joyce8/EMBER2024-capa huggingface dataset:
Function at 0x233fc1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d78], 1
jne 0x234009
or dword [0x2f2d78], 1
mov dword [0x2ece14], 0xa4ac81c7
mov dword [0x2ece18], 0xeebaadab
mov dword [0x2ece1c], 0xabbeb7ba
mov dword [0x2ece20], 0xbdebeef4
mov word [0x2ece24], 0xc4c3
mov byte [0x2ece26], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ece14]
xor cl, 0xce
mov byte [eax + 0x2ed4c0], cl
inc eax
cmp eax, 0x13
jb 0x23400b
mov eax, 0x2ed4c0
ret

Function at 0x234026
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d74], 1
jne 0x23408f
or dword [0x2f2d74], 1
mov dword [0x2ece28], 0xa7af88c7
mov dword [0x2ece2c], 0xeeaaaba2
mov dword [0x2ece30], 0xa8eea1ba
mov dword [0x2ece34], 0xa1a2a2a1
mov dword [0x2ece38], 0xa1beeeb9
mov dword [0x2ece3c], 0xabbaa0a7
mov dword [0x2ece40], 0xa6adeebc
mov dword [0x2ece44], 0xc3a0a7af
mov word [0x2ece48], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x2ece28]
xor cl, 0xce
mov byte [eax + 0x2ed4d4], cl
inc eax
cmp eax, 0x22
jb 0x234091
mov eax, 0x2ed4d4
ret

Function at 0x2340ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d70], 1
jne 0x2340cf
or dword [0x2f2d70], 1
mov dword [0x2ece4c], 0xaababd8e
mov word [0x2ece50], 0xce8e
xor eax, eax
mov cl, byte [eax + 0x2ece4c]
xor cl, 0xce
mov byte [eax + 0x2ed4f8], cl
inc eax
cmp eax, 6
jb 0x2340d1
mov eax, 0x2ed4f8
ret

Function at 0x2340ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d6c], 1
jne 0x234123
or dword [0x2f2d6c], 1
mov dword [0x2ece54], 0xbaa0bbbc
mov dword [0x2ece58], 0x91aba3a7
mov dword [0x2ece5c], 0xa1bcbcab
mov word [0x2ece60], 0xcebc
xor eax, eax
mov cl, byte [eax + 0x2ece54]
xor cl, 0xce
mov byte [eax + 0x2ed500], cl
inc eax
cmp eax, 0xe
jb 0x234125
mov eax, 0x2ed500
ret

Function at 0x234140
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d68], 1
jne 0x23416e
or dword [0x2f2d68], 1
mov dword [0x2ece64], 0xa9a0afbc
mov dword [0x2ece68], 0xbcab91ab
mov dword [0x2ece6c], 0xcebca1bc
xor eax, eax
mov cl, byte [eax + 0x2ece64]
xor cl, 0xce
mov byte [eax + 0x2ed510], cl
inc eax
cmp eax, 0xc
jb 0x234170
mov eax, 0x2ed510
ret

Function at 0x23418b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d64], 1
jne 0x2341c9
or dword [0x2f2d64], 1
mov dword [0x2ece70], 0xbcabb8a1
mov dword [0x2ece74], 0xb9a1a2a8
mov dword [0x2ece78], 0xbcbcab91
mov word [0x2ece7c], 0xbca1
mov byte [0x2ece7e], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ece70]
xor cl, 0xce
mov byte [eax + 0x2ed51c], cl
inc eax
cmp eax, 0xf
jb 0x2341cb
mov eax, 0x2ed51c
ret

Function at 0x2341e6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d60], 1
jne 0x23421e
or dword [0x2f2d60], 1
mov dword [0x2ece80], 0xabaaa0bb
mov dword [0x2ece84], 0xa1a2a8bc
mov dword [0x2ece88], 0xbcab91b9
mov dword [0x2ece8c], 0xcebca1bc
xor eax, eax
mov cl, byte [eax + 0x2ece80]
xor cl, 0xce
mov byte [eax + 0x2ed52c], cl
inc eax
cmp eax, 0x10
jb 0x234220
mov eax, 0x2ed52c
ret
Function at 0x23423b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d5c], 1
jne 0x234269
or dword [0x2f2d5c], 1
mov dword [0x2ece90], 0xa7a9a1a2
mov dword [0x2ece94], 0xbcab91ad
mov dword [0x2ece98], 0xcebca1bc
xor eax, eax
mov cl, byte [eax + 0x2ece90]
xor cl, 0xce
mov byte [eax + 0x2ed53c], cl
inc eax
cmp eax, 0xc
jb 0x23426b
mov eax, 0x2ed53c
ret

