joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf844c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c44], 1
jne 0xf8494
or dword [0x1b2c44], 1
mov dword [0x1adeb0], 0xbcfde9d0
mov dword [0x1adeb4], 0xf3f1f9f1
mov dword [0x1adeb8], 0xf9bce5ee
mov dword [0x1adebc], 0xeef3eeee
mov word [0x1adec0], 0xbca6
mov byte [0x1adec2], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adeb0]
xor cl, 0x9c
mov byte [eax + 0x1ae4a8], cl
inc eax
cmp eax, 0x13
jb 0xf8496
mov eax, 0x1ae4a8
ret

Function at 0xf84b1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c40], 1
jne 0xf8518
or dword [0x1b2c40], 1
mov dword [0x1adec4], 0xbcfde9d0
mov dword [0x1adec8], 0xf3eeeef9
mov dword [0x1adecc], 0xf2f5bcee
mov dword [0x1aded0], 0xf9f8f5ef
mov dword [0x1aded4], 0xeeeef9bc
mov dword [0x1aded8], 0xf4bceef3
mov dword [0x1adedc], 0xf0f8f2fd
mov dword [0x1adee0], 0xbca6eef9
mov byte [0x1adee4], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adec4]
xor cl, 0x9c
mov byte [eax + 0x1ae4bc], cl
inc eax
cmp eax, 0x21
jb 0xf851a
mov eax, 0x1ae4bc
ret

Function at 0xf8535
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c3c], 1
jne 0xf8591
or dword [0x1b2c3c], 1
mov dword [0x1adee8], 0xf2f7f2c9
mov dword [0x1adeec], 0xbcf2ebf3
mov dword [0x1adef0], 0xf3eeeef9
mov dword [0x1adef4], 0xf2f5bcee
mov dword [0x1adef8], 0xfde9f0bc
mov dword [0x1adefc], 0xfdffecc3
mov word [0x1adf00], 0xf0f0
mov byte [0x1adf02], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adee8]
xor cl, 0x9c
mov byte [eax + 0x1ae4e0], cl
inc eax
cmp eax, 0x1b
jb 0xf8593
mov eax, 0x1ae4e0
ret

Function at 0xf87cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c38], 1
jne 0xf8818
or dword [0x1b2c38], 1
mov dword [0x1adf04], 0xf9effdde
mov dword [0x1adf08], 0xf8bca8aa
mov dword [0x1adf0c], 0xf8f3fff9
mov dword [0x1adf10], 0xfdfabcf9
mov dword [0x1adf14], 0xf8f9f0f5
mov byte [0x1adf18], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adf04]
xor cl, 0x9c
mov byte [eax + 0x1ae4fc], cl
inc eax
cmp eax, 0x15
jb 0xf881a
mov eax, 0x1ae4fc
ret
Function at 0xf8835
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x17cae3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0011c8c2
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0011ac8f
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.000f4e23
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.000fadbe
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0xf88c2
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0011f8c8
add esp, 0x10
test al, al
jne 0xf8907
call fcn.000f897e
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00153ae5
push 0x19ec28
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.0015da05
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.000fadbe
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0xf8947
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0xf8926
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.000fa213
lea esi, [esp + 0x20]
call fcn.000fada5
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.000f4ce5
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf897e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c34], 1
jne 0xf89c7
or dword [0x1b2c34], 1
mov dword [0x1adf1c], 0xf9effdde
mov dword [0x1adf20], 0xf8bca8aa
mov dword [0x1adf24], 0xf8f3fff9
mov dword [0x1adf28], 0xfdfabcf9
mov dword [0x1adf2c], 0xf8f9f0f5
mov byte [0x1adf30], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adf1c]
xor cl, 0x9c
mov byte [eax + 0x1ae514], cl
inc eax
cmp eax, 0x15
jb 0xf89c9
mov eax, 0x1ae514
ret

