joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402710
Capabilities:
Encode data using xor
Get file size
Set file attributes
Set registry value

Disassembly:
push esi
push edi
push 0x80
push 0x40711c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x407118
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 0
push str.asgdr
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [esp + 0xc]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
test edi, edi
jle 0x402780
mov ecx, dword [esp + 0x10]
mov dl, byte [esp + 0x14]
push ebx
push ebp
mov eax, ecx
sub esi, ecx
mov ebp, edi
mov bl, byte [esi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ebp
jne 0x40276a
pop ebp
mov byte [edi + ecx], 0
pop ebx
pop edi
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov byte [eax + ecx], 0
ret 0xc

Function at 0x402790
Capabilities:
Get disk information

Disassembly:
sub esp, 0x68
push esi
push edi
push 0
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
push 0xc
push 0
push 0x40714c
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
lea edx, [esp + 0x10]
push 0x407148
push edx
call esi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x402810
push 0x407144
push 0x407140
push 0x40713c
push 0x407138
push 0x407134
push 0x407130
lea eax, [esp + 0x24]
push str._s_s_s_s_s_s
push eax
call esi
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
xor ecx, ecx
test eax, eax
je 0x40283c
push eax
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x68
ret
pop edi
mov eax, ecx
pop esi
add esp, 0x68
ret
Function at 0xaf110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0xaf11b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0xaf1160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0xaf11a8
mov esi, dword [ebp - 4]
jns 0xaf1187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0xaf1197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0xaf1169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0xaf1140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xaf11d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0xaf1024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0xaf1254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0xaf1214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xaf255b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2e20], 1
mov ecx, 0xd867
jne 0xaf25e2
or dword [0xbb2e20], 1
lea eax, [ecx - 0x25]
mov edx, eax
add eax, 0xfffffff9
mov word [0xbac9d4], ax
mov word [0xbac9c8], dx
add edx, 0xfffffff1
lea eax, [ecx - 0x64]
mov word [0xbac9d6], ax
add eax, 0xf
mov word [0xbac9d8], ax
mov word [0xbac9ca], dx
lea edx, [ecx - 0x45]
lea eax, [ecx - 0x5d]
mov word [0xbac9da], ax
mov word [0xbac9cc], dx
add edx, 8
add eax, 0xd
mov word [0xbac9dc], ax
lea eax, [ecx - 0x2f]
mov word [0xbac9de], ax
mov eax, ecx
mov word [0xbac9ce], dx
mov dword [0xbac9d0], 0xd842d837
mov word [0xbac9e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbac9c8]
add eax, 2
mov word [eax + 0xbad072], dx
cmp eax, 0x1a
jb 0xaf25e4
mov eax, 0xbad074
ret

Function at 0xaf2602
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2e18], 1
jne 0xaf2630
or dword [0xbb2e18], 1
mov dword [0xbac9f0], 0x3080a5b
mov dword [0xbac9f4], 0x58020b12
mov dword [0xbac9f8], 0x67595858
xor eax, eax
mov cl, byte [eax + 0xbac9f0]
xor cl, 0x67
mov byte [eax + 0xbad09c], cl
inc eax
cmp eax, 0xc
jb 0xaf2632
mov eax, 0xbad09c
ret

