joyce8/EMBER2024-capa huggingface dataset:
Function at 0x873fc1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938448], 1
jne 0x874009
or dword [0x938448], 1
mov dword [0x931ed8], 0xc8c0edab
mov dword [0x931edc], 0x82d6c1c7
mov dword [0x931ee0], 0xc7d2dbd6
mov dword [0x931ee4], 0xd1878298
mov word [0x931ee8], 0xa8af
mov byte [0x931eea], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931ed8]
xor cl, 0xa2
mov byte [eax + 0x932584], cl
inc eax
cmp eax, 0x13
jb 0x87400b
mov eax, 0x932584
ret

Function at 0x874026
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938444], 1
jne 0x87408f
or dword [0x938444], 1
mov dword [0x931eec], 0xcbc3e4ab
mov dword [0x931ef0], 0x82c6c7ce
mov dword [0x931ef4], 0xc482cdd6
mov dword [0x931ef8], 0xcdcececd
mov dword [0x931efc], 0xcdd282d5
mov dword [0x931f00], 0xc7d6cccb
mov dword [0x931f04], 0xcac182d0
mov dword [0x931f08], 0xafcccbc3
mov word [0x931f0c], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x931eec]
xor cl, 0xa2
mov byte [eax + 0x932598], cl
inc eax
cmp eax, 0x22
jb 0x874091
mov eax, 0x932598
ret

Function at 0x8740ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938440], 1
jne 0x8740cf
or dword [0x938440], 1
mov dword [0x931f10], 0xc6d6d1e2
mov word [0x931f14], 0xa2e2
xor eax, eax
mov cl, byte [eax + 0x931f10]
xor cl, 0xa2
mov byte [eax + 0x9325bc], cl
inc eax
cmp eax, 6
jb 0x8740d1
mov eax, 0x9325bc
ret

Function at 0x8740ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93843c], 1
jne 0x874123
or dword [0x93843c], 1
mov dword [0x931f18], 0xd6ccd7d0
mov dword [0x931f1c], 0xfdc7cfcb
mov dword [0x931f20], 0xcdd0d0c7
mov word [0x931f24], 0xa2d0
xor eax, eax
mov cl, byte [eax + 0x931f18]
xor cl, 0xa2
mov byte [eax + 0x9325c4], cl
inc eax
cmp eax, 0xe
jb 0x874125
mov eax, 0x9325c4
ret

Function at 0x874140
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938438], 1
jne 0x87416e
or dword [0x938438], 1
mov dword [0x931f28], 0xc5ccc3d0
mov dword [0x931f2c], 0xd0c7fdc7
mov dword [0x931f30], 0xa2d0cdd0
xor eax, eax
mov cl, byte [eax + 0x931f28]
xor cl, 0xa2
mov byte [eax + 0x9325d4], cl
inc eax
cmp eax, 0xc
jb 0x874170
mov eax, 0x9325d4
ret

Function at 0x87418b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938434], 1
jne 0x8741c9
or dword [0x938434], 1
mov dword [0x931f34], 0xd0c7d4cd
mov dword [0x931f38], 0xd5cdcec4
mov dword [0x931f3c], 0xd0d0c7fd
mov word [0x931f40], 0xd0cd
mov byte [0x931f42], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931f34]
xor cl, 0xa2
mov byte [eax + 0x9325e0], cl
inc eax
cmp eax, 0xf
jb 0x8741cb
mov eax, 0x9325e0
ret

Function at 0x8741e6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938430], 1
jne 0x87421e
or dword [0x938430], 1
mov dword [0x931f44], 0xc7c6ccd7
mov dword [0x931f48], 0xcdcec4d0
mov dword [0x931f4c], 0xd0c7fdd5
mov dword [0x931f50], 0xa2d0cdd0
xor eax, eax
mov cl, byte [eax + 0x931f44]
xor cl, 0xa2
mov byte [eax + 0x9325f0], cl
inc eax
cmp eax, 0x10
jb 0x874220
mov eax, 0x9325f0
ret
Function at 0x87423b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93842c], 1
jne 0x874269
or dword [0x93842c], 1
mov dword [0x931f54], 0xcbc5cdce
mov dword [0x931f58], 0xd0c7fdc1
mov dword [0x931f5c], 0xa2d0cdd0
xor eax, eax
mov cl, byte [eax + 0x931f54]
xor cl, 0xa2
mov byte [eax + 0x932600], cl
inc eax
cmp eax, 0xc
jb 0x87426b
mov eax, 0x932600
ret

