joyce8/EMBER2024-capa huggingface dataset:
Function at 0x321f07
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c27cc], 1
jne 0x321f6e
or dword [0x3c27cc], 1
mov dword [0x3c0a48], 0x4b444a4f
mov dword [0x3c0a4c], 0x46505657
mov dword [0x3c0a50], 0x57424751
mov dword [0x3c0a54], 0x46507c42
mov dword [0x3c0a58], 0x42557c57
mov dword [0x3c0a5c], 0x4d424a51
mov dword [0x3c0a60], 0x564d7c57
mov dword [0x3c0a64], 0x5146414e
mov byte [0x3c0a68], 0x23
xor eax, eax
mov cl, byte [eax + 0x3c0a48]
xor cl, 0x23
mov byte [eax + 0x3c0c20], cl
inc eax
cmp eax, 0x21
jb 0x321f70
mov eax, 0x3c0c20
ret

Function at 0x321f8b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c27c8], 1
jne 0x321ff4
or dword [0x3c27c8], 1
mov dword [0x3c0a6c], 0x4b444a4f
mov dword [0x3c0a70], 0x46505657
mov dword [0x3c0a74], 0x57424751
mov dword [0x3c0a78], 0x46507c42
mov dword [0x3c0a7c], 0x42557c57
mov dword [0x3c0a80], 0x4d424a51
mov dword [0x3c0a84], 0x4c417c57
mov dword [0x3c0a88], 0x42464f4c
mov word [0x3c0a8c], 0x234d
xor eax, eax
mov cl, byte [eax + 0x3c0a6c]
xor cl, 0x23
mov byte [eax + 0x3c0c44], cl
inc eax
cmp eax, 0x22
jb 0x321ff6
mov eax, 0x3c0c44
ret

Function at 0x322011
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c27c4], 1
jne 0x322077
or dword [0x3c27c4], 1
mov dword [0x3c0a90], 0x4b444a4f
mov dword [0x3c0a94], 0x46505657
mov dword [0x3c0a98], 0x57424751
mov dword [0x3c0a9c], 0x46507c42
mov dword [0x3c0aa0], 0x42557c57
mov dword [0x3c0aa4], 0x4d424a51
mov dword [0x3c0aa8], 0x564d7c57
mov word [0x3c0aac], 0x4f4f
mov byte [0x3c0aae], 0x23
xor eax, eax
mov cl, byte [eax + 0x3c0a90]
xor cl, 0x23
mov byte [eax + 0x3c0c68], cl
inc eax
cmp eax, 0x1f
jb 0x322079
mov eax, 0x3c0c68
ret

Function at 0x322309
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38a9ed
call fcn.00389c38
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x3920a8]
test byte [0x3c27a4], 1
mov edi, eax
jne 0x322356
or dword [0x3c27a4], 1
mov dword [0x3c0d04], 0x4d4a4d53
mov dword [0x3c0d08], 0xa50414a
mov dword [0x3c0d0c], 0x24484840
xor ecx, ecx
mov al, byte [ecx + 0x3c0d04]
xor al, 0x24
mov byte [ecx + 0x3c0fbc], al
inc ecx
cmp ecx, 0xc
jb 0x322358
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x3c0fbc
call dword [0x3920d4]
push eax
push 0x1b00
call dword [0x39212c]
test eax, eax
jne 0x3223a4
call fcn.0032241a
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0030d2ba
pop ecx
pop ecx
jmp 0x322409
test byte [0x3c279c], 1
jne 0x3223c4
or dword [0x3c279c], 1
mov word [0x3c0d2c], 0x41e
mov byte [0x3c0d2e], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0d2c]
xor cl, 0x24
mov byte [eax + 0x3c0fe4], cl
inc eax
cmp eax, 3
jb 0x3223c6
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x3c0fe4
push eax
call fcn.0030d2ba
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0030d66d
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00304cea
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x32241a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c27a0], 1
jne 0x32246f
or dword [0x3c27a0], 1
mov dword [0x3c0d10], 0x45620c04
mov dword [0x3c0d14], 0x4041484d
mov dword [0x3c0d18], 0x44b5004
mov dword [0x3c0d1c], 0x49564b42
mov dword [0x3c0d20], 0x41045045
mov dword [0x3c0d24], 0x564b5656
mov word [0x3c0d28], 0x240d
xor eax, eax
mov cl, byte [eax + 0x3c0d10]
xor cl, 0x24
mov byte [eax + 0x3c0fc8], cl
inc eax
cmp eax, 0x1a
jb 0x322471
mov eax, 0x3c0fc8
ret

