joyce8/EMBER2024-capa huggingface dataset:
Function at 0xde01e0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x943516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.00e3e530
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0xde0224
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00eb75d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0xde02ba
push edi
push 2
push 0
push ebx
call fcn.00ebb3a6
push ebx
call fcn.00eb715b
push 0
push 0
push ebx
mov edi, eax
call fcn.00ebb3a6
mov ecx, dword [esi]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0xde0290
cmp dword [ecx + 0x14], 0x10
jb 0xde0288
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0xde029c
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.00e3ce10
mov eax, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0xde02a6
mov eax, dword [eax]
push ebx
push edi
push 1
push eax
call fcn.00ebfe4f
push ebx
call fcn.00ebae58
add esp, 0x14
pop edi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0xde02eb
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xde02e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xde02fc
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00eb6a20
int3
Function at 0xde0310
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x943516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.00e3e530
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0xde0354
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00eb75d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0xde03f4
push esi
push 2
push 0
push ebx
call fcn.00ebb3a6
push ebx
call fcn.00eb715b
push 0
push 0
push ebx
mov esi, eax
call fcn.00ebb3a6
mov ecx, dword [edi]
mov eax, 0x1e8481
mov edx, dword [ecx + 0x10]
add esp, 0x1c
cmp esi, eax
cmova esi, eax
lea eax, [ecx + 0x10]
cmp esi, edx
ja 0xde03ca
cmp dword [ecx + 0x14], 0x10
jb 0xde03c2
mov ecx, dword [ecx]
mov dword [eax], esi
mov byte [ecx + esi], 0
jmp 0xde03d6
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00e3ce10
mov eax, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0xde03e0
mov eax, dword [eax]
push ebx
push esi
push 1
push eax
call fcn.00ebfe4f
push ebx
call fcn.00ebae58
add esp, 0x14
pop esi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0xde0425
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xde041b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xde0436
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00eb6a20
int3

Function at 0xde0440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x100f6e1
xor ecx, ecx
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0xde0450
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push esi
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00eb75d0
mov esi, eax
add esp, 8
test esi, esi
je 0xde049b
push 2
push 0
push esi
call fcn.00ebb3a6
push esi
call fcn.00eb715b
push esi
mov edi, eax
call fcn.00ebae58
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0xde04cc
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xde04c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xde04d3
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00eb6a20
int3
Function at 0xde0520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0xd1f9e0c1
xor ecx, ecx
mov dword [ebp - 0x16], 0xffcfecf2
mov dword [ebp - 0x12], 0xf1f4efe9
mov word [ebp - 0xe], 0xf1
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0xde0550
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0xfaf1e0dd
mov dword [ebp - 7], 0xf6fdb6fb
mov word [ebp - 3], 0xf7
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0xde0580
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
push ecx
call 0x1068cc8
lea ecx, [ebp - 0x1a]
push ecx
push eax
call dword [0x94c0d8]
test eax, eax
je 0xde05b5
lea ecx, [ebp - 0xb8]
push ecx
call eax
jmp 0xde05c2
lea eax, [ebp - 0xb8]
push eax
call dword [0x94c0ac]
mov eax, dword [ebp - 0xb4]
cmp eax, 0xb
je 0xde05d2
cmp eax, 0xa
jne 0xde05e1
cmp dword [ebp - 0xb0], 0
je 0xde05fb
xor al, al
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0xde05db
mov eax, dword [ebp - 0xb0]
cmp eax, 3
je 0xde05fb
cmp eax, 2
sete al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0xde06b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x100f6e1
xor ecx, ecx
nop dword [eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0xde06c0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00eb75d0
add esp, 8
test eax, eax
je 0xde06fb
push eax
call fcn.00ebae58
add esp, 4
mov bl, 1
jmp 0xde06fd
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0xde072d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xde0723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xde0734
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00eb6a20
int3

Function at 0xde21b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0xde21d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0xde21c0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret

Function at 0xde35c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0xde35e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0xde35d0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0xde35f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0xde3612
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0xde3600
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret
Function at 0xde3620
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0xde3642
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0xde3630
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0xde3650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0xde3672
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0xde3660
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0xde3680
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0xde36a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0xde3690
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0xde36b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0xde36d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0xde36c0
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0xde36e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0xde3702
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0xde36f0
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0xde3710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0xde3732
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0xde3720
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0xde3740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0xde3762
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0xde3750
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0xde3770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0xde3792
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0xde3780
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret

Function at 0xde37a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0xde37c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0xde37b0
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0xde37d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0xde37f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0xde37e0
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0xde3800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x943835
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1cc
push esi
push edi
mov byte [ebp - 0xe], cl
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
mov byte [ebp - 4], 4
xor ecx, ecx
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x18], 0xbcbbbecf
mov word [ebp - 0x14], 0x100
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 4
jb 0xde3886
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x13], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xde38a0
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0xde3e04
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x80]
call fcn.00e41f90
mov ecx, dword [ebp - 0x50]
cmp ecx, 0x10
jb 0xde390d
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xde3903
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xde3e0f
push ecx
push edx
call fcn.00eb1783
add esp, 8
movups xmm1, xmmword [ebp - 0x80]
lea ecx, [ebp - 0x64]
movq xmm0, qword [ebp - 0x70]
movd eax, xmm1
movq qword [ebp - 0x54], xmm0
cmp dword [ebp - 0x50], 0x10
movups xmmword [ebp - 0x64], xmm1
cmovae ecx, eax
lea eax, [ebp - 0x1d8]
push eax
push ecx
call 0xf3d39a
ret
call fcn.00dd6840
push eax
call fcn.00eb072b
call fcn.00eb6a20
int3

Function at 0xde4d00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0xde4d22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0xde4d10
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0xde8810
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0xde8832
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0xde8820
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0xde9450
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call fcn.00f2280a

Function at 0xde95d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0xf8e7f1f8
mov dword [ebp - 0xa], 0xa8aaf4f2
xor eax, eax
mov dword [ebp - 6], 0xf2f1f8b5
mov word [ebp - 2], 0x100
lea ecx, [eax - 0x6d]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0xde9621
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
push eax
call fcn.0101a6bd
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xde9890
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0xde98b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0xde98a0
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
ret

Function at 0xdea870
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0xdea892
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0xdea880
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret

Function at 0xdea8a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0xdea8c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0xdea8b0
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret
Function at 0xdeaaa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x943420
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x90
push esi
push edi
mov byte [ebp - 0x11], cl
push 0x44
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00eb3760
add esp, 0xc
mov dword [ebp - 0xa0], 0x44
cmp byte [ebp - 0x11], 0
push 0
je 0xdeab0a
push 0xce446
jmp 0xdeab0f
push 0xce447
call fcn.00ddc520
xorps xmm0, xmm0
mov word [ebp - 0x70], ax
add esp, 8
mov dword [ebp - 0x38], 0xf7f0e6d0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x34], 0xe8c9fde3
xor ecx, ecx
mov dword [ebp - 0x30], 0xedf8fff4
mov dword [ebp - 0x2c], 0x100e1ec
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0xe
jb 0xdeab40
mov byte [ebp - 0x29], 0
xor ecx, ecx
mov dword [ebp - 0x28], 0xf8e7f1d8
mov dword [ebp - 0x24], 0xa8aaf4f2
mov dword [ebp - 0x20], 0xf2f1f8b5
mov word [ebp - 0x1c], 0x100
nop
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0xc
jb 0xdeab70
lea eax, [ebp - 0x28]
mov byte [ebp - 0x1b], 0
push eax
call 0xf52622
ret
Function at 0xdeaed0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x944183
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x470
mov dword [ebp - 0x20], 0
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x2d], 0xf7f2f1df
mov dword [ebp - 0x29], 0xf6fcd0fb
mov dword [ebp - 0x25], 0xeff9eb
mov byte [ebp - 0x21], 1
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xb
jb 0xdeaf26
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0xdeaf40
mov esi, 0x7fffffff
sub ecx, edx
mov edx, dword [0x973b54]
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0xdec97f
cmp dword [0x973b58], 0x10
mov eax, 0x973b44
push edx
cmovae eax, dword [0x973b44]
push eax
push ecx
lea eax, [ebp - 0x2d]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x1ec]
call fcn.00e41f90
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0xe4f0e4dc
mov dword [ebp - 0x2a], 0xf4f6dbf6
mov dword [ebp - 0x26], 0xeafef9f5
mov word [ebp - 0x22], 0x100
nop dword [eax]
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0xdeafb0
lea ecx, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xdeafc8
sub ecx, edx
mov eax, esi
mov edx, dword [0x973b54]
sub eax, edx
cmp eax, ecx
jb 0xdec984
cmp dword [0x973b58], 0x10
mov eax, 0x973b44
push edx
cmovae eax, dword [0x973b44]
push eax
push ecx
lea eax, [ebp - 0x2e]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x27c]
call fcn.00e41f90
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x2b], 0xe6c0d1da
mov dword [ebp - 0x27], 0xffedf9f3
mov word [ebp - 0x23], 0xe9
mov byte [ebp - 0x21], 1
nop word [eax + eax]
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0xdeb030
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xdeb048
sub ecx, edx
mov eax, esi
mov edx, dword [0x973b54]
sub eax, edx
cmp eax, ecx
jb 0xdec989
cmp dword [0x973b58], 0x10
mov eax, 0x973b44
push edx
cmovae eax, dword [0x973b44]
push eax
push ecx
lea eax, [ebp - 0x2b]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x15c]
call fcn.00e41f90
push 0x200
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.00eb3760
add esp, 0xc
lea eax, [ebp - 0x480]
push 0x200
push eax
push 0
call fcn.00f82907
ret
call fcn.00dd6840
call fcn.00dd6840
call fcn.00dd6840
push eax
call fcn.00eb072b
call fcn.00dd6840
call fcn.00eb6a20
call fcn.00eb6a20
call fcn.00eb6a20
push eax
call fcn.00eb072b
call fcn.00eb6a20
call fcn.00dd6840
call fcn.00eb6a20
call fcn.00eb6a20
call fcn.00eb6a20
call fcn.00eb6a20
call fcn.00eb6a20
call fcn.00eb6a20
call fcn.00eb6a20
int3
Function at 0xdec9e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0xdeca02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0xdec9f0
mov byte [esi + 0x2e], 0
mov eax, esi
pop esi
ret
Function at 0xdf2270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0xdf2292
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0xdf2280
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
ret

