joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb68d9c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d78], 1
jne 0xb68fbe
or dword [0xc07d78], 1
push ebx
push esi
push edi
mov edi, 0xc4ce
mov eax, edi
mov word [0xc069c8], ax
dec eax
mov word [0xc069ca], ax
lea esi, [edi - 0xb]
mov eax, esi
mov word [0xc069cc], ax
add eax, 0x1c
mov word [0xc069ce], ax
lea edx, [edi + 0xb]
mov eax, edx
mov word [0xc069d0], ax
lea ecx, [edi - 4]
mov eax, ecx
mov word [0xc069d2], ax
dec eax
mov word [0xc069d4], ax
lea eax, [edi - 9]
mov word [0xc069d6], ax
add eax, 2
mov ebx, eax
mov word [0xc069d8], bx
mov word [0xc069e0], ax
lea ebx, [edi - 3]
mov ecx, ebx
lea eax, [edi + 1]
mov word [0xc069e6], ax
inc edx
mov eax, edx
mov word [0xc069ec], ax
lea eax, [edi + 7]
mov word [0xc069ee], ax
mov word [0xc069de], cx
add ecx, 0x1e
mov eax, ecx
mov word [0xc069f0], ax
lea eax, [edi + 0x12]
mov word [0xc069f2], ax
add eax, 0x12
mov word [0xc069f4], ax
lea eax, [edi + 0x23]
add edi, 0x19
mov word [0xc069f6], ax
mov eax, edi
mov word [0xc069f8], ax
lea eax, [esi + 0x31]
mov esi, eax
mov word [0xc069fa], si
add esi, 0xffffffef
mov word [0xc06a00], bx
mov word [0xc069fc], si
mov esi, edx
mov word [0xc069fe], si
lea esi, [ebx + 0x24]
mov ebx, esi
mov word [0xc06a02], bx
add ebx, 0xfffffff6
mov word [0xc06a04], bx
mov ebx, eax
mov word [0xc06a06], bx
mov ebx, ecx
mov word [0xc06a08], bx
lea ebx, [eax + 1]
mov word [0xc06a0a], bx
mov ebx, ecx
mov word [0xc06a0c], bx
lea ebx, [eax - 0x14]
mov word [0xc06a0e], bx
add ebx, 0x12
mov word [0xc06a10], bx
mov ebx, edx
mov word [0xc06a12], bx
mov dword [0xc069da], 0xc4d9c4ca
mov dword [0xc069e2], 0xc4cec4c5
mov dword [0xc069e8], 0xc4c3c4c8
lea ebx, [eax - 0x2f]
mov word [0xc06a14], bx
mov ebx, eax
mov word [0xc06a16], bx
add ebx, 0xb
mov word [0xc06a18], bx
lea ebx, [eax + 2]
mov eax, edi
mov word [0xc06a24], ax
mov eax, ebx
mov word [0xc06a26], ax
add eax, 0xfffffff8
mov ecx, eax
mov eax, esi
mov word [0xc06a36], ax
add eax, 0xfffffff9
mov word [0xc06a38], ax
lea eax, [esi - 0xc]
mov word [0xc06a3a], ax
add eax, 0xffffffde
mov word [0xc06a3c], ax
lea eax, [esi - 0xd]
pop edi
mov word [0xc06a42], ax
add eax, 0xffffffa4
pop esi
mov word [0xc06a1a], bx
mov dword [0xc06a1c], 0xc4e9c4f2
mov dword [0xc06a20], 0xc4f4c4e1
mov word [0xc06a28], cx
mov dword [0xc06a2a], 0xc4dac4ff
mov dword [0xc06a2e], 0xc4e7c4cb
mov dword [0xc06a32], 0xc4eec4e5
mov dword [0xc06a3e], 0xc4efc4f3
mov word [0xc06a44], ax
pop ebx
xor eax, eax
mov ecx, 0xc486
xor cx, word [eax + 0xc069c8]
add eax, 2
mov word [eax + 0xc06a86], cx
cmp eax, 0x7e
jb 0xb68fc0
mov eax, 0xc06a88
ret
Function at 0xb69a62
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0xb69c24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0xb69c66
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0xbefee0]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0xbefee0]
inc edx
cmp dword [ebp + 8], 0
jne 0xb69c31
pop esi
not eax
pop ebp
ret