Function at 0x3225da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2798], 1
jne 0x322623
or dword [0x3c2798], 1
mov dword [0x3c0d30], 0x6c4a4d73
mov dword [0x3c0d34], 0x6b545050
mov dword [0x3c0d38], 0xc4a4154
mov dword [0x3c0d3c], 0x4542040d
mov dword [0x3c0d40], 0x4041484d
mov byte [0x3c0d44], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0d30]
xor cl, 0x24
mov byte [eax + 0x3c0fe8], cl
inc eax
cmp eax, 0x15
jb 0x322625
mov eax, 0x3c0fe8
ret

Function at 0x3228ea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2794], 1
jne 0x32293d
or dword [0x3c2794], 1
mov dword [0x3c0d48], 0x6c4a4d73
mov dword [0x3c0d4c], 0x67545050
mov dword [0x3c0d50], 0x4f474556
mov dword [0x3c0d54], 0xc485671
mov dword [0x3c0d58], 0x4542040d
mov dword [0x3c0d5c], 0x4041484d
mov byte [0x3c0d60], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0d48]
xor cl, 0x24
mov byte [eax + 0x3c1000], cl
inc eax
cmp eax, 0x19
jb 0x32293f
mov eax, 0x3c1000
ret

Function at 0x32295a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2790], 1
jne 0x3229a6
or dword [0x3c2790], 1
mov dword [0x3c0d64], 0x6c4a4d73
mov dword [0x3c0d68], 0x67545050
mov dword [0x3c0d6c], 0x414a4a4b
mov dword [0x3c0d70], 0xd0c5047
mov dword [0x3c0d74], 0x4d454204
mov dword [0x3c0d78], 0x24404148
xor eax, eax
mov cl, byte [eax + 0x3c0d64]
xor cl, 0x24
mov byte [eax + 0x3c101c], cl
inc eax
cmp eax, 0x18
jb 0x3229a8
mov eax, 0x3c101c
ret

Function at 0x3232ff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c278c], 1
jne 0x3233d8
or dword [0x3c278c], 1
mov dword [0x3c0d80], 0x51554176
mov dword [0x3c0d84], 0x4505741
mov dword [0x3c0d88], 0x4485651
mov dword [0x3c0d8c], 0x40415751
mov dword [0x3c0d90], 0x40044504
mov dword [0x3c0d94], 0x4142424d
mov dword [0x3c0d98], 0x504a4156
mov dword [0x3c0d9c], 0x4c475704
mov dword [0x3c0da0], 0x4414941
mov dword [0x3c0da4], 0x4a454c50
mov dword [0x3c0da8], 0x414c5004
mov dword [0x3c0dac], 0x4a4b4704
mov dword [0x3c0db0], 0x5047414a
mov dword [0x3c0db4], 0x44a4b4d
mov dword [0x3c0db8], 0x4574553
mov dword [0x3c0dbc], 0x504d4a4d
mov dword [0x3c0dc0], 0x4d48454d
mov dword [0x3c0dc4], 0x440415e
mov dword [0x3c0dc8], 0x4c504d53
mov byte [0x3c0dcc], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0d80]
xor cl, 0x24
mov byte [eax + 0x3c1038], cl
inc eax
cmp eax, 0x4d
jb 0x3233da
mov eax, 0x3c1038
ret
Function at 0x3233f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2788], 1
jne 0x3234d1
or dword [0x3c2788], 1
mov dword [0x3c0dd0], 0x51554176
mov dword [0x3c0dd4], 0x4505741
mov dword [0x3c0dd8], 0x4485651
mov dword [0x3c0ddc], 0x40415751
mov dword [0x3c0de0], 0x40044504
mov dword [0x3c0de4], 0x4142424d
mov dword [0x3c0de8], 0x504a4156
mov dword [0x3c0dec], 0x574b4c04
mov dword [0x3c0df0], 0x454a0450
mov dword [0x3c0df4], 0x50044149
mov dword [0x3c0df8], 0x44a454c
mov dword [0x3c0dfc], 0x4414c50
mov dword [0x3c0e00], 0x4a4a4b47
mov dword [0x3c0e04], 0x4d504741
mov dword [0x3c0e08], 0x53044a4b
mov dword [0x3c0e0c], 0x4d045745
mov dword [0x3c0e10], 0x4d504d4a
mov dword [0x3c0e14], 0x5e4d4845
mov dword [0x3c0e18], 0x53044041
mov dword [0x3c0e1c], 0x244c504d
xor eax, eax
mov cl, byte [eax + 0x3c0dd0]
xor cl, 0x24
mov byte [eax + 0x3c1088], cl
inc eax
cmp eax, 0x50
jb 0x3234d3
mov eax, 0x3c1088
ret