Function at 0x874286
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938428], 1
jne 0x8742bb
or dword [0x938428], 1
mov dword [0x931f60], 0xc3cfcdc6
mov dword [0x931f64], 0xc7fdcccb
mov dword [0x931f68], 0xd0cdd0d0
mov byte [0x931f6c], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931f60]
xor cl, 0xa2
mov byte [eax + 0x93260c], cl
inc eax
cmp eax, 0xd
jb 0x8742bd
mov eax, 0x93260c
ret

Function at 0x8742d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938424], 1
jne 0x874317
or dword [0x938424], 1
mov dword [0x931f70], 0xc3d4cccb
mov dword [0x931f74], 0xfdc6cbce
mov dword [0x931f78], 0xd7c5d0c3
mov dword [0x931f7c], 0xd6ccc7cf
mov byte [0x931f80], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931f70]
xor cl, 0xa2
mov byte [eax + 0x93261c], cl
inc eax
cmp eax, 0x11
jb 0x874319
mov eax, 0x93261c
ret

Function at 0x874334
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938420], 1
jne 0x874369
or dword [0x938420], 1
mov dword [0x931f84], 0xc5ccc7ce
mov dword [0x931f88], 0xc7fdcad6
mov dword [0x931f8c], 0xd0cdd0d0
mov byte [0x931f90], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931f84]
xor cl, 0xa2
mov byte [eax + 0x932630], cl
inc eax
cmp eax, 0xd
jb 0x87436b
mov eax, 0x932630
ret

Function at 0x874386
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93841c], 1
jne 0x8743bb
or dword [0x93841c], 1
mov dword [0x931f94], 0xfdd6d7cd
mov dword [0x931f98], 0xd0fdc4cd
mov dword [0x931f9c], 0xc7c5ccc3
mov byte [0x931fa0], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931f94]
xor cl, 0xa2
mov byte [eax + 0x932640], cl
inc eax
cmp eax, 0xd
jb 0x8743bd
mov eax, 0x932640
ret

Function at 0x8743d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938418], 1
jne 0x874405
or dword [0x938418], 1
mov dword [0x931fa4], 0xc7c1dac7
mov dword [0x931fa8], 0xcdcbd6d2
mov word [0x931fac], 0xa2cc
xor eax, eax
mov cl, byte [eax + 0x931fa4]
xor cl, 0xa2
mov byte [eax + 0x932650], cl
inc eax
cmp eax, 0xa
jb 0x874407
mov eax, 0x932650
ret

Function at 0x874422
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938414], 1
jne 0x874481
or dword [0x938414], 1
mov dword [0x931fb0], 0xc6d6d1ab
mov dword [0x931fb4], 0xdac79898
mov dword [0x931fb8], 0xd6d2c7c1
mov dword [0x931fbc], 0x98cccdcb
mov dword [0x931fc0], 0xc3cad598
mov dword [0x931fc4], 0x988b8ad6
mov dword [0x931fc8], 0xafd18782
mov word [0x931fcc], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x931fb0]
xor cl, 0xa2
mov byte [eax + 0x93265c], cl
inc eax
cmp eax, 0x1e
jb 0x874483
mov eax, 0x93265c
ret
Function at 0x87449e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938410], 1
jne 0x874512
or dword [0x938410], 1
mov dword [0x931fd0], 0xcbc3e4ab
mov dword [0x931fd4], 0x82c6c7ce
mov dword [0x931fd8], 0xc582cdd6
mov dword [0x931fdc], 0xd182d6c7
mov dword [0x931fe0], 0x9898c6d6
mov dword [0x931fe4], 0xc7c1dac7
mov dword [0x931fe8], 0xcdcbd6d2
mov dword [0x931fec], 0xd59898cc
mov dword [0x931ff0], 0x8ad6c3ca
mov dword [0x931ff4], 0xa2a8af8b
xor eax, eax
mov cl, byte [eax + 0x931fd0]
xor cl, 0xa2
mov byte [eax + 0x93267c], cl
inc eax
cmp eax, 0x28
jb 0x874514
mov eax, 0x93267c
ret