Function at 0x234286
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d58], 1
jne 0x2342bb
or dword [0x2f2d58], 1
mov dword [0x2ece9c], 0xafa3a1aa
mov dword [0x2ecea0], 0xab91a0a7
mov dword [0x2ecea4], 0xbca1bcbc
mov byte [0x2ecea8], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ece9c]
xor cl, 0xce
mov byte [eax + 0x2ed548], cl
inc eax
cmp eax, 0xd
jb 0x2342bd
mov eax, 0x2ed548
ret

Function at 0x2342d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d54], 1
jne 0x234317
or dword [0x2f2d54], 1
mov dword [0x2eceac], 0xafb8a0a7
mov dword [0x2eceb0], 0x91aaa7a2
mov dword [0x2eceb4], 0xbba9bcaf
mov dword [0x2eceb8], 0xbaa0aba3
mov byte [0x2ecebc], 0xce
xor eax, eax
mov cl, byte [eax + 0x2eceac]
xor cl, 0xce
mov byte [eax + 0x2ed558], cl
inc eax
cmp eax, 0x11
jb 0x234319
mov eax, 0x2ed558
ret

Function at 0x234334
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d50], 1
jne 0x234369
or dword [0x2f2d50], 1
mov dword [0x2ecec0], 0xa9a0aba2
mov dword [0x2ecec4], 0xab91a6ba
mov dword [0x2ecec8], 0xbca1bcbc
mov byte [0x2ececc], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecec0]
xor cl, 0xce
mov byte [eax + 0x2ed56c], cl
inc eax
cmp eax, 0xd
jb 0x23436b
mov eax, 0x2ed56c
ret

Function at 0x234386
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d4c], 1
jne 0x2343bb
or dword [0x2f2d4c], 1
mov dword [0x2eced0], 0x91babba1
mov dword [0x2eced4], 0xbc91a8a1
mov dword [0x2eced8], 0xaba9a0af
mov byte [0x2ecedc], 0xce
xor eax, eax
mov cl, byte [eax + 0x2eced0]
xor cl, 0xce
mov byte [eax + 0x2ed57c], cl
inc eax
cmp eax, 0xd
jb 0x2343bd
mov eax, 0x2ed57c
ret

Function at 0x2343d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d48], 1
jne 0x234405
or dword [0x2f2d48], 1
mov dword [0x2ecee0], 0xabadb6ab
mov dword [0x2ecee4], 0xa1a7babe
mov word [0x2ecee8], 0xcea0
xor eax, eax
mov cl, byte [eax + 0x2ecee0]
xor cl, 0xce
mov byte [eax + 0x2ed58c], cl
inc eax
cmp eax, 0xa
jb 0x234407
mov eax, 0x2ed58c
ret

Function at 0x234422
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d44], 1
jne 0x234481
or dword [0x2f2d44], 1
mov dword [0x2eceec], 0xaababdc7
mov dword [0x2ecef0], 0xb6abf4f4
mov dword [0x2ecef4], 0xbabeabad
mov dword [0x2ecef8], 0xf4a0a1a7
mov dword [0x2ecefc], 0xafa6b9f4
mov dword [0x2ecf00], 0xf4e7e6ba
mov dword [0x2ecf04], 0xc3bdebee
mov word [0x2ecf08], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x2eceec]
xor cl, 0xce
mov byte [eax + 0x2ed598], cl
inc eax
cmp eax, 0x1e
jb 0x234483
mov eax, 0x2ed598
ret
Function at 0x23449e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d40], 1
jne 0x234512
or dword [0x2f2d40], 1
mov dword [0x2ecf0c], 0xa7af88c7
mov dword [0x2ecf10], 0xeeaaaba2
mov dword [0x2ecf14], 0xa9eea1ba
mov dword [0x2ecf18], 0xbdeebaab
mov dword [0x2ecf1c], 0xf4f4aaba
mov dword [0x2ecf20], 0xabadb6ab
mov dword [0x2ecf24], 0xa1a7babe
mov dword [0x2ecf28], 0xb9f4f4a0
mov dword [0x2ecf2c], 0xe6baafa6
mov dword [0x2ecf30], 0xcec4c3e7
xor eax, eax
mov cl, byte [eax + 0x2ecf0c]
xor cl, 0xce
mov byte [eax + 0x2ed5b8], cl
inc eax
cmp eax, 0x28
jb 0x234514
mov eax, 0x2ed5b8
ret