Function at 0xf90bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c30], 1
jne 0xf9110
or dword [0x1b2c30], 1
mov dword [0x1adf34], 0xf0e9f3df
mov dword [0x1adf38], 0xf3f2bcf8
mov dword [0x1adf3c], 0xecf3bce8
mov dword [0x1adf40], 0xffbcf2f9
mov dword [0x1adf44], 0xf4effdee
mov dword [0x1adf48], 0xf1e9f8bc
mov word [0x1adf4c], 0x9cec
xor eax, eax
mov cl, byte [eax + 0x1adf34]
xor cl, 0x9c
mov byte [eax + 0x1ae52c], cl
inc eax
cmp eax, 0x1a
jb 0xf9112
mov eax, 0x1ae52c
ret
Function at 0xf912d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c28], 1
jne 0xf9150
or dword [0x1b2c28], 1
mov dword [0x1adf54], 0xfbf3f0b3
mov word [0x1adf58], 0x9cb3
xor eax, eax
mov cl, byte [eax + 0x1adf54]
xor cl, 0x9c
mov byte [eax + 0x1ae54c], cl
inc eax
cmp eax, 6
jb 0xf9152
mov eax, 0x1ae54c
ret

Function at 0xf916d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c24], 1
jne 0xf91e8
or dword [0x1b2c24], 1
mov dword [0x1adf5c], 0xece8e8f4
mov dword [0x1adf60], 0xfdb3b3a6
mov dword [0x1adf64], 0xe5f0fdf2
mov dword [0x1adf68], 0xeffff5e8
mov dword [0x1adf6c], 0xe8f9fbb2
mov dword [0x1adf70], 0xf2ebf3f8
mov dword [0x1adf74], 0xe8eff9e8
mov dword [0x1adf78], 0xf1f3ffb2
mov dword [0x1adf7c], 0xb3aeeab3
mov dword [0x1adf80], 0xb3fbf3f0
mov byte [0x1adf84], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adf5c]
xor cl, 0x9c
mov byte [eax + 0x1ae554], cl
inc eax
cmp eax, 0x29
jb 0xf91ea
mov eax, 0x1ae554
ret

Function at 0xf9205
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c20], 1
jne 0xf9230
or dword [0x1b2c20], 1
mov dword [0x1adf88], 0xefbaa1ff
mov dword [0x1adf8c], 0xa1e8baa1
mov byte [0x1adf90], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adf88]
xor cl, 0x9c
mov byte [eax + 0x1ae580], cl
inc eax
cmp eax, 9
jb 0xf9232
mov eax, 0x1ae580
ret

Function at 0xf924d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c10], 1
jne 0xf92d5
or dword [0x1b2c10], 1
mov dword [0x1adfa4], 0xe8f2f3df
mov dword [0x1adfa8], 0xb1e8f2f9
mov dword [0x1adfac], 0xf9ece5c8
mov dword [0x1adfb0], 0xecfdbca6
mov dword [0x1adfb4], 0xfff5f0ec
mov dword [0x1adfb8], 0xf3f5e8fd
mov dword [0x1adfbc], 0xb1e4b3f2
mov dword [0x1adfc0], 0xb1ebebeb
mov dword [0x1adfc4], 0xf1eef3fa
mov dword [0x1adfc8], 0xf0eee9b1
mov dword [0x1adfcc], 0xf3fff2f9
mov dword [0x1adfd0], 0x9cf8f9f8
xor eax, eax
mov cl, byte [eax + 0x1adfa4]
xor cl, 0x9c
mov byte [eax + 0x1ae59c], cl
inc eax
cmp eax, 0x30
jb 0xf92d7
mov eax, 0x1ae59c
ret

Function at 0xf92f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c0c], 1
jne 0xf931d
or dword [0x1b2c0c], 1
mov dword [0x1adfd4], 0xc8cfd3cc
mov dword [0x1adfd8], 0xbcf3e8bc
mov byte [0x1adfdc], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adfd4]
xor cl, 0x9c
mov byte [eax + 0x1ae5cc], cl
inc eax
cmp eax, 9
jb 0xf931f
mov eax, 0x1ae5cc
ret