Function at 0x87452f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93840c], 1
jne 0x874563
or dword [0x93840c], 1
mov dword [0x931ff8], 0xcfcdc1fd
mov dword [0x931ffc], 0xd0d0c7fd
mov word [0x932000], 0xd0cd
mov byte [0x932002], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931ff8]
xor cl, 0xa2
mov byte [eax + 0x9326a4], cl
inc eax
cmp eax, 0xb
jb 0x874565
mov eax, 0x9326a4
ret

Function at 0x874580
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938408], 1
jne 0x8745e9
or dword [0x938408], 1
mov dword [0x932004], 0xcdc1fdab
mov dword [0x932008], 0xd0c7fdcf
mov dword [0x93200c], 0x98d0cdd0
mov dword [0x932010], 0xd0d0e798
mov dword [0x932014], 0xc7efd0cd
mov dword [0x932018], 0xc5c3d1d1
mov dword [0x93201c], 0x988b8ac7
mov dword [0x932020], 0xafd18782
mov word [0x932024], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x932004]
xor cl, 0xa2
mov byte [eax + 0x9326b0], cl
inc eax
cmp eax, 0x22
jb 0x8745eb
mov eax, 0x9326b0
ret

Function at 0x874606
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938404], 1
jne 0x874684
or dword [0x938404], 1
mov dword [0x932028], 0xcbc3e4ab
mov dword [0x93202c], 0x82c6c7ce
mov dword [0x932030], 0xc582cdd6
mov dword [0x932034], 0xfd82d6c7
mov dword [0x932038], 0xfdcfcdc1
mov dword [0x93203c], 0xcdd0d0c7
mov dword [0x932040], 0xe79898d0
mov dword [0x932044], 0xd0cdd0d0
mov dword [0x932048], 0xd1d1c7ef
mov dword [0x93204c], 0x8ac7c5c3
mov dword [0x932050], 0xa2a8af8b
xor eax, eax
mov cl, byte [eax + 0x932028]
xor cl, 0xa2
mov byte [eax + 0x9326d4], cl
inc eax
cmp eax, 0x2c
jb 0x874686
mov eax, 0x9326d4
ret

Function at 0x8746a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938400], 1
jne 0x87471c
or dword [0x938400], 1
mov dword [0x932054], 0xc1c3d6f1
mov dword [0x932058], 0xd7c682c9
mov dword [0x93205c], 0xc782d2cf
mov dword [0x932060], 0xd0cdd0d0
mov dword [0x932064], 0xcde18298
mov dword [0x932068], 0xdac7d6cc
mov dword [0x93206c], 0xc1c7f0d6
mov dword [0x932070], 0x82c6d0cd
mov dword [0x932074], 0x82d1c3d5
mov dword [0x932078], 0xceced7cc
mov byte [0x93207c], 0xa2
xor eax, eax
mov cl, byte [eax + 0x932054]
xor cl, 0xa2
mov byte [eax + 0x932700], cl
inc eax
cmp eax, 0x29
jb 0x87471e
mov eax, 0x932700
ret
Function at 0x874739
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383fc], 1
jne 0x8747b3
or dword [0x9383fc], 1
mov dword [0x932080], 0xc1c3d6f1
mov dword [0x932084], 0xd7c682c9
mov dword [0x932088], 0xc782d2cf
mov dword [0x93208c], 0xd0cdd0d0
mov dword [0x932090], 0xdbf18298
mov dword [0x932094], 0xcbccebcf
mov dword [0x932098], 0xcec3cbd6
mov dword [0x93209c], 0x82c7d8cb
mov dword [0x9320a0], 0xcecbc3c4
mov word [0x9320a4], 0xc6c7
mov byte [0x9320a6], 0xa2
xor eax, eax
mov cl, byte [eax + 0x932080]
xor cl, 0xa2
mov byte [eax + 0x93272c], cl
inc eax
cmp eax, 0x27
jb 0x8747b5
mov eax, 0x93272c
ret