Function at 0x3234ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2784], 1
jne 0x3235c6
or dword [0x3c2784], 1
mov dword [0x3c0e20], 0x51554176
mov dword [0x3c0e24], 0x4505741
mov dword [0x3c0e28], 0x4485651
mov dword [0x3c0e2c], 0x40415751
mov dword [0x3c0e30], 0x40044504
mov dword [0x3c0e34], 0x4142424d
mov dword [0x3c0e38], 0x504a4156
mov dword [0x3c0e3c], 0x564b5404
mov dword [0x3c0e40], 0x4c500450
mov dword [0x3c0e44], 0x50044a45
mov dword [0x3c0e48], 0x4704414c
mov dword [0x3c0e4c], 0x414a4a4b
mov dword [0x3c0e50], 0x4b4d5047
mov dword [0x3c0e54], 0x4553044a
mov dword [0x3c0e58], 0x4a4d0457
mov dword [0x3c0e5c], 0x454d504d
mov dword [0x3c0e60], 0x415e4d48
mov dword [0x3c0e64], 0x4d530440
mov word [0x3c0e68], 0x4c50
mov byte [0x3c0e6a], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0e20]
xor cl, 0x24
mov byte [eax + 0x3c10d8], cl
inc eax
cmp eax, 0x4b
jb 0x3235c8
mov eax, 0x3c10d8
ret

Function at 0x3235e3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2780], 1
jne 0x323639
or dword [0x3c2780], 1
mov dword [0x3c0e6c], 0x6c4a4d73
mov dword [0x3c0e70], 0x6b545050
mov dword [0x3c0e74], 0x764a4154
mov dword [0x3c0e78], 0x41515541
mov dword [0x3c0e7c], 0xd0c5057
mov dword [0x3c0e80], 0x4d454204
mov dword [0x3c0e84], 0x24404148
xor eax, eax
mov cl, byte [eax + 0x3c0e6c]
xor cl, 0x24
mov byte [eax + 0x3c1124], cl
inc eax
cmp eax, 0x1c
jb 0x32363b
mov eax, 0x3c1124
ret
Function at 0x323656
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c277c], 1
jne 0x323725
or dword [0x3c277c], 1
mov dword [0x3c0e88], 0x6c4a4d73
mov dword [0x3c0e8c], 0x77545050
mov dword [0x3c0e90], 0x546b5041
mov dword [0x3c0e94], 0x4a4b4d50
mov dword [0x3c0e98], 0x6a6d730c
mov dword [0x3c0e9c], 0x7470706c
mov dword [0x3c0ea0], 0x70746b7b
mov dword [0x3c0ea4], 0x7b6a6b6d
mov dword [0x3c0ea8], 0x71676177
mov dword [0x3c0eac], 0x7d706d76
mov dword [0x3c0eb0], 0x6568627b
mov dword [0x3c0eb4], 0x40d7763
mov dword [0x3c0eb8], 0x56044a4b
mov dword [0x3c0ebc], 0x41515541
mov dword [0x3c0ec0], 0x4c045057
mov dword [0x3c0ec4], 0x48404a45
mov dword [0x3c0ec8], 0x45420441
mov dword [0x3c0ecc], 0x4041484d
mov byte [0x3c0ed0], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0e88]
xor cl, 0x24
mov byte [eax + 0x3c1140], cl
inc eax
cmp eax, 0x49
jb 0x323727
mov eax, 0x3c1140
ret

