joyce8/EMBER2024-capa huggingface dataset:
Function at 0x89465f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8fdd9c
call fcn.008fcc58
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x9060a8]
test byte [0x937e0c], 1
mov edi, eax
jne 0x8946ac
or dword [0x937e0c], 1
mov dword [0x936154], 0xa8afa8b6
mov dword [0x936158], 0xefb5a4af
mov dword [0x93615c], 0xc1adada5
xor ecx, ecx
mov al, byte [ecx + 0x936154]
xor al, 0xc1
mov byte [ecx + 0x93640c], al
inc ecx
cmp ecx, 0xc
jb 0x8946ae
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x93640c
call dword [0x9060dc]
push eax
push 0x1b00
call dword [0x906134]
test eax, eax
jne 0x8946fa
call fcn.00894770
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0087ebe9
pop ecx
pop ecx
jmp 0x89475f
test byte [0x937e04], 1
jne 0x89471a
or dword [0x937e04], 1
mov word [0x93617c], 0xe1fb
mov byte [0x93617e], 0xc1
xor eax, eax
mov cl, byte [eax + 0x93617c]
xor cl, 0xc1
mov byte [eax + 0x936434], cl
inc eax
cmp eax, 3
jb 0x89471c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x936434
push eax
call fcn.0087ebe9
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0087ef9c
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00874c70
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x894770
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937e08], 1
jne 0x8947c5
or dword [0x937e08], 1
mov dword [0x936160], 0xa087e9e1
mov dword [0x936164], 0xa5a4ada8
mov dword [0x936168], 0xe1aeb5e1
mov dword [0x93616c], 0xacb3aea7
mov dword [0x936170], 0xa4e1b5a0
mov dword [0x936174], 0xb3aeb3b3
mov word [0x936178], 0xc1e8
xor eax, eax
mov cl, byte [eax + 0x936160]
xor cl, 0xc1
mov byte [eax + 0x936418], cl
inc eax
cmp eax, 0x1a
jb 0x8947c7
mov eax, 0x936418
ret

Function at 0x894930
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937e00], 1
jne 0x894979
or dword [0x937e00], 1
mov dword [0x936180], 0x89afa896
mov dword [0x936184], 0x8eb1b5b5
mov dword [0x936188], 0xe9afa4b1
mov dword [0x93618c], 0xa0a7e1e8
mov dword [0x936190], 0xa5a4ada8
mov byte [0x936194], 0xc1
xor eax, eax
mov cl, byte [eax + 0x936180]
xor cl, 0xc1
mov byte [eax + 0x936438], cl
inc eax
cmp eax, 0x15
jb 0x89497b
mov eax, 0x936438
ret

Function at 0x894c40
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dfc], 1
jne 0x894c93
or dword [0x937dfc], 1
mov dword [0x936198], 0x89afa896
mov dword [0x93619c], 0x82b1b5b5
mov dword [0x9361a0], 0xaaa2a0b3
mov dword [0x9361a4], 0xe9adb394
mov dword [0x9361a8], 0xa0a7e1e8
mov dword [0x9361ac], 0xa5a4ada8
mov byte [0x9361b0], 0xc1
xor eax, eax
mov cl, byte [eax + 0x936198]
xor cl, 0xc1
mov byte [eax + 0x936450], cl
inc eax
cmp eax, 0x19
jb 0x894c95
mov eax, 0x936450
ret
Function at 0x894cb0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937df8], 1
jne 0x894cfc
or dword [0x937df8], 1
mov dword [0x9361b4], 0x89afa896
mov dword [0x9361b8], 0x82b1b5b5
mov dword [0x9361bc], 0xa4afafae
mov dword [0x9361c0], 0xe8e9b5a2
mov dword [0x9361c4], 0xa8a0a7e1
mov dword [0x9361c8], 0xc1a5a4ad
xor eax, eax
mov cl, byte [eax + 0x9361b4]
xor cl, 0xc1
mov byte [eax + 0x93646c], cl
inc eax
cmp eax, 0x18
jb 0x894cfe
mov eax, 0x93646c
ret