Function at 0x8747d0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383f8], 1
jne 0x874836
or dword [0x9383f8], 1
mov dword [0x9320a8], 0xcbc9d19e
mov dword [0x9320ac], 0xc6c7d2d2
mov dword [0x9320b0], 0xc3d0c482
mov dword [0x9320b4], 0x828ec7cf
mov dword [0x9320b8], 0xd582e1f2
mov dword [0x9320bc], 0xcc82d1c3
mov dword [0x9320c0], 0x9cceced7
mov word [0x9320c4], 0xa8af
mov byte [0x9320c6], 0xa2
xor eax, eax
mov cl, byte [eax + 0x9320a8]
xor cl, 0xa2
mov byte [eax + 0x932754], cl
inc eax
cmp eax, 0x1f
jb 0x874838
mov eax, 0x932754
ret

Function at 0x874853
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383f4], 1
jne 0x8748e6
or dword [0x9383f4], 1
mov dword [0x9320c8], 0xcbc9d19e
mov dword [0x9320cc], 0xc6c7d2d2
mov dword [0x9320d0], 0xc3d0c482
mov dword [0x9320d4], 0x828ec7cf
mov dword [0x9320d8], 0xd582e1f2
mov dword [0x9320dc], 0xd182d1c3
mov dword [0x9320e0], 0x82c7cfc3
mov dword [0x9320e4], 0xd082d1c3
mov dword [0x9320e8], 0xd0d7d6c7
mov dword [0x9320ec], 0xc6c382cc
mov dword [0x9320f0], 0xd1c7d0c6
mov dword [0x9320f4], 0xa8af9cd1
mov byte [0x9320f8], 0xa2
xor eax, eax
mov cl, byte [eax + 0x9320c8]
xor cl, 0xa2
mov byte [eax + 0x932774], cl
inc eax
cmp eax, 0x31
jb 0x8748e8
mov eax, 0x932774
ret
Function at 0x874903
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.008e9a80
push ebx
push esi
push edi
call dword [0x906094]
test byte [0x9383f0], 1
mov dword [ebp - 4], eax
jne 0x87494a
or dword [0x9383f0], 1
mov dword [0x9320fc], 0xc6cdcf9e
mov dword [0x932100], 0x9dc7ced7
mov dword [0x932104], 0xa29c9d9d
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x9320fc]
xor cl, 0xa2
mov byte [eax + 0x9327a8], cl
inc eax
cmp eax, 0xc
jb 0x87494e
test byte [0x9383ec], 1
mov dword [ebp - 8], 0x9327a8
jne 0x874998
or dword [0x9383ec], 1
mov dword [0x932108], 0xcfdbd19e
mov dword [0x93210c], 0x9dcecdc0
mov dword [0x932110], 0xa29c9d9d
xor eax, eax
mov cl, byte [eax + 0x932108]
xor cl, 0xa2
mov byte [eax + 0x9327b4], cl
inc eax
cmp eax, 0xc
jb 0x87499a
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x9327b4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.008db890
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x9063bc]
test eax, eax
je 0x8749ff
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.008db890
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x9063c4]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x874a4b
mov ecx, dword [ebp - 0x1c]
test byte [0x9383e8], 1
jne 0x874a82
or dword [0x9383e8], 1
mov dword [0x932114], 0x8782d287
mov dword [0x932118], 0xd18783d1
mov dword [0x93211c], 0x87da9289
mov word [0x932120], 0xa2da
xor eax, eax
mov dl, byte [eax + 0x932114]
xor dl, 0xa2
mov byte [eax + 0x9327c0], dl
inc eax
cmp eax, 0xe
jb 0x874a84
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x9327c0
push dword [ebp + 0xc]
call fcn.008d716e
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x9063c8]
test eax, eax
je 0x874afb
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00874b48
push eax
push dword [ebp + 0xc]
call fcn.008d716e
add esp, 0x14
test byte [0x9383e0], 1
jne 0x874b1b
or dword [0x9383e0], 1
mov word [0x932134], 0xa8af
mov byte [0x932136], 0xa2
xor eax, eax
mov cl, byte [eax + 0x932134]
xor cl, 0xa2
mov byte [eax + 0x9327e0], cl
inc eax
cmp eax, 3
jb 0x874b1d
push dword [ebp + 0xc]
push 0x9327e0
call fcn.008d6de1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x874b48
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383e4], 1
jne 0x874b80
or dword [0x9383e4], 1
mov dword [0x932124], 0xd1878a82
mov dword [0x932128], 0x82c68798
mov dword [0x93212c], 0xda928289
mov dword [0x932130], 0xa28bda87
xor eax, eax
mov cl, byte [eax + 0x932124]
xor cl, 0xa2
mov byte [eax + 0x9327d0], cl
inc eax
cmp eax, 0x10
jb 0x874b82
mov eax, 0x9327d0
ret