Function at 0xb6b8b1
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0xb6b8d6
cmp dword [ecx + 0x38], ebx
je 0xb6b8d6
cmp eax, dword [ecx + 0x10]
jae 0xb6b8d6
cmp dword [ecx + 0x14], 1
jne 0xb6b8d6
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0xb6b8d8
xor edi, edi
cmp edi, ebx
je 0xb6b9bb
cmp esi, ebx
je 0xb6b9bb
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00b6b05a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0xb6b967
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00ba9f10
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0xb6b98c
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00ba9f10
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0xb6b9bd
xor eax, eax
pop edi
pop ebx
ret
Function at 0xb6cc76
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d70], 1
jne 0xb6ccfb
or dword [0xc07d70], 1
mov dword [0xc06b0c], 0xe5e0e8cf
mov dword [0xc06b10], 0xfda9edec
mov dword [0xc06b14], 0xfbeaa9e6
mov dword [0xc06b18], 0xecfde8ec
mov dword [0xc06b1c], 0xe8fce5a9
mov dword [0xc06b20], 0xe8fdfaa9
mov dword [0xc06b24], 0xa1a9ecfd
mov dword [0xc06b28], 0xe2fbe6fe
mov dword [0xc06b2c], 0xfda9fbec
mov dword [0xc06b30], 0xe8ecfbe1
mov dword [0xc06b34], 0xa9b3a0ed
mov byte [0xc06b38], 0x89
xor eax, eax
mov cl, byte [eax + 0xc06b0c]
xor cl, 0x89
mov byte [eax + 0xc06bd4], cl
inc eax
cmp eax, 0x2d
jb 0xb6ccfd
mov eax, 0xc06bd4
ret

Function at 0xb6cd18
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d60], 1
jne 0xb6cd7f
or dword [0xc07d60], 1
mov dword [0xc06b48], 0xeca9e6c7
mov dword [0xc06b4c], 0xfbe6fbfb
mov dword [0xc06b50], 0xfaece4a9
mov dword [0xc06b54], 0xeceee8fa
mov dword [0xc06b58], 0xfdecfba9
mov dword [0xc06b5c], 0xece7fbfc
mov dword [0xc06b60], 0xf0eba9ed
mov dword [0xc06b64], 0xebe6e3a9
mov byte [0xc06b68], 0x89
xor eax, eax
mov cl, byte [eax + 0xc06b48]
xor cl, 0x89
mov byte [eax + 0xc06c10], cl
inc eax
cmp eax, 0x21
jb 0xb6cd81
mov eax, 0xc06c10
ret

Function at 0xb6cd9c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d54], 1
jne 0xb6ce05
or dword [0xc07d54], 1
mov dword [0xc06b94], 0xa9e8fcc5
mov dword [0xc06b98], 0xe6fbfbec
mov dword [0xc06b9c], 0xfcfba9fb
mov dword [0xc06ba0], 0xe7e0e7e7
mov dword [0xc06ba4], 0xfbeca9ee
mov dword [0xc06ba8], 0xa9fbe6fb
mov dword [0xc06bac], 0xede7e8e1
mov dword [0xc06bb0], 0xb3fbece5
mov word [0xc06bb4], 0x89a9
xor eax, eax
mov cl, byte [eax + 0xc06b94]
xor cl, 0x89
mov byte [eax + 0xc06c5c], cl
inc eax
cmp eax, 0x22
jb 0xb6ce07
mov eax, 0xc06c5c
ret