Function at 0x323742
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2778], 1
jne 0x323810
or dword [0x3c2778], 1
mov dword [0x3c0ed8], 0x6c4a4d73
mov dword [0x3c0edc], 0x77545050
mov dword [0x3c0ee0], 0x546b5041
mov dword [0x3c0ee4], 0x4a4b4d50
mov dword [0x3c0ee8], 0x6a6d730c
mov dword [0x3c0eec], 0x7470706c
mov dword [0x3c0ef0], 0x70746b7b
mov dword [0x3c0ef4], 0x7b6a6b6d
mov dword [0x3c0ef8], 0x606a6177
mov dword [0x3c0efc], 0x696d707b
mov dword [0x3c0f00], 0x70716b61
mov dword [0x3c0f04], 0x4a4b040d
mov dword [0x3c0f08], 0x55415604
mov dword [0x3c0f0c], 0x50574151
mov dword [0x3c0f10], 0x4a454c04
mov dword [0x3c0f14], 0x4414840
mov dword [0x3c0f18], 0x484d4542
mov word [0x3c0f1c], 0x4041
mov byte [0x3c0f1e], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0ed8]
xor cl, 0x24
mov byte [eax + 0x3c1190], cl
inc eax
cmp eax, 0x47
jb 0x323812
mov eax, 0x3c1190
ret

Function at 0x32382d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2774], 1
jne 0x323896
or dword [0x3c2774], 1
mov dword [0x3c0f20], 0x6c4a4d73
mov dword [0x3c0f24], 0x65545050
mov dword [0x3c0f28], 0x41764040
mov dword [0x3c0f2c], 0x57415155
mov dword [0x3c0f30], 0x45416c50
mov dword [0x3c0f34], 0x57564140
mov dword [0x3c0f38], 0x42040d0c
mov dword [0x3c0f3c], 0x41484d45
mov word [0x3c0f40], 0x2440
xor eax, eax
mov cl, byte [eax + 0x3c0f20]
xor cl, 0x24
mov byte [eax + 0x3c11d8], cl
inc eax
cmp eax, 0x22
jb 0x323898
mov eax, 0x3c11d8
ret

Function at 0x3238b3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2770], 1
jne 0x323906
or dword [0x3c2770], 1
mov dword [0x3c0f44], 0x5450506c
mov dword [0x3c0f48], 0x404a4177
mov dword [0x3c0f4c], 0x51554176
mov dword [0x3c0f50], 0xc505741
mov dword [0x3c0f54], 0x4542040d
mov dword [0x3c0f58], 0x4041484d
mov byte [0x3c0f5c], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0f44]
xor cl, 0x24
mov byte [eax + 0x3c11fc], cl
inc eax
cmp eax, 0x19
jb 0x323908
mov eax, 0x3c11fc
ret
Function at 0x323923
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c276c], 1
jne 0x323975
or dword [0x3c276c], 1
mov dword [0x3c0f60], 0x5450506c
mov dword [0x3c0f64], 0x56415175
mov dword [0x3c0f68], 0x424a6d5d
mov dword [0x3c0f6c], 0x40d0c4b
mov dword [0x3c0f70], 0x484d4542
mov word [0x3c0f74], 0x4041
mov byte [0x3c0f76], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0f60]
xor cl, 0x24
mov byte [eax + 0x3c1218], cl
inc eax
cmp eax, 0x17
jb 0x323977
mov eax, 0x3c1218
ret
Function at 0x324155
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2764], 1
jne 0x3241c5
or dword [0x3c2764], 1
mov dword [0x3c0f7c], 0x6c4a4d73
mov dword [0x3c0f80], 0x75545050
mov dword [0x3c0f84], 0x5d564151
mov dword [0x3c0f88], 0x45504560
mov dword [0x3c0f8c], 0x4d455265
mov dword [0x3c0f90], 0x48464548
mov dword [0x3c0f94], 0x40d0c41
mov dword [0x3c0f98], 0x484d4542
mov word [0x3c0f9c], 0x4041
mov byte [0x3c0f9e], 0x24
xor eax, eax
mov cl, byte [eax + 0x3c0f7c]
xor cl, 0x24
mov byte [eax + 0x3c1234], cl
inc eax
cmp eax, 0x23
jb 0x3241c7
mov eax, 0x3c1234
ret