Function at 0x875df6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383d4], 1
jne 0x875e4b
or dword [0x9383d4], 1
mov dword [0x932804], 0xe0f6e5ec
mov dword [0x932808], 0xe1f6e5f3
mov dword [0x93280c], 0xf4e7e5f8
mov dword [0x932810], 0xf7e0f8ed
mov dword [0x932814], 0xf2f8f0e0
mov dword [0x932818], 0xfbfcebe6
mov word [0x93281c], 0xa4fb
xor eax, eax
mov cl, byte [eax + 0x932804]
xor cl, 0xa4
mov byte [eax + 0x932a04], cl
inc eax
cmp eax, 0x1a
jb 0x875e4d
mov eax, 0x932a04
ret

Function at 0x875f5c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383d0], 1
jne 0x875f86
or dword [0x9383d0], 1
mov dword [0x932820], 0xc5f3e9f2
mov word [0x932824], 0xc1d6
mov byte [0x932826], 0xa4
xor eax, eax
mov cl, byte [eax + 0x932820]
xor cl, 0xa4
mov byte [eax + 0x932a20], cl
inc eax
cmp eax, 7
jb 0x875f88
mov eax, 0x932a20
ret

Function at 0x875fa3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383cc], 1
jne 0x875fd0
or dword [0x9383cc], 1
mov dword [0x932828], 0xd0d6cdf2
mov dword [0x93282c], 0xf4c8c5d1
mov word [0x932830], 0xa4e7
xor eax, eax
mov cl, byte [eax + 0x932828]
xor cl, 0xa4
mov byte [eax + 0x932a28], cl
inc eax
cmp eax, 0xa
jb 0x875fd2
mov eax, 0x932a28
ret

Function at 0x875fee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383c8], 1
jne 0x876022
or dword [0x9383c8], 1
mov dword [0x932834], 0xd0d6cdf2
mov dword [0x932838], 0xe6c8c5d1
mov word [0x93283c], 0xdccb
mov byte [0x93283e], 0xa4
xor eax, eax
mov cl, byte [eax + 0x932834]
xor cl, 0xa4
mov byte [eax + 0x932a34], cl
inc eax
cmp eax, 0xb
jb 0x876024
mov eax, 0x932a34
ret