Function at 0x23452f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d3c], 1
jne 0x234563
or dword [0x2f2d3c], 1
mov dword [0x2ecf34], 0xa3a1ad91
mov dword [0x2ecf38], 0xbcbcab91
mov word [0x2ecf3c], 0xbca1
mov byte [0x2ecf3e], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecf34]
xor cl, 0xce
mov byte [eax + 0x2ed5e0], cl
inc eax
cmp eax, 0xb
jb 0x234565
mov eax, 0x2ed5e0
ret

Function at 0x234580
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d38], 1
jne 0x2345e9
or dword [0x2f2d38], 1
mov dword [0x2ecf40], 0xa1ad91c7
mov dword [0x2ecf44], 0xbcab91a3
mov dword [0x2ecf48], 0xf4bca1bc
mov dword [0x2ecf4c], 0xbcbc8bf4
mov dword [0x2ecf50], 0xab83bca1
mov dword [0x2ecf54], 0xa9afbdbd
mov dword [0x2ecf58], 0xf4e7e6ab
mov dword [0x2ecf5c], 0xc3bdebee
mov word [0x2ecf60], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x2ecf40]
xor cl, 0xce
mov byte [eax + 0x2ed5ec], cl
inc eax
cmp eax, 0x22
jb 0x2345eb
mov eax, 0x2ed5ec
ret

Function at 0x234606
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d34], 1
jne 0x234684
or dword [0x2f2d34], 1
mov dword [0x2ecf64], 0xa7af88c7
mov dword [0x2ecf68], 0xeeaaaba2
mov dword [0x2ecf6c], 0xa9eea1ba
mov dword [0x2ecf70], 0x91eebaab
mov dword [0x2ecf74], 0x91a3a1ad
mov dword [0x2ecf78], 0xa1bcbcab
mov dword [0x2ecf7c], 0x8bf4f4bc
mov dword [0x2ecf80], 0xbca1bcbc
mov dword [0x2ecf84], 0xbdbdab83
mov dword [0x2ecf88], 0xe6aba9af
mov dword [0x2ecf8c], 0xcec4c3e7
xor eax, eax
mov cl, byte [eax + 0x2ecf64]
xor cl, 0xce
mov byte [eax + 0x2ed610], cl
inc eax
cmp eax, 0x2c
jb 0x234686
mov eax, 0x2ed610
ret

Function at 0x2346a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d30], 1
jne 0x23471c
or dword [0x2f2d30], 1
mov dword [0x2ecf90], 0xadafba9d
mov dword [0x2ecf94], 0xbbaaeea5
mov dword [0x2ecf98], 0xabeebea3
mov dword [0x2ecf9c], 0xbca1bcbc
mov dword [0x2ecfa0], 0xa18deef4
mov dword [0x2ecfa4], 0xb6abbaa0
mov dword [0x2ecfa8], 0xadab9cba
mov dword [0x2ecfac], 0xeeaabca1
mov dword [0x2ecfb0], 0xeebdafb9
mov dword [0x2ecfb4], 0xa2a2bba0
mov byte [0x2ecfb8], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecf90]
xor cl, 0xce
mov byte [eax + 0x2ed63c], cl
inc eax
cmp eax, 0x29
jb 0x23471e
mov eax, 0x2ed63c
ret
Function at 0x234739
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d2c], 1
jne 0x2347b3
or dword [0x2f2d2c], 1
mov dword [0x2ecfbc], 0xadafba9d
mov dword [0x2ecfc0], 0xbbaaeea5
mov dword [0x2ecfc4], 0xabeebea3
mov dword [0x2ecfc8], 0xbca1bcbc
mov dword [0x2ecfcc], 0xb79deef4
mov dword [0x2ecfd0], 0xa7a087a3
mov dword [0x2ecfd4], 0xa2afa7ba
mov dword [0x2ecfd8], 0xeeabb4a7
mov dword [0x2ecfdc], 0xa2a7afa8
mov word [0x2ecfe0], 0xaaab
mov byte [0x2ecfe2], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecfbc]
xor cl, 0xce
mov byte [eax + 0x2ed668], cl
inc eax
cmp eax, 0x27
jb 0x2347b5
mov eax, 0x2ed668
ret