Function at 0xaf264d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2e14], 1
mov edx, 0xd867
jne 0xaf270d
push esi
lea ecx, [edx - 0x22]
mov eax, ecx
mov word [0xbac9fc], ax
add eax, 2
or dword [0xbb2e14], 1
mov word [0xbac9fe], ax
lea eax, [edx - 0x1d]
mov esi, eax
mov word [0xbaca00], si
mov word [0xbaca02], ax
add eax, 0xffffffba
mov word [0xbaca04], ax
lea eax, [edx - 0x52]
mov esi, eax
mov word [0xbaca06], si
add esi, 0xfffffff1
mov word [0xbaca08], si
lea esi, [edx - 0x53]
mov word [0xbaca0a], si
add esi, 0xfffffffb
mov word [0xbaca0c], si
lea esi, [edx - 0x2f]
mov word [0xbaca0e], si
mov esi, eax
mov word [0xbaca10], si
add esi, 0xffffffed
add eax, 0xfffffffe
mov word [0xbaca12], si
lea esi, [edx - 0x50]
mov word [0xbaca1a], ax
mov eax, edx
mov word [0xbaca14], si
mov dword [0xbaca16], 0xd815d808
mov dword [0xbaca1c], 0xd845d85a
mov word [0xbaca20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xbac9fc]
add eax, 2
mov word [eax + 0xbad0a6], cx
cmp eax, 0x26
jb 0xaf270f
mov eax, 0xbad0a8
ret
Function at 0xaf27f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0xbb2e10], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xd867
jne 0xaf282e
or dword [0xbb2e10], 1
lea eax, [ecx - 0x57]
mov word [0xbaca24], ax
add eax, 0xfffffff5
mov word [0xbaca26], ax
mov eax, ecx
mov word [0xbaca28], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbaca24]
add eax, 2
mov word [eax + 0xbad0ce], dx
cmp eax, 6
jb 0xaf2832
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0xaf2855
mov eax, dword [eax]
push 0xbad0d0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00b538b7
add esp, 0xc
test eax, eax
jne 0xaf2920
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00af3583
push dword [esp + 0x10]
call fcn.00af2929
push eax
call fcn.00b53e11
push dword [esp + 0x18]
call fcn.00b5439c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00b56f70
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0xb8208c]
test eax, eax
jne 0xaf290e
call dword [0xb820a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00b1a90d
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0xaf28f2
mov eax, dword [eax]
push eax
call fcn.00af2969
push eax
call fcn.00b540e0
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.00af4d08
jmp 0xaf2920
push dword [esp + 0x18]
mov esi, dword [0xb820bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xaf2929
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2e0c], 1
jne 0xaf294c
or dword [0xbb2e0c], 1
mov dword [0xbaca2c], 0x29226d6a
mov word [0xbaca30], 0x6723
xor eax, eax
mov cl, byte [eax + 0xbaca2c]
xor cl, 0x67
mov byte [eax + 0xbad0d8], cl
inc eax
cmp eax, 6
jb 0xaf294e
mov eax, 0xbad0d8
ret

Function at 0xaf2969
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2e08], 1
jne 0xaf29ee
or dword [0xbb2e08], 1
mov dword [0xbaca34], 0xb0e0621
mov dword [0xbaca38], 0x13470302
mov dword [0xbaca3c], 0x15044708
mov dword [0xbaca40], 0x2130602
mov dword [0xbaca44], 0x6150447
mov dword [0xbaca48], 0x15470f14
mov dword [0xbaca4c], 0x15081702
mov dword [0xbaca50], 0x47150213
mov dword [0xbaca54], 0x4081517
mov dword [0xbaca58], 0x5d141402
mov dword [0xbaca5c], 0x6d144247
mov byte [0xbaca60], 0x67
xor eax, eax
mov cl, byte [eax + 0xbaca34]
xor cl, 0x67
mov byte [eax + 0xbad0e0], cl
inc eax
cmp eax, 0x2d
jb 0xaf29f0
mov eax, 0xbad0e0
ret
Function at 0xaf3ab8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2da8], 1
jne 0xaf3aed
or dword [0xbb2da8], 1
mov dword [0xbacce0], 0x1203082a
mov dword [0xbacce4], 0x475d020b
mov dword [0xbacce8], 0x6d6a1442
mov byte [0xbaccec], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacce0]
xor cl, 0x67
mov byte [eax + 0xbad38c], cl
inc eax
cmp eax, 0xd
jb 0xaf3aef
mov eax, 0xbad38c
ret

Function at 0xaf3b0a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2da4], 1
jne 0xaf3b49
or dword [0xbb2da4], 1
mov dword [0xbaccf0], 0x2150f33
mov dword [0xbaccf4], 0x475d0306
mov dword [0xbaccf8], 0x1f421f57
mov dword [0xbaccfc], 0x6d6a6d6a
mov byte [0xbacd00], 0x67
xor eax, eax
mov cl, byte [eax + 0xbaccf0]
xor cl, 0x67
mov byte [eax + 0xbad39c], cl
inc eax
cmp eax, 0x11
jb 0xaf3b4b
mov eax, 0xbad39c
ret

Function at 0xaf3b66
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2da0], 1
jne 0xaf3ba4
or dword [0xbb2da0], 1
mov dword [0xbacd04], 0x2041f22
mov dword [0xbacd08], 0x80e1317
mov dword [0xbacd0c], 0x3424709
mov word [0xbacd10], 0x6d6a
mov byte [0xbacd12], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacd04]
xor cl, 0x67
mov byte [eax + 0xbad3b0], cl
inc eax
cmp eax, 0xf
jb 0xaf3ba6
mov eax, 0xbad3b0
ret