Function at 0x895655
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937df4], 1
jne 0x89572e
or dword [0x937df4], 1
mov dword [0x9361d0], 0xb4b0a493
mov dword [0x9361d4], 0xe1b5b2a4
mov dword [0x9361d8], 0xe1adb3b4
mov dword [0x9361dc], 0xa5a4b2b4
mov dword [0x9361e0], 0xa5e1a0e1
mov dword [0x9361e4], 0xa4a7a7a8
mov dword [0x9361e8], 0xb5afa4b3
mov dword [0x9361ec], 0xa9a2b2e1
mov dword [0x9361f0], 0xe1a4aca4
mov dword [0x9361f4], 0xafa0a9b5
mov dword [0x9361f8], 0xa4a9b5e1
mov dword [0x9361fc], 0xafaea2e1
mov dword [0x936200], 0xb5a2a4af
mov dword [0x936204], 0xe1afaea8
mov dword [0x936208], 0xe1b2a0b6
mov dword [0x93620c], 0xb5a8afa8
mov dword [0x936210], 0xa8ada0a8
mov dword [0x936214], 0xe1a5a4bb
mov dword [0x936218], 0xa9b5a8b6
mov byte [0x93621c], 0xc1
xor eax, eax
mov cl, byte [eax + 0x9361d0]
xor cl, 0xc1
mov byte [eax + 0x936488], cl
inc eax
cmp eax, 0x4d
jb 0x895730
mov eax, 0x936488
ret

Function at 0x89574b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937df0], 1
jne 0x895827
or dword [0x937df0], 1
mov dword [0x936220], 0xb4b0a493
mov dword [0x936224], 0xe1b5b2a4
mov dword [0x936228], 0xe1adb3b4
mov dword [0x93622c], 0xa5a4b2b4
mov dword [0x936230], 0xa5e1a0e1
mov dword [0x936234], 0xa4a7a7a8
mov dword [0x936238], 0xb5afa4b3
mov dword [0x93623c], 0xb2aea9e1
mov dword [0x936240], 0xa0afe1b5
mov dword [0x936244], 0xb5e1a4ac
mov dword [0x936248], 0xe1afa0a9
mov dword [0x93624c], 0xe1a4a9b5
mov dword [0x936250], 0xafafaea2
mov dword [0x936254], 0xa8b5a2a4
mov dword [0x936258], 0xb6e1afae
mov dword [0x93625c], 0xa8e1b2a0
mov dword [0x936260], 0xa8b5a8af
mov dword [0x936264], 0xbba8ada0
mov dword [0x936268], 0xb6e1a5a4
mov dword [0x93626c], 0xc1a9b5a8
xor eax, eax
mov cl, byte [eax + 0x936220]
xor cl, 0xc1
mov byte [eax + 0x9364d8], cl
inc eax
cmp eax, 0x50
jb 0x895829
mov eax, 0x9364d8
ret
Function at 0x895844
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dec], 1
jne 0x89591c
or dword [0x937dec], 1
mov dword [0x936270], 0xb4b0a493
mov dword [0x936274], 0xe1b5b2a4
mov dword [0x936278], 0xe1adb3b4
mov dword [0x93627c], 0xa5a4b2b4
mov dword [0x936280], 0xa5e1a0e1
mov dword [0x936284], 0xa4a7a7a8
mov dword [0x936288], 0xb5afa4b3
mov dword [0x93628c], 0xb3aeb1e1
mov dword [0x936290], 0xa9b5e1b5
mov dword [0x936294], 0xb5e1afa0
mov dword [0x936298], 0xa2e1a4a9
mov dword [0x93629c], 0xa4afafae
mov dword [0x9362a0], 0xaea8b5a2
mov dword [0x9362a4], 0xa0b6e1af
mov dword [0x9362a8], 0xafa8e1b2
mov dword [0x9362ac], 0xa0a8b5a8
mov dword [0x9362b0], 0xa4bba8ad
mov dword [0x9362b4], 0xa8b6e1a5
mov word [0x9362b8], 0xa9b5
mov byte [0x9362ba], 0xc1
xor eax, eax
mov cl, byte [eax + 0x936270]
xor cl, 0xc1
mov byte [eax + 0x936528], cl
inc eax
cmp eax, 0x4b
jb 0x89591e
mov eax, 0x936528
ret