Function at 0xf933a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c08], 1
jne 0xf9383
or dword [0x1b2c08], 1
mov dword [0x1adfe0], 0xf5fdfabc
mov dword [0x1adfe4], 0xbcf8f9f0
mov dword [0x1adfe8], 0xf4e8f5eb
mov dword [0x1adfec], 0xfde8efbc
mov dword [0x1adff0], 0xbcefe9e8
mov byte [0x1adff4], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1adfe0]
xor cl, 0x9c
mov byte [eax + 0x1ae5d8], cl
inc eax
cmp eax, 0x15
jb 0xf9385
mov eax, 0x1ae5d8
ret
Function at 0xf93ba
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x17b36a
call fcn.00179dc8
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0xf956b
cmp dword [ebp + 0x10], ebx
je 0xf956b
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.000fa706
push eax
push 0x19cb68
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.000f5479
push 0x19cb64
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.000f54af
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.000f4e23
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.000f4e23
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0xf94c6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.000fa706
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.000fa728
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0xf947a
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.000fe1d2
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.000f4e23
inc bl
jne 0xf9532
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.000f4e23
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0xf9441
test byte [0x1b2c00], 1
jne 0xf94f3
or dword [0x1b2c00], 1
mov dword [0x1ae004], 0xbce8f3d2
mov dword [0x1ae008], 0xf2e9f3fa
mov word [0x1ae00c], 0x9cf8
xor eax, eax
mov cl, byte [eax + 0x1ae004]
xor cl, 0x9c
mov byte [eax + 0x1ae5fc], cl
inc eax
cmp eax, 0xa
jb 0xf94f5
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x1ae5fc
call fcn.00153ae5
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x19ec28
lea eax, [ebp - 0x44]
push eax
call fcn.0015da05
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.000fa728
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.000f4e23
push 1
lea esi, [ebp - 0x2c]
call fcn.000f4e23
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.000f9590
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.00153ae5
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x19ec28
lea eax, [ebp - 0x38]
jmp 0xf952c

Function at 0xf9590
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2c04], 1
jne 0xf95bd
or dword [0x1b2c04], 1
mov dword [0x1adff8], 0xbce8f3d2
mov dword [0x1adffc], 0xf2e9f3fa
mov word [0x1ae000], 0x9cf8
xor eax, eax
mov cl, byte [eax + 0x1adff8]
xor cl, 0x9c
mov byte [eax + 0x1ae5f0], cl
inc eax
cmp eax, 0xa
jb 0xf95bf
mov eax, 0x1ae5f0
ret
Function at 0xf9d74
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bfc], 1
mov ecx, 0x839c
jne 0xf9dfe
or dword [0x1b2bfc], 1
lea eax, [ecx + 0x63]
mov word [0x1ae010], ax
add eax, 0xffffffef
mov edx, eax
mov word [0x1ae012], dx
lea edx, [ecx + 0x61]
mov word [0x1ae014], dx
add edx, 0xfffffff2
mov word [0x1ae016], dx
lea edx, [ecx + 0x58]
mov word [0x1ae018], dx
add edx, 0xffffffcf
mov word [0x1ae01a], dx
mov edx, eax
mov word [0x1ae01c], dx
lea edx, [ecx + 0x5d]
lea eax, [ecx + 0x4c]
mov word [0x1ae01e], dx
mov word [0x1ae026], ax
add edx, 0xfffffff3
mov eax, ecx
mov word [0x1ae020], dx
mov dword [0x1ae022], 0x83ee83f3
mov word [0x1ae028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1ae010]
add eax, 2
mov word [eax + 0x1ae606], dx
cmp eax, 0x1a
jb 0xf9e00
mov eax, 0x1ae608
ret

Function at 0xf9e1e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bf8], 1
jne 0xf9e49
or dword [0x1b2bf8], 1
mov dword [0x1ae02c], 0xf2eef9f7
mov dword [0x1ae030], 0xaeaff0f9
mov byte [0x1ae034], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1ae02c]
xor cl, 0x9c
mov byte [eax + 0x1ae624], cl
inc eax
cmp eax, 9
jb 0xf9e4b
mov eax, 0x1ae624
ret