Function at 0x87603f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383c4], 1
jne 0x876063
or dword [0x9383c4], 1
mov dword [0x932840], 0xc1cac1e3
mov dword [0x932844], 0xa4c7cdd6
xor eax, eax
mov cl, byte [eax + 0x932840]
xor cl, 0xa4
mov byte [eax + 0x932a40], cl
inc eax
cmp eax, 8
jb 0x876065
mov eax, 0x932a40
ret
Function at 0x876080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x8fe0f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x9383c0], 1
push esi
jne 0x8760d3
or dword [0x9383c0], 1
mov dword [0x932848], 0xc8c0d0ca
mov dword [0x93284c], 0xc8c08ac8
mov word [0x932850], 0xa4c8
xor eax, eax
mov cl, byte [eax + 0x932848]
xor cl, 0xa4
mov byte [eax + 0x932a48], cl
inc eax
cmp eax, 0xa
jb 0x8760d5
push 0x932a48
call dword [0x9060cc]
mov esi, eax
test esi, esi
jne 0x876147
call dword [0x9060a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0089dc19
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0087628e
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00875bc7
push 0x922d30
mov eax, esi
push eax
call fcn.008e0895
call fcn.008762f4
push eax
push esi
call dword [0x9060c8]
test eax, eax
jne 0x8761a4
call dword [0x9060a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0089dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00876366
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00875bc7
push 0x922d30
mov eax, esi
jmp 0x876141
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x87622c
cmp dword [esp + 4], 0x18
jne 0x87622c
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x9060c4]
test eax, eax
jne 0x87627b
call dword [0x9060a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0089dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.008764a6
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00875bc7
push 0x922d30
mov eax, esi
jmp 0x876141
call dword [0x9060a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0089dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00876419
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00875bc7
push 0x922d30
mov eax, esi
jmp 0x876141
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x87628e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383bc], 1
jne 0x8762d7
or dword [0x9383bc], 1
mov dword [0x932854], 0xc0c5cbe8
mov dword [0x932858], 0xd6c6cde8
mov dword [0x93285c], 0x84ddd6c5
mov dword [0x932860], 0xc8cdc5c2
mov dword [0x932864], 0x849ec0c1
mov byte [0x932868], 0xa4
xor eax, eax
mov cl, byte [eax + 0x932854]
xor cl, 0xa4
mov byte [eax + 0x932a54], cl
inc eax
cmp eax, 0x15
jb 0x8762d9
mov eax, 0x932a54
ret
Function at 0x8762f4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383b8], 1
jne 0x876349
or dword [0x9383b8], 1
mov dword [0x93286c], 0xd1f5d0ea
mov dword [0x932870], 0xedddd6c1
mov dword [0x932874], 0xd6cbc2ca
mov dword [0x932878], 0xcdd0c5c9
mov dword [0x93287c], 0xd6f4cacb
mov dword [0x932880], 0xd7c1c7cb
mov word [0x932884], 0xa4d7
xor eax, eax
mov cl, byte [eax + 0x93286c]
xor cl, 0xa4
mov byte [eax + 0x932a6c], cl
inc eax
cmp eax, 0x1a
jb 0x87634b
mov eax, 0x932a6c
ret

Function at 0x876366
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383b4], 1
jne 0x8763fc
or dword [0x9383b4], 1
mov dword [0x932888], 0xf4d0c1e3
mov dword [0x93288c], 0xe5c7cbd6
mov dword [0x932890], 0xc1d6c0c0
mov dword [0x932894], 0xc284d7d7
mov dword [0x932898], 0xc1c8cdc5
mov dword [0x93289c], 0xea8c84c0
mov dword [0x9328a0], 0xc1d1f5d0
mov dword [0x9328a4], 0xcaedddd6
mov dword [0x9328a8], 0xc9d6cbc2
mov dword [0x9328ac], 0xcbcdd0c5
mov dword [0x9328b0], 0xcbd6f4ca
mov dword [0x9328b4], 0xd7d7c1c7
mov dword [0x9328b8], 0xa4849e8d
xor eax, eax
mov cl, byte [eax + 0x932888]
xor cl, 0xa4
mov byte [eax + 0x932a88], cl
inc eax
cmp eax, 0x34
jb 0x8763fe
mov eax, 0x932a88
ret