Function at 0x895939
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937de8], 1
jne 0x89598f
or dword [0x937de8], 1
mov dword [0x9362bc], 0x89afa896
mov dword [0x9362c0], 0x8eb1b5b5
mov dword [0x9362c4], 0x93afa4b1
mov dword [0x9362c8], 0xa4b4b0a4
mov dword [0x9362cc], 0xe8e9b5b2
mov dword [0x9362d0], 0xa8a0a7e1
mov dword [0x9362d4], 0xc1a5a4ad
xor eax, eax
mov cl, byte [eax + 0x9362bc]
xor cl, 0xc1
mov byte [eax + 0x936574], cl
inc eax
cmp eax, 0x1c
jb 0x895991
mov eax, 0x936574
ret

Function at 0x8959ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937de4], 1
jne 0x895a7b
or dword [0x937de4], 1
mov dword [0x9362d8], 0x89afa896
mov dword [0x9362dc], 0x92b1b5b5
mov dword [0x9362e0], 0xb18eb5a4
mov dword [0x9362e4], 0xafaea8b5
mov dword [0x9362e8], 0x8f8896e9
mov dword [0x9362ec], 0x91959589
mov dword [0x9362f0], 0x95918e9e
mov dword [0x9362f4], 0x9e8f8e88
mov dword [0x9362f8], 0x94828492
mov dword [0x9362fc], 0x98958893
mov dword [0x936300], 0x808d879e
mov dword [0x936304], 0xe1e89286
mov dword [0x936308], 0xb3e1afae
mov dword [0x93630c], 0xa4b4b0a4
mov dword [0x936310], 0xa9e1b5b2
mov dword [0x936314], 0xada5afa0
mov dword [0x936318], 0xa0a7e1a4
mov dword [0x93631c], 0xa5a4ada8
mov byte [0x936320], 0xc1
xor eax, eax
mov cl, byte [eax + 0x9362d8]
xor cl, 0xc1
mov byte [eax + 0x936590], cl
inc eax
cmp eax, 0x49
jb 0x895a7d
mov eax, 0x936590
ret
Function at 0x895a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937de0], 1
jne 0x895b66
or dword [0x937de0], 1
mov dword [0x936328], 0x89afa896
mov dword [0x93632c], 0x92b1b5b5
mov dword [0x936330], 0xb18eb5a4
mov dword [0x936334], 0xafaea8b5
mov dword [0x936338], 0x8f8896e9
mov dword [0x93633c], 0x91959589
mov dword [0x936340], 0x95918e9e
mov dword [0x936344], 0x9e8f8e88
mov dword [0x936348], 0x858f8492
mov dword [0x93634c], 0x8c88959e
mov dword [0x936350], 0x95948e84
mov dword [0x936354], 0xafaee1e8
mov dword [0x936358], 0xb0a4b3e1
mov dword [0x93635c], 0xb5b2a4b4
mov dword [0x936360], 0xafa0a9e1
mov dword [0x936364], 0xe1a4ada5
mov dword [0x936368], 0xada8a0a7
mov word [0x93636c], 0xa5a4
mov byte [0x93636e], 0xc1
xor eax, eax
mov cl, byte [eax + 0x936328]
xor cl, 0xc1
mov byte [eax + 0x9365e0], cl
inc eax
cmp eax, 0x47
jb 0x895b68
mov eax, 0x9365e0
ret

Function at 0x895b83
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937ddc], 1
jne 0x895bec
or dword [0x937ddc], 1
mov dword [0x936370], 0x89afa896
mov dword [0x936374], 0x80b1b5b5
mov dword [0x936378], 0xa493a5a5
mov dword [0x93637c], 0xb2a4b4b0
mov dword [0x936380], 0xa0a489b5
mov dword [0x936384], 0xb2b3a4a5
mov dword [0x936388], 0xa7e1e8e9
mov dword [0x93638c], 0xa4ada8a0
mov word [0x936390], 0xc1a5
xor eax, eax
mov cl, byte [eax + 0x936370]
xor cl, 0xc1
mov byte [eax + 0x936628], cl
inc eax
cmp eax, 0x22
jb 0x895bee
mov eax, 0x936628
ret