Function at 0xf9e66
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bf4], 1
jne 0xf9ecf
or dword [0x1b2bf4], 1
mov dword [0x1ae038], 0xcce8f9cf
mov dword [0x1ae03c], 0xf9fff3ee
mov dword [0x1ae040], 0xefc9efef
mov dword [0x1ae044], 0xf3d1eef9
mov dword [0x1ae048], 0xe4d9f9f8
mov dword [0x1ae04c], 0xe8ecf9ff
mov dword [0x1ae050], 0xccf2f3f5
mov dword [0x1ae054], 0xfff5f0f3
mov word [0x1ae058], 0x9ce5
xor eax, eax
mov cl, byte [eax + 0x1ae038]
xor cl, 0x9c
mov byte [eax + 0x1ae630], cl
inc eax
cmp eax, 0x22
jb 0xf9ed1
mov eax, 0x1ae630
ret

Function at 0xf9eec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bf0], 1
jne 0xf9f55
or dword [0x1b2bf0], 1
mov dword [0x1ae05c], 0xcce8f9db
mov dword [0x1ae060], 0xf9fff3ee
mov dword [0x1ae064], 0xefc9efef
mov dword [0x1ae068], 0xf3d1eef9
mov dword [0x1ae06c], 0xe4d9f9f8
mov dword [0x1ae070], 0xe8ecf9ff
mov dword [0x1ae074], 0xccf2f3f5
mov dword [0x1ae078], 0xfff5f0f3
mov word [0x1ae07c], 0x9ce5
xor eax, eax
mov cl, byte [eax + 0x1ae05c]
xor cl, 0x9c
mov byte [eax + 0x1ae654], cl
inc eax
cmp eax, 0x22
jb 0xf9f57
mov eax, 0x1ae654
ret

Function at 0xf9f72
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bec], 1
jne 0xf9fc8
or dword [0x1b2bec], 1
mov dword [0x1ae080], 0xbcf9f0d3
mov dword [0x1ae084], 0xe8f5f2f5
mov dword [0x1ae088], 0xf5f0fdf5
mov dword [0x1ae08c], 0xf5e8fde6
mov dword [0x1ae090], 0xfabcf2f3
mov dword [0x1ae094], 0xf9f0f5fd
mov dword [0x1ae098], 0x9cbca6f8
xor eax, eax
mov cl, byte [eax + 0x1ae080]
xor cl, 0x9c
mov byte [eax + 0x1ae678], cl
inc eax
cmp eax, 0x1c
jb 0xf9fca
mov eax, 0x1ae678
ret
Function at 0xf9fe6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2be8], 1
mov ecx, 0x839c
jne 0xfa015
or dword [0x1b2be8], 1
lea eax, [ecx + 0x61]
mov word [0x1ae09c], ax
add eax, 0xffffffb1
mov word [0x1ae09e], ax
mov eax, ecx
mov word [0x1ae0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1ae09c]
add eax, 2
mov word [eax + 0x1ae692], dx
cmp eax, 6
jb 0xfa017
mov eax, 0x1ae694
ret

Function at 0xfa035
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2be0], 1
jne 0xfa0a5
or dword [0x1b2be0], 1
mov dword [0x1ae0ac], 0xf0f5fdda
mov dword [0x1ae0b0], 0xe8bcf8f9
mov dword [0x1ae0b4], 0xf2f5bcf3
mov dword [0x1ae0b8], 0xfdf5e8f5
mov dword [0x1ae0bc], 0xf9e6f5f0
mov dword [0x1ae0c0], 0xeaf2f9bc
mov dword [0x1ae0c4], 0xf2f3eef5
mov dword [0x1ae0c8], 0xe8f2f9f1
mov word [0x1ae0cc], 0xbca6
mov byte [0x1ae0ce], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1ae0ac]
xor cl, 0x9c
mov byte [eax + 0x1ae6a4], cl
inc eax
cmp eax, 0x23
jb 0xfa0a7
mov eax, 0x1ae6a4
ret