Function at 0x2347d0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d28], 1
jne 0x234836
or dword [0x2f2d28], 1
mov dword [0x2ecfe4], 0xa7a5bdf2
mov dword [0x2ecfe8], 0xaaabbebe
mov dword [0x2ecfec], 0xafbca8ee
mov dword [0x2ecff0], 0xeee2aba3
mov dword [0x2ecff4], 0xb9ee8d9e
mov dword [0x2ecff8], 0xa0eebdaf
mov dword [0x2ecffc], 0xf0a2a2bb
mov word [0x2ed000], 0xc4c3
mov byte [0x2ed002], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ecfe4]
xor cl, 0xce
mov byte [eax + 0x2ed690], cl
inc eax
cmp eax, 0x1f
jb 0x234838
mov eax, 0x2ed690
ret

Function at 0x234853
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d24], 1
jne 0x2348e6
or dword [0x2f2d24], 1
mov dword [0x2ed004], 0xa7a5bdf2
mov dword [0x2ed008], 0xaaabbebe
mov dword [0x2ed00c], 0xafbca8ee
mov dword [0x2ed010], 0xeee2aba3
mov dword [0x2ed014], 0xb9ee8d9e
mov dword [0x2ed018], 0xbdeebdaf
mov dword [0x2ed01c], 0xeeaba3af
mov dword [0x2ed020], 0xbceebdaf
mov dword [0x2ed024], 0xbcbbbaab
mov dword [0x2ed028], 0xaaafeea0
mov dword [0x2ed02c], 0xbdabbcaa
mov dword [0x2ed030], 0xc4c3f0bd
mov byte [0x2ed034], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ed004]
xor cl, 0xce
mov byte [eax + 0x2ed6b0], cl
inc eax
cmp eax, 0x31
jb 0x2348e8
mov eax, 0x2ed6b0
ret
Function at 0x234903
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.002a6ab0
push ebx
push esi
push edi
call dword [0x2c2094]
test byte [0x2f2d20], 1
mov dword [ebp - 4], eax
jne 0x23494a
or dword [0x2f2d20], 1
mov dword [0x2ed038], 0xaaa1a3f2
mov dword [0x2ed03c], 0xf1aba2bb
mov dword [0x2ed040], 0xcef0f1f1
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x2ed038]
xor cl, 0xce
mov byte [eax + 0x2ed6e4], cl
inc eax
cmp eax, 0xc
jb 0x23494e
test byte [0x2f2d1c], 1
mov dword [ebp - 8], 0x2ed6e4
jne 0x234998
or dword [0x2f2d1c], 1
mov dword [0x2ed044], 0xa3b7bdf2
mov dword [0x2ed048], 0xf1a2a1ac
mov dword [0x2ed04c], 0xcef0f1f1
xor eax, eax
mov cl, byte [eax + 0x2ed044]
xor cl, 0xce
mov byte [eax + 0x2ed6f0], cl
inc eax
cmp eax, 0xc
jb 0x23499a
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x2ed6f0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00296f70
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x2c23b0]
test eax, eax
je 0x2349ff
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.00296f70
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x2c23bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x234a4b
mov ecx, dword [ebp - 0x1c]
test byte [0x2f2d18], 1
jne 0x234a82
or dword [0x2f2d18], 1
mov dword [0x2ed050], 0xebeebeeb
mov dword [0x2ed054], 0xbdebefbd
mov dword [0x2ed058], 0xebb6fee5
mov word [0x2ed05c], 0xceb6
xor eax, eax
mov dl, byte [eax + 0x2ed050]
xor dl, 0xce
mov byte [eax + 0x2ed6fc], dl
inc eax
cmp eax, 0xe
jb 0x234a84
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x2ed6fc
push dword [ebp + 0xc]
call fcn.0029419d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x2c23a4]
test eax, eax
je 0x234afb
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00234b48
push eax
push dword [ebp + 0xc]
call fcn.0029419d
add esp, 0x14
test byte [0x2f2d10], 1
jne 0x234b1b
or dword [0x2f2d10], 1
mov word [0x2ed070], 0xc4c3
mov byte [0x2ed072], 0xce
xor eax, eax
mov cl, byte [eax + 0x2ed070]
xor cl, 0xce
mov byte [eax + 0x2ed71c], cl
inc eax
cmp eax, 3
jb 0x234b1d
push dword [ebp + 0xc]
push 0x2ed71c
call fcn.00293e11
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x234b48
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d14], 1
jne 0x234b80
or dword [0x2f2d14], 1
mov dword [0x2ed060], 0xbdebe6ee
mov dword [0x2ed064], 0xeeaaebf4
mov dword [0x2ed068], 0xb6feeee5
mov dword [0x2ed06c], 0xcee7b6eb
xor eax, eax
mov cl, byte [eax + 0x2ed060]
xor cl, 0xce
mov byte [eax + 0x2ed70c], cl
inc eax
cmp eax, 0x10
jb 0x234b82
mov eax, 0x2ed70c
ret