Function at 0x3241e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2760], 1
jne 0x324237
or dword [0x3c2760], 1
mov dword [0x3c0fa0], 0x41504a6d
mov dword [0x3c0fa4], 0x50414a56
mov dword [0x3c0fa8], 0x40454176
mov dword [0x3c0fac], 0x41484d62
mov dword [0x3c0fb0], 0x42040d0c
mov dword [0x3c0fb4], 0x41484d45
mov word [0x3c0fb8], 0x2440
xor eax, eax
mov cl, byte [eax + 0x3c0fa0]
xor cl, 0x24
mov byte [eax + 0x3c1258], cl
inc eax
cmp eax, 0x1a
jb 0x324239
mov eax, 0x3c1258
ret

Function at 0x325037
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2744], 1
jne 0x3250be
or dword [0x3c2744], 1
mov dword [0x3c1290], 0x50054b64
mov dword [0x3c1294], 0x4640574b
mov dword [0x3c1298], 0x4c4b424a
mov dword [0x3c129c], 0x541405f
mov dword [0x3c12a0], 0x404e4a51
mov dword [0x3c12a4], 0x4452054b
mov dword [0x3c12a8], 0x4a430556
mov dword [0x3c12ac], 0x5414b50
mov dword [0x3c12b0], 0x46055144
mov dword [0x3c12b4], 0x4457444d
mov dword [0x3c12b8], 0x57405146
mov word [0x3c12bc], 0x2505
xor eax, eax
mov cl, byte [eax + 0x3c1290]
xor cl, 0x25
mov byte [eax + 0x3c13e0], cl
inc eax
cmp eax, 0x2e
jb 0x3250c0
mov eax, 0x3c13e0
ret
Function at 0x325504
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2740], 1
jne 0x325560
or dword [0x3c2740], 1
mov dword [0x3c12c0], 0x56564c68
mov dword [0x3c12c4], 0x5424b4c
mov dword [0x3c12c8], 0x40490544
mov dword [0x3c12cc], 0x55055143
mov dword [0x3c12d0], 0x4b405744
mov dword [0x3c12d4], 0x56404d51
mov word [0x3c12d8], 0x564c
mov byte [0x3c12da], 0x25
xor eax, eax
mov cl, byte [eax + 0x3c12c0]
xor cl, 0x25
mov byte [eax + 0x3c1410], cl
inc eax
cmp eax, 0x1b
jb 0x325562
mov eax, 0x3c1410
ret

Function at 0x32557d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c273c], 1
jne 0x3255e6
or dword [0x3c273c], 1
mov dword [0x3c12dc], 0x5514a6b
mov dword [0x3c12e0], 0x504a4b40
mov dword [0x3c12e4], 0x4a054d42
mov dword [0x3c12e8], 0x44574055
mov dword [0x3c12ec], 0x556414b
mov dword [0x3c12f0], 0x40054b4c
mov dword [0x3c12f4], 0x4057555d
mov dword [0x3c12f8], 0x4a4c5656
mov word [0x3c12fc], 0x254b
xor eax, eax
mov cl, byte [eax + 0x3c12dc]
xor cl, 0x25
mov byte [eax + 0x3c142c], cl
inc eax
cmp eax, 0x22
jb 0x3255e8
mov eax, 0x3c142c
ret