Function at 0xb6ce22
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d50], 1
jne 0xb6ce74
or dword [0xc07d50], 1
mov dword [0xc06bb8], 0xc5e8fce5
mov dword [0xc06bbc], 0xe8e6e5d6
mov dword [0xc06bc0], 0xfbfdfaed
mov dword [0xc06bc4], 0xa9eee7e0
mov dword [0xc06bc8], 0xe5e0e8ef
mov word [0xc06bcc], 0xedec
mov byte [0xc06bce], 0x89
xor eax, eax
mov cl, byte [eax + 0xc06bb8]
xor cl, 0x89
mov byte [eax + 0xc06c80], cl
inc eax
cmp eax, 0x17
jb 0xb6ce76
mov eax, 0xc06c80
ret
Function at 0xb6dbe9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xbcdbbd
call fcn.00bccc28
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0xbd6134]
test eax, eax
jne 0xb6dc31
call fcn.00b6dd8a
mov ecx, dword [ebp + 8]
push eax
call fcn.00b46ac4
mov eax, dword [ebp + 8]
jmp 0xb6dd7b
test byte [0xc07d44], 1
jne 0xb6dc52
or dword [0xc07d44], 1
mov dword [0xc06cbc], 0xab818682
mov byte [0xc06cc0], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06cbc]
xor cl, 0x8b
mov byte [eax + 0xc073fc], cl
inc eax
cmp eax, 5
jb 0xb6dc54
push 0xf
mov esi, 0xc073fc
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0xb6dc7f
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00b44e57
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00b44c72
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00b722eb
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00b44c93
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00b44c93
push dword [ebp - 0x10]
call dword [0xbd60e8]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.00b6e0d5
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.00b6ddf3
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00b46b01
add esp, 0xc
push 0xbf139c
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.00b4efb1
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.00b4c95f
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00b44c93
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00b44c93
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00b44c93
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00b44c28
push ebx
push 1
mov ecx, esi
call fcn.00b44c93
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0xb6dd8a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d48], 1
jne 0xb6ddd6
or dword [0xc07d48], 1
mov dword [0xc06ca4], 0xeef9e5de
mov dword [0xc06ca8], 0xe5ece4e8
mov dword [0xc06cac], 0xefeef1e2
mov dword [0xc06cb0], 0xf9f9eeab
mov dword [0xc06cb4], 0xe8abf9e4
mov dword [0xc06cb8], 0x8beeefe4
xor eax, eax
mov cl, byte [eax + 0xc06ca4]
xor cl, 0x8b
mov byte [eax + 0xc073e4], cl
inc eax
cmp eax, 0x18
jb 0xb6ddd8
mov eax, 0xc073e4
ret

Function at 0xb6ddf3
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d40], 1
jne 0xb6de31
or dword [0xc07d40], 1
mov dword [0xc06cc4], 0xf9eea3ab
mov dword [0xc06cc8], 0xabf9e4f9
mov dword [0xc06ccc], 0xeeefe4e8
mov word [0xc06cd0], 0xabb1
mov byte [0xc06cd2], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06cc4]
xor cl, 0x8b
mov byte [eax + 0xc07404], cl
inc eax
cmp eax, 0xf
jb 0xb6de33
mov eax, 0xc07404
ret
Function at 0xb6e0d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0xc07d3c], 1
jne 0xb6e100
or dword [0xc07d3c], 1
mov dword [0xc06cd4], 0xefe7e7ae
mov byte [0xc06cd8], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06cd4]
xor cl, 0x8b
mov byte [eax + 0xc07414], cl
inc eax
cmp eax, 5
jb 0xb6e102
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0xc07414
push eax
call fcn.00b72344
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00b44c72
mov eax, esi
leave
ret

Function at 0xb6e2a4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d38], 1
jne 0xb6e300
or dword [0xc07d38], 1
mov dword [0xc06cdc], 0xc6ffeecc
mov dword [0xc06ce0], 0xe7feefe4
mov dword [0xc06ce4], 0xe7e2cdee
mov dword [0xc06ce8], 0xe6eac5ee
mov dword [0xc06cec], 0xeaedabee
mov dword [0xc06cf0], 0xefeee7e2
mov word [0xc06cf4], 0xabb1
mov byte [0xc06cf6], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06cdc]
xor cl, 0x8b
mov byte [eax + 0xc0741c], cl
inc eax
cmp eax, 0x1b
jb 0xb6e302
mov eax, 0xc0741c
ret

Function at 0xb6e31d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d34], 1
jne 0xb6e37a
or dword [0xc07d34], 1
mov dword [0xc06cf8], 0xc8ffeed8
mov dword [0xc06cfc], 0xeef9f9fe
mov dword [0xc06d00], 0xe2cfffe5
mov dword [0xc06d04], 0xffe8eef9
mov dword [0xc06d08], 0xabf2f9e4
mov dword [0xc06d0c], 0xe7e2eaed
mov dword [0xc06d10], 0xabb1efee
mov byte [0xc06d14], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06cf8]
xor cl, 0x8b
mov byte [eax + 0xc07438], cl
inc eax
cmp eax, 0x1d
jb 0xb6e37c
mov eax, 0xc07438
ret