Function at 0x235df8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d04], 1
jne 0x235e4d
or dword [0x2f2d04], 1
mov dword [0x2ed740], 0x94829198
mov dword [0x2ed744], 0x95829187
mov dword [0x2ed748], 0x8093918c
mov dword [0x2ed74c], 0x83948c99
mov dword [0x2ed750], 0x868c8494
mov dword [0x2ed754], 0x8f889f92
mov word [0x2ed758], 0xd08f
xor eax, eax
mov cl, byte [eax + 0x2ed740]
xor cl, 0xd0
mov byte [eax + 0x2ed940], cl
inc eax
cmp eax, 0x1a
jb 0x235e4f
mov eax, 0x2ed940
ret

Function at 0x235f5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2d00], 1
jne 0x235f88
or dword [0x2f2d00], 1
mov dword [0x2ed75c], 0xb1879d86
mov word [0x2ed760], 0xb5a2
mov byte [0x2ed762], 0xd0
xor eax, eax
mov cl, byte [eax + 0x2ed75c]
xor cl, 0xd0
mov byte [eax + 0x2ed95c], cl
inc eax
cmp eax, 7
jb 0x235f8a
mov eax, 0x2ed95c
ret

Function at 0x235fa5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2cfc], 1
jne 0x235fd2
or dword [0x2f2cfc], 1
mov dword [0x2ed764], 0xa4a2b986
mov dword [0x2ed768], 0x80bcb1a5
mov word [0x2ed76c], 0xd093
xor eax, eax
mov cl, byte [eax + 0x2ed764]
xor cl, 0xd0
mov byte [eax + 0x2ed964], cl
inc eax
cmp eax, 0xa
jb 0x235fd4
mov eax, 0x2ed964
ret

Function at 0x235fef
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2cf8], 1
jne 0x236023
or dword [0x2f2cf8], 1
mov dword [0x2ed770], 0xa4a2b986
mov dword [0x2ed774], 0x92bcb1a5
mov word [0x2ed778], 0xa8bf
mov byte [0x2ed77a], 0xd0
xor eax, eax
mov cl, byte [eax + 0x2ed770]
xor cl, 0xd0
mov byte [eax + 0x2ed970], cl
inc eax
cmp eax, 0xb
jb 0x236025
mov eax, 0x2ed970
ret

