813
mov dword [0xbae090], 0xf490706
mov dword [0xbae094], 0xc050008
mov dword [0xbae098], 0x6949530d
mov cl, byte [eax + 0xbae080]
xor cl, 0x69
mov byte [eax + 0xbae678], cl
inc eax
cmp eax, 0x1c
jb 0xaf9e64
mov eax, 0xbae678
ret

Function at 0xaf9e7f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2be8], 1
mov ecx, 0xd869
jne 0xaf9eae
or dword [0xbb2be8], 1
lea eax, [ecx - 0x61]
mov word [0xbae09c], ax
add eax, 0x53
mov word [0xbae09e], ax
mov eax, ecx
mov word [0xbae0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbae09c]
add eax, 2
mov word [eax + 0xbae692], dx
cmp eax, 6
jb 0xaf9eb0
mov eax, 0xbae694
ret
Function at 0xaf9ece
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2be0], 1
jne 0xaf9f40
or dword [0xbb2be0], 1
mov dword [0xbae0ac], 0x500082f
mov dword [0xbae0b0], 0x1d490d0c
mov dword [0xbae0b4], 0x7004906
mov dword [0xbae0b8], 0x8001d00
mov dword [0xbae0bc], 0xc130005
mov dword [0xbae0c0], 0x1f070c49
mov dword [0xbae0c4], 0x7061b00
mov dword [0xbae0c8], 0x1d070c04
mov word [0xbae0cc], 0x4953
mov byte [0xbae0ce], 0x69
mov cl, byte [eax + 0xbae0ac]
xor cl, 0x69
mov byte [eax + 0xbae6a4], cl
inc eax
cmp eax, 0x23
jb 0xaf9f40
mov eax, 0xbae6a4
ret

Function at 0xaf9f5b
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2bd8], 1
jne 0xaf9fa8
or dword [0xbb2bd8], 1
mov dword [0xbae0d8], 0x801073c
mov dword [0xbae0dc], 0xc050d07
mov dword [0xbae0e0], 0x110c490d
mov dword [0xbae0e4], 0x1d190c0a
mov dword [0xbae0e8], 0x53070600
mov word [0xbae0ec], 0x6949
mov cl, byte [eax + 0xbae0d8]
xor cl, 0x69
mov byte [eax + 0xbae6d0], cl
inc eax
cmp eax, 0x16
jb 0xaf9fa8
mov eax, 0xbae6d0
ret

Function at 0xaf9fc4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2bd4], 1
jne 0xafa019
or dword [0xbb2bd4], 1
mov dword [0xbae0f0], 0x801073c
mov dword [0xbae0f4], 0xc050d07
mov dword [0xbae0f8], 0x110c490d
mov dword [0xbae0fc], 0x1d190c0a
mov dword [0xbae100], 0x53070600
mov dword [0xbae104], 0x631a4c49
mov byte [0xbae108], 0x69
mov cl, byte [eax + 0xbae0f0]
xor cl, 0x69
mov byte [eax + 0xbae6e8], cl
inc eax
cmp eax, 0x19
jb 0xafa019
mov eax, 0xbae6e8
ret

Function at 0xafa034
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2bd0], 1
jne 0xafa06e
or dword [0xbb2bd0], 1
mov dword [0xbae10c], 0xb1c1d3a
mov dword [0xbae110], 0x110c49
mov dword [0xbae114], 0x4c41491d
mov dword [0xbae118], 0x6963400d
mov cl, byte [eax + 0xbae10c]
xor cl, 0x69
mov byte [eax + 0xbae704], cl
inc eax
cmp eax, 0x10
jb 0xafa06e
mov eax, 0xbae704
ret
Function at 0xafba89
Capabilities:
Write file on windows

Disassembly:
mov eax, 0xb7af4d
call fcn.00b79c88
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0xafbb6d
cmp byte [edi + 0x49], bl
je 0xafbb6d
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0xafbac0
xor al, al
jmp 0xafbb6f
push esi
lea esi, [ebp - 0x2c]
call fcn.00afb582
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xafbb10
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0xafbb15
dec eax
je 0xafbb19
dec eax
dec eax
je 0xafbb69
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00af4d08
mov al, bl
pop esi
jmp 0xafbb6f
mov edx, dword [ebp - 0x2c]
jmp 0xafbada
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xafbb25
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0xafbb4b
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xafbb38
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.00b5578e
add esp, 0x10
cmp esi, eax
jne 0xafbafd
cmp byte [edi + 0x49], 0
je 0xafbb69
test esi, esi
jne 0xafbacc
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.00afb65b
jmp 0xafbacc
mov bl, 1
jmp 0xafbaff
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0xb003f0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2bcc], 1
jne 0xb00464
or dword [0xbb2bcc], 1
mov dword [0xbae724], 0x61f0529
mov dword [0xbae728], 0x5044a0e
mov dword [0xbae72c], 0xf0d4a1e
mov dword [0xbae730], 0x30e4a1e
mov dword [0xbae734], 0xe031a19
mov dword [0xbae738], 0x4a0c054a
mov dword [0xbae73c], 0x21e0f07
mov dword [0xbae740], 0x4d4a0e05
mov dword [0xbae744], 0x6060b09
mov dword [0xbae748], 0x6a4a504d
xor eax, eax
mov cl, byte [eax + 0xbae724]
xor cl, 0x6a
mov byte [eax + 0xbae868], cl
inc eax
cmp eax, 0x28
jb 0xb00466
mov eax, 0xbae868
ret

Function at 0xb00481
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2bc8], 1
jne 0xb004e8
or dword [0xbb2bc8], 1
mov dword [0xbae74c], 0x6030b2c
mov dword [0xbae750], 0x1e4a0e0f
mov dword [0xbae754], 0x4034a05
mov dword [0xbae758], 0xf01051c
mov dword [0xbae75c], 0x1e0f074a
mov dword [0xbae760], 0x4a0e0502
mov dword [0xbae764], 0x60b094d
mov dword [0xbae768], 0x4a504d06
mov byte [0xbae76c], 0x6a
xor eax, eax
mov cl, byte [eax + 0xbae74c]
xor cl, 0x6a
mov byte [eax + 0xbae890], cl
inc eax
cmp eax, 0x21
jb 0xb004ea
mov eax, 0xbae890
ret