Function at 0x895c09
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dd8], 1
jne 0x895c5c
or dword [0x937dd8], 1
mov dword [0x936394], 0xb1b5b589
mov dword [0x936398], 0xa5afa492
mov dword [0x93639c], 0xb4b0a493
mov dword [0x9363a0], 0xe9b5b2a4
mov dword [0x9363a4], 0xa0a7e1e8
mov dword [0x9363a8], 0xa5a4ada8
mov byte [0x9363ac], 0xc1
xor eax, eax
mov cl, byte [eax + 0x936394]
xor cl, 0xc1
mov byte [eax + 0x93664c], cl
inc eax
cmp eax, 0x19
jb 0x895c5e
mov eax, 0x93664c
ret

Function at 0x895c79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dd4], 1
jne 0x895ccb
or dword [0x937dd4], 1
mov dword [0x9363b0], 0xb1b5b589
mov dword [0x9363b4], 0xb3a4b490
mov dword [0x9363b8], 0xa7af88b8
mov dword [0x9363bc], 0xe1e8e9ae
mov dword [0x9363c0], 0xada8a0a7
mov word [0x9363c4], 0xa5a4
mov byte [0x9363c6], 0xc1
xor eax, eax
mov cl, byte [eax + 0x9363b0]
xor cl, 0xc1
mov byte [eax + 0x936668], cl
inc eax
cmp eax, 0x17
jb 0x895ccd
mov eax, 0x936668
ret
Function at 0x8964b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dcc], 1
jne 0x896522
or dword [0x937dcc], 1
mov dword [0x9363cc], 0x89afa896
mov dword [0x9363d0], 0x90b1b5b5
mov dword [0x9363d4], 0xb8b3a4b4
mov dword [0x9363d8], 0xa0b5a085
mov dword [0x9363dc], 0xa8a0b780
mov dword [0x9363e0], 0xada3a0ad
mov dword [0x9363e4], 0xe1e8e9a4
mov dword [0x9363e8], 0xada8a0a7
mov word [0x9363ec], 0xa5a4
mov byte [0x9363ee], 0xc1
xor eax, eax
mov cl, byte [eax + 0x9363cc]
xor cl, 0xc1
mov byte [eax + 0x936684], cl
inc eax
cmp eax, 0x23
jb 0x896524
mov eax, 0x936684
ret

Function at 0x89653f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dc8], 1
jne 0x896594
or dword [0x937dc8], 1
mov dword [0x9363f0], 0xa4b5af88
mov dword [0x9363f4], 0xb5a4afb3
mov dword [0x9363f8], 0xa5a0a493
mov dword [0x9363fc], 0xa4ada887
mov dword [0x936400], 0xa7e1e8e9
mov dword [0x936404], 0xa4ada8a0
mov word [0x936408], 0xc1a5
xor eax, eax
mov cl, byte [eax + 0x9363f0]
xor cl, 0xc1
mov byte [eax + 0x9366a8], cl
inc eax
cmp eax, 0x1a
jb 0x896596
mov eax, 0x9366a8
ret

Function at 0x89733b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937dac], 1
jne 0x8973c2
or dword [0x937dac], 1
mov dword [0x9366e0], 0xb7e2ac83
mov dword [0x9366e4], 0xa1a7b0ac
mov dword [0x9366e8], 0xabaca5ad
mov dword [0x9366ec], 0xe2a6a7b8
mov dword [0x9366f0], 0xa7a9adb6
mov dword [0x9366f4], 0xa3b5e2ac
mov dword [0x9366f8], 0xada4e2b1
mov dword [0x9366fc], 0xe2a6acb7
mov dword [0x936700], 0xa1e2b6a3
mov dword [0x936704], 0xa3b0a3aa
mov dword [0x936708], 0xb0a7b6a1
mov word [0x93670c], 0xc2e2
xor eax, eax
mov cl, byte [eax + 0x9366e0]
xor cl, 0xc2
mov byte [eax + 0x936830], cl
inc eax
cmp eax, 0x2e
jb 0x8973c4
mov eax, 0x936830
ret
Function at 0x897808
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937da8], 1
jne 0x897864
or dword [0x937da8], 1
mov dword [0x936710], 0xb1b1ab8f
mov dword [0x936714], 0xe2a5acab
mov dword [0x936718], 0xa7aee2a3
mov dword [0x93671c], 0xb2e2b6a4
mov dword [0x936720], 0xaca7b0a3
mov dword [0x936724], 0xb1a7aab6
mov word [0x936728], 0xb1ab
mov byte [0x93672a], 0xc2
xor eax, eax
mov cl, byte [eax + 0x936710]
xor cl, 0xc2
mov byte [eax + 0x936860], cl
inc eax
cmp eax, 0x1b
jb 0x897866
mov eax, 0x936860
ret