Function at 0xfa0c2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bd8], 1
jne 0xfa10d
or dword [0x1b2bd8], 1
mov dword [0x1ae0d8], 0xfdf4f2c9
mov dword [0x1ae0dc], 0xf9f0f8f2
mov dword [0x1ae0e0], 0xe4f9bcf8
mov dword [0x1ae0e4], 0xe8ecf9ff
mov dword [0x1ae0e8], 0xa6f2f3f5
mov word [0x1ae0ec], 0x9cbc
xor eax, eax
mov cl, byte [eax + 0x1ae0d8]
xor cl, 0x9c
mov byte [eax + 0x1ae6d0], cl
inc eax
cmp eax, 0x16
jb 0xfa10f
mov eax, 0x1ae6d0
ret

Function at 0xfa12a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bd4], 1
jne 0xfa17d
or dword [0x1b2bd4], 1
mov dword [0x1ae0f0], 0xfdf4f2c9
mov dword [0x1ae0f4], 0xf9f0f8f2
mov dword [0x1ae0f8], 0xe4f9bcf8
mov dword [0x1ae0fc], 0xe8ecf9ff
mov dword [0x1ae100], 0xa6f2f3f5
mov dword [0x1ae104], 0x96efb9bc
mov byte [0x1ae108], 0x9c
xor eax, eax
mov cl, byte [eax + 0x1ae0f0]
xor cl, 0x9c
mov byte [eax + 0x1ae6e8], cl
inc eax
cmp eax, 0x19
jb 0xfa17f
mov eax, 0x1ae6e8
ret

Function at 0xfa19a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bd0], 1
jne 0xfa1d2
or dword [0x1b2bd0], 1
mov dword [0x1ae10c], 0xfee9e8cf
mov dword [0x1ae110], 0xf5e4f9bc
mov dword [0x1ae114], 0xb9b4bce8
mov dword [0x1ae118], 0x9c96b5f8
xor eax, eax
mov cl, byte [eax + 0x1ae10c]
xor cl, 0x9c
mov byte [eax + 0x1ae704], cl
inc eax
cmp eax, 0x10
jb 0xfa1d4
mov eax, 0x1ae704
ret
Function at 0xfbbc8
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x17ab69
call fcn.00179dc8
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0xfbcac
cmp byte [edi + 0x49], bl
je 0xfbcac
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0xfbbff
xor al, al
jmp 0xfbcae
push esi
lea esi, [ebp - 0x2c]
call fcn.000fb6c1
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xfbc4f
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0xfbc54
dec eax
je 0xfbc58
dec eax
dec eax
je 0xfbca8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.000f4ce5
mov al, bl
pop esi
jmp 0xfbcae
mov edx, dword [ebp - 0x2c]
jmp 0xfbc19
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xfbc64
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0xfbc8a
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0xfbc77
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.001558be
add esp, 0x10
cmp esi, eax
jne 0xfbc3c
cmp byte [edi + 0x49], 0
je 0xfbca8
test esi, esi
jne 0xfbc0b
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.000fb79a
jmp 0xfbc0b
mov bl, 1
jmp 0xfbc3e
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10054a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bcc], 1
jne 0x1005be
or dword [0x1b2bcc], 1
mov dword [0x1ae724], 0xf3eaf0dc
mov dword [0x1ae728], 0xf0f1bffb
mov dword [0x1ae72c], 0xfaf8bfeb
mov dword [0x1ae730], 0xf6fbbfeb
mov dword [0x1ae734], 0xfbf6efec
mov dword [0x1ae738], 0xbff9f0bf
mov dword [0x1ae73c], 0xf7ebfaf2
mov dword [0x1ae740], 0xb8bffbf0
mov dword [0x1ae744], 0xf3f3fefc
mov dword [0x1ae748], 0x9fbfa5b8
xor eax, eax
mov cl, byte [eax + 0x1ae724]
xor cl, 0x9f
mov byte [eax + 0x1ae868], cl
inc eax
cmp eax, 0x28
jb 0x1005c0
mov eax, 0x1ae868
ret