Function at 0x236040
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2cf4], 1
jne 0x236064
or dword [0x2f2cf4], 1
mov dword [0x2ed77c], 0xb5beb597
mov dword [0x2ed780], 0xd0b3b9a2
xor eax, eax
mov cl, byte [eax + 0x2ed77c]
xor cl, 0xd0
mov byte [eax + 0x2ed97c], cl
inc eax
cmp eax, 8
jb 0x236066
mov eax, 0x2ed97c
ret
Function at 0x236081
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x2bb2df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x2f2cf0], 1
push esi
jne 0x2360d4
or dword [0x2f2cf0], 1
mov dword [0x2ed784], 0xbcb4a4be
mov dword [0x2ed788], 0xbcb4febc
mov word [0x2ed78c], 0xd0bc
xor eax, eax
mov cl, byte [eax + 0x2ed784]
xor cl, 0xd0
mov byte [eax + 0x2ed984], cl
inc eax
cmp eax, 0xa
jb 0x2360d6
push 0x2ed984
call dword [0x2c20cc]
mov esi, eax
test esi, esi
jne 0x236148
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0025a918
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0023628f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00235bc9
push 0x2dec28
mov eax, esi
push eax
call fcn.0029d8c5
call fcn.002362f5
push eax
push esi
call dword [0x2c20c8]
test eax, eax
jne 0x2361a5
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0025a918
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00236367
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00235bc9
push 0x2dec28
mov eax, esi
jmp 0x236142
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x23622d
cmp dword [esp + 4], 0x18
jne 0x23622d
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x2c20c4]
test eax, eax
jne 0x23627c
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0025a918
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.002364a7
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00235bc9
push 0x2dec28
mov eax, esi
jmp 0x236142
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0025a918
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.0023641a
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00235bc9
push 0x2dec28
mov eax, esi
jmp 0x236142
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x23628f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2cec], 1
jne 0x2362d8
or dword [0x2f2cec], 1
mov dword [0x2ed790], 0xb4b1bf9c
mov dword [0x2ed794], 0xa2b2b99c
mov dword [0x2ed798], 0xf0a9a2b1
mov dword [0x2ed79c], 0xbcb9b1b6
mov dword [0x2ed7a0], 0xf0eab4b5
mov byte [0x2ed7a4], 0xd0
xor eax, eax
mov cl, byte [eax + 0x2ed790]
xor cl, 0xd0
mov byte [eax + 0x2ed990], cl
inc eax
cmp eax, 0x15
jb 0x2362da
mov eax, 0x2ed990
ret
Function at 0x2362f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2ce8], 1
jne 0x23634a
or dword [0x2f2ce8], 1
mov dword [0x2ed7a8], 0xa581a49e
mov dword [0x2ed7ac], 0x99a9a2b5
mov dword [0x2ed7b0], 0xa2bfb6be
mov dword [0x2ed7b4], 0xb9a4b1bd
mov dword [0x2ed7b8], 0xa280bebf
mov dword [0x2ed7bc], 0xa3b5b3bf
mov word [0x2ed7c0], 0xd0a3
xor eax, eax
mov cl, byte [eax + 0x2ed7a8]
xor cl, 0xd0
mov byte [eax + 0x2ed9a8], cl
inc eax
cmp eax, 0x1a
jb 0x23634c
mov eax, 0x2ed9a8
ret

Function at 0x236367
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2ce4], 1
jne 0x2363fd
or dword [0x2f2ce4], 1
mov dword [0x2ed7c4], 0x80a4b597
mov dword [0x2ed7c8], 0x91b3bfa2
mov dword [0x2ed7cc], 0xb5a2b4b4
mov dword [0x2ed7d0], 0xb6f0a3a3
mov dword [0x2ed7d4], 0xb5bcb9b1
mov dword [0x2ed7d8], 0x9ef8f0b4
mov dword [0x2ed7dc], 0xb5a581a4
mov dword [0x2ed7e0], 0xbe99a9a2
mov dword [0x2ed7e4], 0xbda2bfb6
mov dword [0x2ed7e8], 0xbfb9a4b1
mov dword [0x2ed7ec], 0xbfa280be
mov dword [0x2ed7f0], 0xa3a3b5b3
mov dword [0x2ed7f4], 0xd0f0eaf9
xor eax, eax
mov cl, byte [eax + 0x2ed7c4]
xor cl, 0xd0
mov byte [eax + 0x2ed9c4], cl
inc eax
cmp eax, 0x34
jb 0x2363ff
mov eax, 0x2ed9c4
ret