Function at 0x325603
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2738], 1
jne 0x325663
or dword [0x3c2738], 1
mov dword [0x3c1300], 0x54a4a71
mov dword [0x3c1304], 0x5c4b4448
mov dword [0x3c1308], 0x40554a05
mov dword [0x3c130c], 0x414b4457
mov dword [0x3c1310], 0x4b4c0556
mov dword [0x3c1314], 0x555d4005
mov dword [0x3c1318], 0x56564057
mov dword [0x3c131c], 0x254b4a4c
xor eax, eax
mov cl, byte [eax + 0x3c1300]
xor cl, 0x25
mov byte [eax + 0x3c1450], cl
inc eax
cmp eax, 0x20
jb 0x325665
mov eax, 0x3c1450
ret

Function at 0x325680
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2734], 1
jne 0x3256d6
or dword [0x3c2734], 1
mov dword [0x3c1320], 0x56564c68
mov dword [0x3c1324], 0x5424b4c
mov dword [0x3c1328], 0x4c570544
mov dword [0x3c132c], 0x5514d42
mov dword [0x3c1330], 0x40574455
mov dword [0x3c1334], 0x404d514b
mov dword [0x3c1338], 0x25564c56
xor eax, eax
mov cl, byte [eax + 0x3c1320]
xor cl, 0x25
mov byte [eax + 0x3c1470], cl
inc eax
cmp eax, 0x1c
jb 0x3256d8
mov eax, 0x3c1470
ret

Function at 0x3256f3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2730], 1
jne 0x325764
or dword [0x3c2730], 1
mov dword [0x3c133c], 0x57444b70
mov dword [0x3c1340], 0x554a055c
mov dword [0x3c1344], 0x51445740
mov dword [0x3c1348], 0x4805574a
mov dword [0x3c134c], 0x5515650
mov dword [0x3c1350], 0x4053444d
mov dword [0x3c1354], 0x404b4a05
mov dword [0x3c1358], 0x40554a05
mov dword [0x3c135c], 0x414b4457
mov byte [0x3c1360], 0x25
xor eax, eax
mov cl, byte [eax + 0x3c133c]
xor cl, 0x25
mov byte [eax + 0x3c148c], cl
inc eax
cmp eax, 0x25
jb 0x325766
mov eax, 0x3c148c
ret
Function at 0x325781
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c272c], 1
jne 0x3257fb
or dword [0x3c272c], 1
mov dword [0x3c1364], 0x444b4c67
mov dword [0x3c1368], 0x4a055c57
mov dword [0x3c136c], 0x44574055
mov dword [0x3c1370], 0x5574a51
mov dword [0x3c1374], 0x51565048
mov dword [0x3c1378], 0x53444d05
mov dword [0x3c137c], 0x52510540
mov dword [0x3c1380], 0x554a054a
mov dword [0x3c1384], 0x4b445740
mov word [0x3c1388], 0x5641
mov byte [0x3c138a], 0x25
xor eax, eax
mov cl, byte [eax + 0x3c1364]
xor cl, 0x25
mov byte [eax + 0x3c14b4], cl
inc eax
cmp eax, 0x27
jb 0x3257fd
mov eax, 0x3c14b4
ret

Function at 0x325818
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2728], 1
jne 0x325881
or dword [0x3c2728], 1
mov dword [0x3c138c], 0x444b4c67
mov dword [0x3c1390], 0x4a055c57
mov dword [0x3c1394], 0x44574055
mov dword [0x3c1398], 0x5574a51
mov dword [0x3c139c], 0x5514a4b
mov dword [0x3c13a0], 0x4955484c
mov dword [0x3c13a4], 0x4b404840
mov dword [0x3c13a8], 0x1f414051
mov word [0x3c13ac], 0x2505
xor eax, eax
mov cl, byte [eax + 0x3c138c]
xor cl, 0x25
mov byte [eax + 0x3c14dc], cl
inc eax
cmp eax, 0x22
jb 0x325883
mov eax, 0x3c14dc
ret
Function at 0x327233
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x327275
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x3abe20]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x3abe20]
inc edx
cmp dword [ebp + 8], 0
jne 0x327240
pop esi
not eax
pop ebp
ret