Function at 0x1005db
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bc8], 1
jne 0x100642
or dword [0x1b2bc8], 1
mov dword [0x1ae74c], 0xf3f6fed9
mov dword [0x1ae750], 0xebbffbfa
mov dword [0x1ae754], 0xf1f6bff0
mov dword [0x1ae758], 0xfaf4f0e9
mov dword [0x1ae75c], 0xebfaf2bf
mov dword [0x1ae760], 0xbffbf0f7
mov dword [0x1ae764], 0xf3fefcb8
mov dword [0x1ae768], 0xbfa5b8f3
mov byte [0x1ae76c], 0x9f
xor eax, eax
mov cl, byte [eax + 0x1ae74c]
xor cl, 0x9f
mov byte [eax + 0x1ae890], cl
inc eax
cmp eax, 0x21
jb 0x100644
mov eax, 0x1ae890
ret
Function at 0x10065f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bc4], 1
jne 0x1006bf
or dword [0x1b2bc4], 1
mov dword [0x1ae770], 0xf0edcf95
mov dword [0x1ae774], 0xf3fdfefd
mov dword [0x1ae778], 0xeafbbfe6
mov dword [0x1ae77c], 0xf0ebbffa
mov dword [0x1ae780], 0xedfcecbf
mov dword [0x1ae784], 0xbfebeff6
mov dword [0x1ae788], 0xf0ededfa
mov dword [0x1ae78c], 0x9fbfa5ed
xor eax, eax
mov cl, byte [eax + 0x1ae770]
xor cl, 0x9f
mov byte [eax + 0x1ae8b4], cl
inc eax
cmp eax, 0x20
jb 0x1006c1
mov eax, 0x1ae8b4
ret

Function at 0x100c87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x100dcc
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x1b2bc0], 1
jne 0x100ce9
or dword [0x1b2bc0], 1
mov eax, 0x83ec
mov word [0x1ae790], ax
add eax, 0xe
mov word [0x1ae792], ax
mov eax, 0x83f1
mov word [0x1ae794], ax
add eax, 0xa
mov word [0x1ae796], ax
mov eax, 0x839f
mov word [0x1ae798], ax
xor eax, eax
mov ecx, 0x839f
xor cx, word [eax + 0x1ae790]
add eax, 2
mov word [eax + 0x1ae8d2], cx
cmp eax, 0xa
jb 0x100ceb
mov eax, dword [ebx + edi]
mov ecx, 0x1ae8d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100d32
test dx, dx
je 0x100d2e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100d32
add eax, esi
add ecx, esi
test dx, dx
jne 0x100d0e
xor eax, eax
jmp 0x100d37
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100d43
mov dword [edi], 0x385
jmp 0x100dbb
call fcn.00100ddc
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100d6f
test dx, dx
je 0x100d6b
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100d6f
add ecx, esi
add eax, esi
test dx, dx
jne 0x100d4b
xor eax, eax
jmp 0x100d74
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100d80
mov dword [edi], 0x386
jmp 0x100dbb
call fcn.00100eaf
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100dac
test dx, dx
je 0x100da8
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100dac
add ecx, esi
add eax, esi
test dx, dx
jne 0x100d88
xor eax, eax
jmp 0x100db1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100dd5
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x100ca6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x100dce
Function at 0x100ddc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bbc], 1
jne 0x100e8c
or dword [0x1b2bbc], 1
mov eax, 0x83fe
mov word [0x1ae79c], ax
add eax, 0xfffffffd
mov ecx, eax
mov word [0x1ae7a0], ax
mov eax, 0x83da
mov word [0x1ae7a2], ax
add eax, 0xf
mov word [0x1ae7a4], ax
mov eax, 0x83fa
mov word [0x1ae79e], cx
mov ecx, eax
lea edx, [eax - 9]
mov word [0x1ae7a6], cx
mov ecx, edx
push edi
mov word [0x1ae7a8], cx
add ecx, 0xfffffffa
mov edi, ecx
mov word [0x1ae7aa], di
lea edi, [eax - 0x27]
mov word [0x1ae7ac], di
add edi, 0x23
mov ecx, eax
add eax, 0xfffffff3
mov word [0x1ae7ba], ax
lea eax, [ecx - 0x5b]
mov word [0x1ae7ae], di
mov dword [0x1ae7b0], 0x83eb83ec
mov word [0x1ae7b4], cx
mov dword [0x1ae7b6], 0x83fa83f1
mov word [0x1ae7bc], ax
pop edi
xor eax, eax
mov ecx, 0x839f
xor cx, word [eax + 0x1ae79c]
add eax, 2
mov word [eax + 0x1ae8de], cx
cmp eax, 0x22
jb 0x100e8e
mov eax, 0x1ae8e0
ret