Function at 0x897881
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937da4], 1
jne 0x8978ea
or dword [0x937da4], 1
mov dword [0x93672c], 0xe2b6ad8c
mov dword [0x936730], 0xb7adaca7
mov dword [0x936734], 0xade2aaa5
mov dword [0x936738], 0xa3b0a7b2
mov dword [0x93673c], 0xe2b1a6ac
mov dword [0x936740], 0xa7e2acab
mov dword [0x936744], 0xa7b0b2ba
mov dword [0x936748], 0xadabb1b1
mov word [0x93674c], 0xc2ac
xor eax, eax
mov cl, byte [eax + 0x93672c]
xor cl, 0xc2
mov byte [eax + 0x93687c], cl
inc eax
cmp eax, 0x22
jb 0x8978ec
mov eax, 0x93687c
ret

Function at 0x897907
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937da0], 1
jne 0x897967
or dword [0x937da0], 1
mov dword [0x936750], 0xe2adad96
mov dword [0x936754], 0xbbaca3af
mov dword [0x936758], 0xa7b2ade2
mov dword [0x93675c], 0xa6aca3b0
mov dword [0x936760], 0xacabe2b1
mov dword [0x936764], 0xb2baa7e2
mov dword [0x936768], 0xb1b1a7b0
mov dword [0x93676c], 0xc2acadab
xor eax, eax
mov cl, byte [eax + 0x936750]
xor cl, 0xc2
mov byte [eax + 0x9368a0], cl
inc eax
cmp eax, 0x20
jb 0x897969
mov eax, 0x9368a0
ret

Function at 0x897984
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d9c], 1
jne 0x8979da
or dword [0x937d9c], 1
mov dword [0x936770], 0xb1b1ab8f
mov dword [0x936774], 0xe2a5acab
mov dword [0x936778], 0xabb0e2a3
mov dword [0x93677c], 0xe2b6aaa5
mov dword [0x936780], 0xa7b0a3b2
mov dword [0x936784], 0xa7aab6ac
mov dword [0x936788], 0xc2b1abb1
xor eax, eax
mov cl, byte [eax + 0x936770]
xor cl, 0xc2
mov byte [eax + 0x9368c0], cl
inc eax
cmp eax, 0x1c
jb 0x8979dc
mov eax, 0x9368c0
ret

Function at 0x8979f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d98], 1
jne 0x897a68
or dword [0x937d98], 1
mov dword [0x93678c], 0xb0a3ac97
mov dword [0x936790], 0xb2ade2bb
mov dword [0x936794], 0xb6a3b0a7
mov dword [0x936798], 0xafe2b0ad
mov dword [0x93679c], 0xe2b6b1b7
mov dword [0x9367a0], 0xa7b4a3aa
mov dword [0x9367a4], 0xa7acade2
mov dword [0x9367a8], 0xa7b2ade2
mov dword [0x9367ac], 0xa6aca3b0
mov byte [0x9367b0], 0xc2
xor eax, eax
mov cl, byte [eax + 0x93678c]
xor cl, 0xc2
mov byte [eax + 0x9368dc], cl
inc eax
cmp eax, 0x25
jb 0x897a6a
mov eax, 0x9368dc
ret
Function at 0x897a85
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d94], 1
jne 0x897aff
or dword [0x937d94], 1
mov dword [0x9367b4], 0xa3acab80
mov dword [0x9367b8], 0xade2bbb0
mov dword [0x9367bc], 0xa3b0a7b2
mov dword [0x9367c0], 0xe2b0adb6
mov dword [0x9367c4], 0xb6b1b7af
mov dword [0x9367c8], 0xb4a3aae2
mov dword [0x9367cc], 0xb5b6e2a7
mov dword [0x9367d0], 0xb2ade2ad
mov dword [0x9367d4], 0xaca3b0a7
mov word [0x9367d8], 0xb1a6
mov byte [0x9367da], 0xc2
xor eax, eax
mov cl, byte [eax + 0x9367b4]
xor cl, 0xc2
mov byte [eax + 0x936904], cl
inc eax
cmp eax, 0x27
jb 0x897b01
mov eax, 0x936904
ret