Function at 0xb6e48e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d30], 1
jne 0xb6e4eb
or dword [0xc07d30], 1
mov dword [0xc06d18], 0xc8ffeecc
mov dword [0xc06d1c], 0xeef9f9fe
mov dword [0xc06d20], 0xe2cfffe5
mov dword [0xc06d24], 0xffe8eef9
mov dword [0xc06d28], 0xabf2f9e4
mov dword [0xc06d2c], 0xe7e2eaed
mov dword [0xc06d30], 0xabb1efee
mov byte [0xc06d34], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06d18]
xor cl, 0x8b
mov byte [eax + 0xc07458], cl
inc eax
cmp eax, 0x1d
jb 0xb6e4ed
mov eax, 0xc07458
ret
Function at 0xb6e6a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d2c], 1
jne 0xb6e813
or dword [0xc07d2c], 1
mov eax, 0xc4d7
mov ecx, eax
mov word [0xc06d38], cx
mov word [0xc06d3a], cx
inc ecx
mov word [0xc06d3c], cx
lea ecx, [eax + 0x28]
mov word [0xc06d3e], cx
add ecx, 0xfffffffa
lea edx, [eax + 0xb]
mov word [0xc06d40], cx
push ebx
mov ecx, edx
mov word [0xc06d42], cx
add ecx, 3
push esi
mov esi, ecx
lea ecx, [eax + 0x16]
mov word [0xc06d44], si
lea esi, [eax + 0x15]
mov word [0xc06d46], si
mov word [0xc06d54], cx
add esi, 0xfffffff8
add edx, 5
mov ecx, esi
push edi
lea edi, [eax + 0x17]
mov word [0xc06d56], cx
mov ecx, eax
mov word [0xc06d4c], dx
mov edx, edi
mov word [0xc06d58], cx
mov word [0xc06d5a], cx
add ecx, 0xffffffe4
mov word [0xc06d4e], dx
mov edx, ecx
mov word [0xc06d5c], dx
lea edx, [eax - 0x18]
mov ebx, edx
mov word [0xc06d5e], bx
mov ebx, ecx
mov word [0xc06d60], bx
lea ebx, [eax - 0x25]
mov word [0xc06d6e], ax
mov word [0xc06d62], bx
mov ebx, ecx
mov ecx, eax
add eax, 4
mov word [0xc06d70], ax
lea eax, [ecx + 0x18]
mov word [0xc06d76], ax
add eax, 0xf
mov word [0xc06d78], ax
lea eax, [ecx + 0x11]
mov word [0xc06d7a], ax
add eax, 0x17
mov word [0xc06d7c], ax
lea eax, [ecx - 0x12]
mov word [0xc06d7e], ax
add eax, 0x25
pop edi
mov word [0xc06d80], ax
lea eax, [ecx - 0x4c]
pop esi
mov word [0xc06d64], bx
mov dword [0xc06d48], 0xc4e2c4cd
mov dword [0xc06d50], 0xc4e5c4c2
mov word [0xc06d66], dx
mov dword [0xc06d68], 0xc4bbc4c9
mov word [0xc06d6c], cx
mov dword [0xc06d72], 0xc4e4c4f9
mov dword [0xc06d82], 0xc4eec4e6
mov word [0xc06d86], ax
pop ebx
xor eax, eax
mov ecx, 0xc48b
xor cx, word [eax + 0xc06d38]
add eax, 2
mov word [eax + 0xc07476], cx
cmp eax, 0x50
jb 0xb6e815
mov eax, 0xc07478
ret

Function at 0xb6e836
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d28], 1
jne 0xb6e88b
or dword [0xc07d28], 1
mov dword [0xc06d88], 0xfdabe4c5
mov dword [0xc06d8c], 0xe2f8f9ee
mov dword [0xc06d90], 0xe2abe5e4
mov dword [0xc06d94], 0xabe4ede5
mov dword [0xc06d98], 0xe2eafdea
mov dword [0xc06d9c], 0xe7e9eae7
mov word [0xc06da0], 0x8bee
xor eax, eax
mov cl, byte [eax + 0xc06d88]
xor cl, 0x8b
mov byte [eax + 0xc074c8], cl
inc eax
cmp eax, 0x1a
jb 0xb6e88d
mov eax, 0xc074c8
ret