Function at 0x100eaf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bb8], 1
mov ecx, 0x839f
jne 0x100f09
or dword [0x1b2bb8], 1
lea eax, [ecx + 0x4a]
mov word [0x1ae7c0], ax
add eax, 0x11
mov word [0x1ae7c2], ax
lea eax, [ecx + 0x4e]
mov word [0x1ae7c4], ax
dec eax
mov word [0x1ae7c6], ax
lea eax, [ecx + 0x57]
mov word [0x1ae7c8], ax
add eax, 0xfffffffa
mov word [0x1ae7ca], ax
lea eax, [ecx + 0x52]
mov word [0x1ae7cc], ax
mov eax, ecx
mov word [0x1ae7ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1ae7c0]
add eax, 2
mov word [eax + 0x1ae902], dx
cmp eax, 0x10
jb 0x100f0b
mov eax, 0x1ae904
ret

Function at 0x1018c8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bb4], 1
mov edx, 0x839f
jne 0x10192b
or dword [0x1b2bb4], 1
lea ecx, [edx + 0x5b]
mov eax, ecx
mov word [0x1ae7d0], ax
add eax, 0xfffffff3
push esi
mov esi, eax
lea eax, [edx + 0x34]
mov word [0x1ae7da], ax
add eax, 0x23
mov word [0x1ae7dc], ax
mov eax, edx
mov word [0x1ae7d2], si
mov word [0x1ae7d4], si
mov dword [0x1ae7d6], 0x83ed83f0
mov dword [0x1ae7de], 0x83fa83f1
mov word [0x1ae7e2], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x1ae7d0]
add eax, 2
mov word [eax + 0x1ae912], cx
cmp eax, 0x14
jb 0x10192d
mov eax, 0x1ae914
ret

Function at 0x10194b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2bb0], 1
jne 0x1019e7
or dword [0x1b2bb0], 1
mov edx, 0x83fa
mov eax, edx
mov word [0x1ae7e4], ax
add eax, 0xfffffff3
mov ecx, eax
mov word [0x1ae7e6], cx
mov word [0x1ae7e8], cx
lea ecx, [edx - 0xa]
mov word [0x1ae7ea], cx
mov ecx, eax
mov word [0x1ae7ec], cx
lea ecx, [edx - 0x1e]
mov word [0x1ae7ee], cx
add ecx, 0x1b
mov word [0x1ae7f0], cx
lea ecx, [edx + 4]
push edi
mov edi, ecx
mov word [0x1ae7f2], di
mov edi, eax
mov word [0x1ae7f6], cx
mov word [0x1ae7fe], ax
add ecx, 0xfffffffe
lea eax, [edx - 0x5b]
mov word [0x1ae7f4], di
mov word [0x1ae7f8], cx
mov dword [0x1ae7fa], 0x83fa83eb
mov word [0x1ae800], ax
pop edi
xor eax, eax
mov ecx, 0x839f
xor cx, word [eax + 0x1ae7e4]
add eax, 2
mov word [eax + 0x1ae926], cx
cmp eax, 0x1e
jb 0x1019e9
mov eax, 0x1ae928
ret