Function at 0x897b1c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d90], 1
jne 0x897b85
or dword [0x937d90], 1
mov dword [0x9367dc], 0xa3acab80
mov dword [0x9367e0], 0xade2bbb0
mov dword [0x9367e4], 0xa3b0a7b2
mov dword [0x9367e8], 0xe2b0adb6
mov dword [0x9367ec], 0xe2b6adac
mov dword [0x9367f0], 0xaeb2afab
mov dword [0x9367f4], 0xaca7afa7
mov dword [0x9367f8], 0xf8a6a7b6
mov word [0x9367fc], 0xc2e2
xor eax, eax
mov cl, byte [eax + 0x9367dc]
xor cl, 0xc2
mov byte [eax + 0x93692c], cl
inc eax
cmp eax, 0x22
jb 0x897b87
mov eax, 0x93692c
ret

Function at 0x898abb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d80], 1
mov edx, 0xdcc4
jne 0x898b4d
or dword [0x937d80], 1
lea ecx, [edx + 0x1d]
push esi
mov eax, ecx
mov word [0x93698c], ax
add eax, 0xffffffb6
mov esi, eax
mov word [0x93698e], si
lea eax, [edx - 0x34]
mov word [0x936994], ax
add eax, 0xfffffff1
mov esi, eax
mov word [0x936996], si
lea esi, [edx - 0x3b]
mov word [0x936998], si
add esi, 0xfffffff7
mov word [0x93699a], si
lea esi, [edx - 0x2e]
mov word [0x93699c], si
add esi, 0xfffffff7
mov eax, edx
mov word [0x93699e], si
mov dword [0x936990], 0xdc97dc9d
mov dword [0x9369a0], 0xdc81dc92
mov word [0x9369a4], cx
mov word [0x9369a6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x93698c]
add eax, 2
mov word [eax + 0x936a46], cx
cmp eax, 0x1c
jb 0x898b4f
mov eax, 0x936a48
ret