Function at 0x876419
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383b0], 1
jne 0x876489
or dword [0x9383b0], 1
mov dword [0x9328bc], 0xd1f5d0ea
mov dword [0x9328c0], 0xedddd6c1
mov dword [0x9328c4], 0xd6cbc2ca
mov dword [0x9328c8], 0xcdd0c5c9
mov dword [0x9328cc], 0xd6f4cacb
mov dword [0x9328d0], 0xd7c1c7cb
mov dword [0x9328d4], 0xc5c284d7
mov dword [0x9328d8], 0xc0c1c8cd
mov word [0x9328dc], 0x849e
mov byte [0x9328de], 0xa4
xor eax, eax
mov cl, byte [eax + 0x9328bc]
xor cl, 0xa4
mov byte [eax + 0x932abc], cl
inc eax
cmp eax, 0x23
jb 0x87648b
mov eax, 0x932abc
ret

Function at 0x8764a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383ac], 1
jne 0x8764ef
or dword [0x9383ac], 1
mov dword [0x9328e0], 0xcac1d4eb
mov dword [0x9328e4], 0xc7cbd6f4
mov dword [0x9328e8], 0x84d7d7c1
mov dword [0x9328ec], 0xc8cdc5c2
mov dword [0x9328f0], 0x849ec0c1
mov byte [0x9328f4], 0xa4
xor eax, eax
mov cl, byte [eax + 0x9328e0]
xor cl, 0xa4
mov byte [eax + 0x932ae0], cl
inc eax
cmp eax, 0x15
jb 0x8764f1
mov eax, 0x932ae0
ret
Function at 0x87650c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x8fe09e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x9383a8], 1
push esi
push edi
jne 0x876569
or dword [0x9383a8], 1
mov dword [0x9328f8], 0xcad6c1cf
mov dword [0x9328fc], 0x9697c8c1
mov dword [0x932900], 0xc8c8c08a
mov byte [0x932904], 0xa4
xor eax, eax
mov cl, byte [eax + 0x9328f8]
xor cl, 0xa4
mov byte [eax + 0x932af8], cl
inc eax
cmp eax, 0xd
jb 0x87656b
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x932af8
call edi
mov esi, eax
test esi, esi
jne 0x8765df
call dword [0x9060a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0089dc19
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00876741
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00875bc7
push 0x922d30
mov eax, esi
push eax
call fcn.008e0895
call fcn.008767be
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x8766ac
call fcn.00876831
push eax
call edi
mov edi, eax
test edi, edi
jne 0x876650
call dword [0x9060a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0089dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0087687b
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00875bc7
push 0x922d30
mov eax, esi
jmp 0x8765d9
call fcn.008768f5
push eax
push edi
call esi
test eax, eax
jne 0x8766ac
call dword [0x9060a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0089dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00876965
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00875bc7
push 0x922d30
mov eax, esi
jmp 0x8765d9
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x87670e
call dword [0x9060a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0089dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00876a1e
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00876adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00875bc7
push 0x922d30
mov eax, esi
jmp 0x8765d9
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00874c4f
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x876741
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9383a4], 1
jne 0x8767a1
or dword [0x9383a4], 1
mov dword [0x932908], 0xc0c5cbe8
mov dword [0x93290c], 0xd6c6cde8
mov dword [0x932910], 0x84ddd6c5
mov dword [0x932914], 0xc8cdc5c2
mov dword [0x932918], 0x8c84c0c1
mov dword [0x93291c], 0xcad6c1cf
mov dword [0x932920], 0x9697c8c1
mov dword [0x932924], 0xa4849e8d
xor eax, eax
mov cl, byte [eax + 0x932908]
xor cl, 0xa4
mov byte [eax + 0x932b08], cl
inc eax
cmp eax, 0x20
jb 0x8767a3
mov eax, 0x932b08
ret