Function at 0xb6ea7a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d24], 1
jne 0xb6eacf
or dword [0xc07d24], 1
mov dword [0xc06da4], 0xfdabe4c5
mov dword [0xc06da8], 0xe2f8f9ee
mov dword [0xc06dac], 0xe2abe5e4
mov dword [0xc06db0], 0xabe4ede5
mov dword [0xc06db4], 0xe2eafdea
mov dword [0xc06db8], 0xe7e9eae7
mov word [0xc06dbc], 0x8bee
xor eax, eax
mov cl, byte [eax + 0xc06da4]
xor cl, 0x8b
mov byte [eax + 0xc074e4], cl
inc eax
cmp eax, 0x1a
jb 0xb6ead1
mov eax, 0xc074e4
ret
Function at 0xb6eaec
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d20], 1
jne 0xb6eb52
or dword [0xc07d20], 1
mov dword [0xc06dc0], 0xeafde5c2
mov dword [0xc06dc4], 0xabefe2e7
mov dword [0xc06dc8], 0xf8f9eefd
mov dword [0xc06dcc], 0xabe5e4e2
mov dword [0xc06dd0], 0xe4ede5e2
mov dword [0xc06dd4], 0xece2f8ab
mov dword [0xc06dd8], 0xfeffeae5
mov word [0xc06ddc], 0xeef9
mov byte [0xc06dde], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06dc0]
xor cl, 0x8b
mov byte [eax + 0xc07500], cl
inc eax
cmp eax, 0x1f
jb 0xb6eb54
mov eax, 0xc07500
ret

Function at 0xb6ee59
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d1c], 1
jne 0xb6eed8
or dword [0xc07d1c], 1
or al, 0xff
mov dword [0xc06de0], 0xe7e2eacd
mov word [0xc06de4], 0xefee
mov byte [0xc06de6], 0xab
mov byte [0xc06de7], al
mov dword [0xc06de8], 0xeeecabe4
mov byte [0xc06dec], al
mov byte [0xc06ded], 0xab
mov byte [0xc06dee], al
mov dword [0xc06def], 0xabfbe6ee
mov dword [0xc06df3], 0xefe7e4ed
mov dword [0xc06df7], 0xfbabf9ee
mov byte [0xc06dfb], 0xea
mov byte [0xc06dfc], al
mov word [0xc06dfd], 0x8be3
xor eax, eax
mov cl, byte [eax + 0xc06de0]
xor cl, 0x8b
mov byte [eax + 0xc07520], cl
inc eax
cmp eax, 0x1f
jb 0xb6eeda
mov eax, 0xc07520
ret

Function at 0xb6f04a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d18], 1
jne 0xb6f09c
or dword [0xc07d18], 1
mov dword [0xc06e00], 0xcdffeecc
mov dword [0xc06e04], 0xeeefe7e4
mov dword [0xc06e08], 0xffeadbf9
mov dword [0xc06e0c], 0xeaedabe3
mov dword [0xc06e10], 0xefeee7e2
mov word [0xc06e14], 0xabb1
mov byte [0xc06e16], 0x8b
xor eax, eax
mov cl, byte [eax + 0xc06e00]
xor cl, 0x8b
mov byte [eax + 0xc07540], cl
inc eax
cmp eax, 0x17
jb 0xb6f09e
mov eax, 0xc07540
ret

Function at 0xb6f366
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d14], 1
mov edx, 0xc48b
jne 0xb6f3fd
or dword [0xc07d14], 1
lea ecx, [edx + 0x23]
mov eax, ecx
mov word [0xc06e18], ax
add eax, 0x2d
mov word [0xc06e1a], ax
push esi
lea eax, [edx + 0x6e]
mov esi, eax
add eax, 0xfffffff1
mov word [0xc06e24], ax
lea eax, [edx + 0x5b]
mov word [0xc06e26], ax
add eax, 0xfffffff6
mov word [0xc06e28], ax
lea eax, [edx + 0x32]
mov word [0xc06e1c], si
add esi, 0xffffffeb
mov word [0xc06e2a], ax
add eax, 2
mov word [0xc06e2c], ax
lea eax, [edx + 0x2d]
mov word [0xc06e2e], ax
mov eax, edx
mov word [0xc06e1e], si
mov dword [0xc06e20], 0xc4f9c4ec
mov dword [0xc06e30], 0xc4aec4b9
mov word [0xc06e34], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xc06e18]
add eax, 2
mov word [eax + 0xc07556], cx
cmp eax, 0x1e
jb 0xb6f3ff
mov eax, 0xc07558
ret