Function at 0x898b6d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d7c], 1
jne 0x898bcc
or dword [0x937d7c], 1
mov dword [0x9369a8], 0x92b0a183
mov dword [0x9369ac], 0xa9b1a8ab
mov dword [0x9369b0], 0xa2aa8da1
mov dword [0x9369b4], 0xa5a9b6ab
mov dword [0x9369b8], 0xaaabadb0
mov dword [0x9369bc], 0xada582e4
mov dword [0x9369c0], 0xfea0a1a8
mov word [0x9369c4], 0xc4e4
xor eax, eax
mov cl, byte [eax + 0x9369a8]
xor cl, 0xc4
mov byte [eax + 0x936a64], cl
inc eax
cmp eax, 0x1e
jb 0x898bce
mov eax, 0x936a64
ret
Function at 0x898dab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x937d78], 1
jne 0x898fd3
push ebx
push esi
push edi
mov edi, 0xdc8c
mov eax, edi
mov word [0x9369c8], ax
add eax, 3
mov word [0x9369ca], ax
lea esi, [edi - 0xb]
mov eax, esi
mov word [0x9369cc], ax
add eax, 0x1c
mov word [0x9369ce], ax
lea edx, [edi + 0xf]
mov eax, edx
mov word [0x9369d0], ax
lea ecx, [edi - 4]
mov eax, ecx
mov word [0x9369d2], ax
add eax, 3
mov word [0x9369d4], ax
lea eax, [edi - 5]
mov word [0x9369d6], ax
add eax, 0xfffffffe
mov ebx, eax
mov word [0x9369d8], bx
mov word [0x9369e0], ax
lea ebx, [edi - 3]
mov ecx, ebx
lea eax, [edi + 1]
mov word [0x9369e6], ax
add edx, 0xfffffffd
mov eax, edx
mov word [0x9369ec], ax
lea eax, [edi + 0xb]
mov word [0x9369ee], ax
mov word [0x9369de], cx
add ecx, 0x22
mov eax, ecx
mov word [0x9369f0], ax
lea eax, [edi + 0x16]
mov word [0x9369f2], ax
add eax, 0xe
mov word [0x9369f4], ax
lea eax, [edi + 0x27]
add edi, 0x19
mov word [0x9369f6], ax
mov eax, edi
mov word [0x9369f8], ax
lea eax, [esi + 0x35]
or dword [0x937d78], 1
mov esi, eax
mov word [0x9369fa], si
add esi, 0xffffffeb
mov word [0x936a00], bx
mov word [0x9369fc], si
mov esi, edx
mov word [0x9369fe], si
lea esi, [ebx + 0x24]
mov ebx, esi
mov word [0x936a02], bx
add ebx, 0xfffffffa
mov word [0x936a04], bx
mov ebx, eax
mov word [0x936a06], bx
mov ebx, ecx
mov word [0x936a08], bx
lea ebx, [eax + 1]
mov word [0x936a0a], bx
mov ebx, ecx
mov word [0x936a0c], bx
lea ebx, [eax - 0x14]
mov word [0x936a0e], bx
add ebx, 0xe
mov word [0x936a10], bx
mov ebx, edx
mov word [0x936a12], bx
mov dword [0x9369da], 0xdc9bdc88
mov dword [0x9369e2], 0xdc8cdc87
mov dword [0x9369e8], 0xdc81dc8a
lea ebx, [eax - 0x2f]
mov word [0x936a14], bx
mov ebx, eax
mov word [0x936a16], bx
add ebx, 7
mov word [0x936a18], bx
lea ebx, [eax - 2]
mov eax, edi
mov word [0x936a24], ax
mov eax, ebx
mov word [0x936a26], ax
add eax, 0xfffffff8
mov ecx, eax
mov eax, esi
mov word [0x936a36], ax
add eax, 0xfffffffd
mov word [0x936a38], ax
lea eax, [esi - 0xc]
mov word [0x936a3a], ax
add eax, 0xffffffe2
mov word [0x936a3c], ax
lea eax, [esi - 0xd]
pop edi
mov word [0x936a42], ax
add eax, 0x24
pop esi
mov word [0x936a1a], bx
mov dword [0x936a1c], 0xdcabdcb0
mov dword [0x936a20], 0xdcb6dca3
mov word [0x936a28], cx
mov dword [0x936a2a], 0xdc98dcbd
mov dword [0x936a2e], 0xdca5dc89
mov dword [0x936a32], 0xdcacdca7
mov dword [0x936a3e], 0xdcaddcb1
mov word [0x936a44], ax
pop ebx
xor eax, eax
mov ecx, 0xdcc4
xor cx, word [eax + 0x9369c8]
add eax, 2
mov word [eax + 0x936a86], cx
cmp eax, 0x7e
jb 0x898fd5
mov eax, 0x936a88
ret
Function at 0x899a77
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x899c39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x899c7b
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x91fee0]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x91fee0]
inc edx
cmp dword [ebp + 8], 0
jne 0x899c46
pop esi
not eax
pop ebp
ret

Function at 0x89b8c6
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x89b8eb
cmp dword [ecx + 0x38], ebx
je 0x89b8eb
cmp eax, dword [ecx + 0x10]
jae 0x89b8eb
cmp dword [ecx + 0x14], 1
jne 0x89b8eb
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x89b8ed
xor edi, edi
cmp edi, ebx
je 0x89b9d0
cmp esi, ebx
je 0x89b9d0
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0089b06f
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x89b97c
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.008d9f40
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x89b9a1
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.008d9f40
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x89b9d2
xor eax, eax
pop edi
pop ebx
ret