Function at 0xdf22a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0xdf22c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0xdf22b0
mov byte [esi + 0x23], 0
mov eax, esi
pop esi
ret
Function at 0xdf3cd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9448c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x28
push esi
push edi
push 0
push 0xd0549
mov dword [ebp - 4], 1
call fcn.00ddc520
mov edi, eax
mov dword [ebp - 0x1c], 0xbce9beef
mov eax, dword [0x973aac]
add esp, 8
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov word [ebp - 0x18], 0xeb
mov byte [ebp - 0x16], 1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 5
jb 0xdf3d34
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x16], 0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xdf3d50
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, ecx
jb 0xdf3e9c
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
push ecx
cmovae eax, dword [ebx + 8]
lea ecx, [ebp - 0x1c]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.00e41f90
sub esp, 0x18
mov byte [ebp - 4], 2
mov esi, esp
lea eax, [ebx + 0x20]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], esi
push eax
call fcn.00e3a2d0
mov ecx, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov edx, edi
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00df2860
mov ecx, dword [ebp - 0x20]
add esp, 0x18
cmp ecx, 0x10
jb 0xdf3e17
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xdf3e0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xdf3ea1
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0xdf3e47
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xdf3e3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xdf3ea6
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov ecx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp ecx, 0x10
jb 0xdf3e89
mov edx, dword [ebx + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0xdf3e7f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xdf3ea6
push ecx
push edx
call fcn.00eb1783
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00dd6840
call fcn.00eb6a20
call fcn.00eb6a20
int3
Function at 0xdf8e80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0xdf8ea2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0xdf8e90
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret
Function at 0xdfcc90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x86], 0
je 0xdfccb7
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x85
jb 0xdfcca0
mov byte [esi + 0x86], 0
mov eax, esi
pop esi
ret

Function at 0xdfccc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0xdfcce2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0xdfccd0
mov byte [esi + 0x57], 0
mov eax, esi
pop esi
ret
Function at 0xdfeeb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x66], 0
je 0xdfeed2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x65
jb 0xdfeec0
mov byte [esi + 0x66], 0
mov eax, esi
pop esi
ret
Function at 0xe0ace0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0xe0ad02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x4a
jb 0xe0acf0
mov byte [esi + 0x4b], 0
mov eax, esi
pop esi
ret