Function at 0xb6f41d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d10], 1
mov ecx, 0xc48b
jne 0xb6f45e
or dword [0xc07d10], 1
lea eax, [ecx + 0x65]
mov word [0xc06e38], ax
add eax, 0xb
mov word [0xc06e3a], ax
lea eax, [ecx + 0x62]
mov word [0xc06e3c], ax
add eax, 9
mov word [0xc06e3e], ax
mov eax, ecx
mov word [0xc06e40], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc06e38]
add eax, 2
mov word [eax + 0xc07576], dx
cmp eax, 0xa
jb 0xb6f460
mov eax, 0xc07578
ret
Function at 0xb6f47e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d0c], 1
mov ecx, 0xc48b
jne 0xb6f4d1
or dword [0xc07d0c], 1
lea eax, [ecx + 0x65]
mov word [0xc06e44], ax
add eax, 0xb
mov word [0xc06e46], ax
lea eax, [ecx + 0x62]
mov word [0xc06e48], ax
add eax, 0xffffffcb
mov word [0xc06e4a], ax
lea eax, [ecx + 0x2e]
mov word [0xc06e4c], ax
add eax, 0x3d
mov word [0xc06e4e], ax
mov eax, ecx
mov word [0xc06e50], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc06e44]
add eax, 2
mov word [eax + 0xc07582], dx
cmp eax, 0xe
jb 0xb6f4d3
mov eax, 0xc07584
ret

Function at 0xb6f4f1
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d08], 1
mov ecx, 0xc48b
jne 0xb6f544
or dword [0xc07d08], 1
lea eax, [ecx + 0x65]
mov word [0xc06e54], ax
add eax, 0xb
mov word [0xc06e56], ax
lea eax, [ecx + 0x62]
mov word [0xc06e58], ax
add eax, 0xffffffd0
mov word [0xc06e5a], ax
lea eax, [ecx + 0x34]
mov word [0xc06e5c], ax
add eax, 0x37
mov word [0xc06e5e], ax
mov eax, ecx
mov word [0xc06e60], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc06e54]
add eax, 2
mov word [eax + 0xc07592], dx
cmp eax, 0xe
jb 0xb6f546
mov eax, 0xc07594
ret

Function at 0xb6f564
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d04], 1
mov ecx, 0xc48b
jne 0xb6f5a5
or dword [0xc07d04], 1
lea eax, [ecx + 0x65]
mov word [0xc06e64], ax
add eax, 0xb
mov word [0xc06e66], ax
lea eax, [ecx + 0x62]
mov word [0xc06e68], ax
add eax, 9
mov word [0xc06e6a], ax
mov eax, ecx
mov word [0xc06e6c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc06e64]
add eax, 2
mov word [eax + 0xc075a2], dx
cmp eax, 0xa
jb 0xb6f5a7
mov eax, 0xc075a4
ret