Function at 0x328ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x328ee5
cmp dword [ecx + 0x38], ebx
je 0x328ee5
cmp eax, dword [ecx + 0x10]
jae 0x328ee5
cmp dword [ecx + 0x14], 1
jne 0x328ee5
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x328ee7
xor edi, edi
cmp edi, ebx
je 0x328fca
cmp esi, ebx
je 0x328fca
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00328669
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x328f76
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00366fe0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x328f9b
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00366fe0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x328fcc
xor eax, eax
pop edi
pop ebx
ret

Function at 0x3299c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c271c], 1
jne 0x329a45
or dword [0x3c271c], 1
mov dword [0x3c1518], 0x4a4f4760
mov dword [0x3c151c], 0x52064243
mov dword [0x3c1520], 0x54450649
mov dword [0x3c1524], 0x43524743
mov dword [0x3c1528], 0x47534a06
mov dword [0x3c152c], 0x47525506
mov dword [0x3c1530], 0xe064352
mov dword [0x3c1534], 0x4d544951
mov dword [0x3c1538], 0x52065443
mov dword [0x3c153c], 0x4743544e
mov dword [0x3c1540], 0x61c0f42
mov byte [0x3c1544], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1518]
xor cl, 0x26
mov byte [eax + 0x3c15e0], cl
inc eax
cmp eax, 0x2d
jb 0x329a47
mov eax, 0x3c15e0
ret
Function at 0x329a62
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c270c], 1
jne 0x329ac9
or dword [0x3c270c], 1
mov dword [0x3c1554], 0x43064968
mov dword [0x3c1558], 0x54495454
mov dword [0x3c155c], 0x55434b06
mov dword [0x3c1560], 0x43414755
mov dword [0x3c1564], 0x52435406
mov dword [0x3c1568], 0x43485453
mov dword [0x3c156c], 0x5f440642
mov dword [0x3c1570], 0x44494c06
mov byte [0x3c1574], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c1554]
xor cl, 0x26
mov byte [eax + 0x3c161c], cl
inc eax
cmp eax, 0x21
jb 0x329acb
mov eax, 0x3c161c
ret

Function at 0x329ae6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c2700], 1
jne 0x329b4f
or dword [0x3c2700], 1
mov dword [0x3c15a0], 0x647536a
mov dword [0x3c15a4], 0x49545443
mov dword [0x3c15a8], 0x53540654
mov dword [0x3c15ac], 0x484f4848
mov dword [0x3c15b0], 0x54430641
mov dword [0x3c15b4], 0x6544954
mov dword [0x3c15b8], 0x4248474e
mov dword [0x3c15bc], 0x1c54434a
mov word [0x3c15c0], 0x2606
xor eax, eax
mov cl, byte [eax + 0x3c15a0]
xor cl, 0x26
mov byte [eax + 0x3c1668], cl
inc eax
cmp eax, 0x22
jb 0x329b51
mov eax, 0x3c1668
ret

Function at 0x329b6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x3c26fc], 1
jne 0x329bbe
or dword [0x3c26fc], 1
mov dword [0x3c15c4], 0x6a47534a
mov dword [0x3c15c8], 0x47494a79
mov dword [0x3c15cc], 0x54525542
mov dword [0x3c15d0], 0x641484f
mov dword [0x3c15d4], 0x4a4f4740
mov word [0x3c15d8], 0x4243
mov byte [0x3c15da], 0x26
xor eax, eax
mov cl, byte [eax + 0x3c15c4]
xor cl, 0x26
mov byte [eax + 0x3c168c], cl
inc eax
cmp eax, 0x17
jb 0x329bc0
mov eax, 0x3c168c
ret