Function at 0x23641a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2ce0], 1
jne 0x23648a
or dword [0x2f2ce0], 1
mov dword [0x2ed7f8], 0xa581a49e
mov dword [0x2ed7fc], 0x99a9a2b5
mov dword [0x2ed800], 0xa2bfb6be
mov dword [0x2ed804], 0xb9a4b1bd
mov dword [0x2ed808], 0xa280bebf
mov dword [0x2ed80c], 0xa3b5b3bf
mov dword [0x2ed810], 0xb1b6f0a3
mov dword [0x2ed814], 0xb4b5bcb9
mov word [0x2ed818], 0xf0ea
mov byte [0x2ed81a], 0xd0
xor eax, eax
mov cl, byte [eax + 0x2ed7f8]
xor cl, 0xd0
mov byte [eax + 0x2ed9f8], cl
inc eax
cmp eax, 0x23
jb 0x23648c
mov eax, 0x2ed9f8
ret

Function at 0x2364a7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2cdc], 1
jne 0x2364f0
or dword [0x2f2cdc], 1
mov dword [0x2ed81c], 0xbeb5a09f
mov dword [0x2ed820], 0xb3bfa280
mov dword [0x2ed824], 0xf0a3a3b5
mov dword [0x2ed828], 0xbcb9b1b6
mov dword [0x2ed82c], 0xf0eab4b5
mov byte [0x2ed830], 0xd0
xor eax, eax
mov cl, byte [eax + 0x2ed81c]
xor cl, 0xd0
mov byte [eax + 0x2eda1c], cl
inc eax
cmp eax, 0x15
jb 0x2364f2
mov eax, 0x2eda1c
ret
Function at 0x23650d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x2bb28c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x2f2cd8], 1
push esi
push edi
jne 0x23656a
or dword [0x2f2cd8], 1
mov dword [0x2ed834], 0xbea2b5bb
mov dword [0x2ed838], 0xe2e3bcb5
mov dword [0x2ed83c], 0xbcbcb4fe
mov byte [0x2ed840], 0xd0
xor eax, eax
mov cl, byte [eax + 0x2ed834]
xor cl, 0xd0
mov byte [eax + 0x2eda34], cl
inc eax
cmp eax, 0xd
jb 0x23656c
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x2eda34
call edi
mov esi, eax
test esi, esi
jne 0x2365e0
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0025a918
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00236742
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00235bc9
push 0x2dec28
mov eax, esi
push eax
call fcn.0029d8c5
call fcn.002367bf
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x2366ad
call fcn.00236832
push eax
call edi
mov edi, eax
test edi, edi
jne 0x236651
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0025a918
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0023687c
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00235bc9
push 0x2dec28
mov eax, esi
jmp 0x2365da
call fcn.002368f6
push eax
push edi
call esi
test eax, eax
jne 0x2366ad
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0025a918
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00236966
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00235bc9
push 0x2dec28
mov eax, esi
jmp 0x2365da
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x23670f
call dword [0x2c20a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0025a918
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00236a1f
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00236ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00235bc9
push 0x2dec28
mov eax, esi
jmp 0x2365da
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00234cc4
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x236742
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2f2cd4], 1
jne 0x2367a2
or dword [0x2f2cd4], 1
mov dword [0x2ed844], 0xb4b1bf9c
mov dword [0x2ed848], 0xa2b2b99c
mov dword [0x2ed84c], 0xf0a9a2b1
mov dword [0x2ed850], 0xbcb9b1b6
mov dword [0x2ed854], 0xf8f0b4b5
mov dword [0x2ed858], 0xbea2b5bb
mov dword [0x2ed85c], 0xe2e3bcb5
mov dword [0x2ed860], 0xd0f0eaf9
xor eax, eax
mov cl, byte [eax + 0x2ed844]
xor cl, 0xd0
mov byte [eax + 0x2eda44], cl
inc eax
cmp eax, 0x20
jb 0x2367a4
mov eax, 0x2eda44
ret