Function at 0xb6f5c5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07d00], 1
mov ecx, 0xc48b
jne 0xb6f618
or dword [0xc07d00], 1
lea eax, [ecx + 0x65]
mov word [0xc06e70], ax
add eax, 0xb
mov word [0xc06e72], ax
lea eax, [ecx + 0x62]
mov word [0xc06e74], ax
add eax, 0xffffffcb
mov word [0xc06e76], ax
lea eax, [ecx + 0x2e]
mov word [0xc06e78], ax
add eax, 0x3d
mov word [0xc06e7a], ax
mov eax, ecx
mov word [0xc06e7c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc06e70]
add eax, 2
mov word [eax + 0xc075ae], dx
cmp eax, 0xe
jb 0xb6f61a
mov eax, 0xc075b0
ret
Function at 0xb6f712
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07cfc], 1
mov ecx, 0xc48b
jne 0xb6f93b
or dword [0xc07cfc], 1
lea eax, [ecx + 0x30]
mov word [0xc06e88], ax
dec eax
mov word [0xc06e8a], ax
lea eax, [ecx + 0x2e]
mov word [0xc06e8c], ax
dec eax
mov word [0xc06e8e], ax
lea eax, [ecx + 0x34]
mov word [0xc06e90], ax
dec eax
mov word [0xc06e92], ax
lea eax, [ecx + 0x32]
mov word [0xc06e94], ax
dec eax
mov word [0xc06e96], ax
lea eax, [ecx + 0x28]
mov word [0xc06e98], ax
dec eax
mov word [0xc06e9a], ax
lea eax, [ecx + 0x3f]
mov word [0xc06e9c], ax
dec eax
mov word [0xc06e9e], ax
lea eax, [ecx + 0x3d]
mov word [0xc06ea0], ax
add eax, 7
mov word [0xc06ea2], ax
lea eax, [ecx + 0x43]
mov word [0xc06ea4], ax
dec eax
mov word [0xc06ea6], ax
lea eax, [ecx + 0x41]
mov word [0xc06ea8], ax
add eax, 0xfffffff7
mov word [0xc06eaa], ax
lea eax, [ecx + 0x37]
mov word [0xc06eac], ax
dec eax
mov word [0xc06eae], ax
lea eax, [ecx + 0x35]
mov word [0xc06eb0], ax
add eax, 7
mov word [0xc06eb2], ax
lea eax, [ecx + 0x3b]
mov word [0xc06eb4], ax
dec eax
mov word [0xc06eb6], ax
lea eax, [ecx + 0x39]
mov word [0xc06eb8], ax
add eax, 0x17
mov word [0xc06eba], ax
lea eax, [ecx + 0x4f]
mov word [0xc06ebc], ax
dec eax
mov word [0xc06ebe], ax
lea eax, [ecx + 0x4d]
mov word [0xc06ec0], ax
add eax, 7
mov word [0xc06ec2], ax
lea eax, [ecx + 0x53]
mov word [0xc06ec4], ax
dec eax
mov word [0xc06ec6], ax
lea eax, [ecx + 0x51]
mov word [0xc06ec8], ax
add eax, 0xfffffff7
mov word [0xc06eca], ax
lea eax, [ecx + 0x47]
mov word [0xc06ecc], ax
dec eax
mov word [0xc06ece], ax
lea eax, [ecx + 0x5f]
mov word [0xc06ed0], ax
dec eax
mov word [0xc06ed2], ax
lea eax, [ecx + 0x5d]
mov word [0xc06ed4], ax
add eax, 7
mov word [0xc06ed6], ax
lea eax, [ecx + 0x63]
mov word [0xc06ed8], ax
dec eax
mov word [0xc06eda], ax
lea eax, [ecx + 0x61]
mov word [0xc06edc], ax
add eax, 0xfffffff7
mov word [0xc06ede], ax
lea eax, [ecx + 0x57]
mov word [0xc06ee0], ax
dec eax
mov word [0xc06ee2], ax
lea eax, [ecx + 0x55]
mov word [0xc06ee4], ax
add eax, 7
mov word [0xc06ee6], ax
lea eax, [ecx + 0x5b]
mov word [0xc06ee8], ax
dec eax
mov word [0xc06eea], ax
lea eax, [ecx + 0x59]
mov word [0xc06eec], ax
add eax, 0x17
mov word [0xc06eee], ax
lea eax, [ecx + 0x6f]
mov word [0xc06ef0], ax
dec eax
mov word [0xc06ef2], ax
lea eax, [ecx + 0x6d]
mov word [0xc06ef4], ax
add eax, 7
mov word [0xc06ef6], ax
lea eax, [ecx + 0x73]
mov word [0xc06ef8], ax
dec eax
mov word [0xc06efa], ax
lea eax, [ecx + 0x71]
mov word [0xc06efc], ax
add eax, 0xfffffff7
mov word [0xc06efe], ax
lea eax, [ecx + 0x67]
mov word [0xc06f00], ax
dec eax
mov word [0xc06f02], ax
mov eax, ecx
mov word [0xc06f04], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xc06e88]
add eax, 2
mov word [eax + 0xc075be], dx
cmp eax, 0x7e
jb 0xb6f93d
mov eax, 0xc075c0
ret