Function at 0xaf3bc1
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d9c], 1
jne 0xaf3bff
or dword [0xbb2d9c], 1
mov dword [0xbacd14], 0x604082b
mov dword [0xbacd18], 0x9080e13
mov dword [0xbacd1c], 0x1742475d
mov word [0xbacd20], 0x6d6a
mov byte [0xbacd22], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacd14]
xor cl, 0x67
mov byte [eax + 0xbad3c0], cl
inc eax
cmp eax, 0xf
jb 0xaf3c01
mov eax, 0xbad3c0
ret

Function at 0xaf3c1c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d98], 1
jne 0xaf3c5d
or dword [0xbb2d98], 1
mov dword [0xbacd24], 0x2171e33
mov dword [0xbacd28], 0x1442475d
mov dword [0xbacd2c], 0x1f574f47
mov dword [0xbacd30], 0x6a4e1f42
mov word [0xbacd34], 0x676d
xor eax, eax
mov cl, byte [eax + 0xbacd24]
xor cl, 0x67
mov byte [eax + 0xbad3d0], cl
inc eax
cmp eax, 0x12
jb 0xaf3c5f
mov eax, 0xbad3d0
ret

Function at 0xaf3c7a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d94], 1
jne 0xaf3d02
or dword [0xbb2d94], 1
mov dword [0xbacd38], 0x6130223
mov dword [0xbacd3c], 0x5d140b0e
mov dword [0xbacd40], 0xe153347
mov dword [0xbacd44], 0x13470302
mov dword [0xbacd48], 0x2154708
mov dword [0xbacd4c], 0x1470306
mov dword [0xbacd50], 0x470a0815
mov dword [0xbacd54], 0x80a020a
mov dword [0xbacd58], 0x6471e15
mov dword [0xbacd5c], 0x2150303
mov dword [0xbacd60], 0x42471414
mov dword [0xbacd64], 0x676d6a17
xor eax, eax
mov cl, byte [eax + 0xbacd38]
xor cl, 0x67
mov byte [eax + 0xbad3e4], cl
inc eax
cmp eax, 0x30
jb 0xaf3d04
mov eax, 0xbad3e4
ret
Function at 0xaf3d1f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d90], 1
jne 0xaf3db1
or dword [0xbb2d90], 1
mov dword [0xbacd68], 0x6130223
mov dword [0xbacd6c], 0x5d140b0e
mov dword [0xbacd70], 0xe153347
mov dword [0xbacd74], 0x13470302
mov dword [0xbacd78], 0x15104708
mov dword [0xbacd7c], 0x4702130e
mov dword [0xbacd80], 0xa470813
mov dword [0xbacd84], 0x15080a02
mov dword [0xbacd88], 0x306471e
mov dword [0xbacd8c], 0x14021503
mov dword [0xbacd90], 0x17424714
mov word [0xbacd94], 0x6d6a
mov byte [0xbacd96], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacd68]
xor cl, 0x67
mov byte [eax + 0xbad414], cl
inc eax
cmp eax, 0x2f
jb 0xaf3db3
mov eax, 0xbad414
ret

Function at 0xaf3dce
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d8c], 1
jne 0xaf3e61
or dword [0xbb2d8c], 1
mov dword [0xbacd98], 0x6130223
mov dword [0xbacd9c], 0x5d140b0e
mov dword [0xbacda0], 0xe153347
mov dword [0xbacda4], 0x13470302
mov dword [0xbacda8], 0x1f024708
mov dword [0xbacdac], 0x13120402
mov dword [0xbacdb0], 0x20a4702
mov dword [0xbacdb4], 0x1e15080a
mov dword [0xbacdb8], 0x47130647
mov dword [0xbacdbc], 0x15030306
mov dword [0xbacdc0], 0x47141402
mov dword [0xbacdc4], 0x6d6a1742
mov byte [0xbacdc8], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacd98]
xor cl, 0x67
mov byte [eax + 0xbad444], cl
inc eax
cmp eax, 0x31
jb 0xaf3e63
mov eax, 0xbad444
ret

Function at 0xaf3e7e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d88], 1
jne 0xaf3eb7
or dword [0xbb2d88], 1
mov dword [0xbacdcc], 0x60b21
mov dword [0xbacdd0], 0x57475d14
mov dword [0xbacdd4], 0x6a1f421f
mov word [0xbacdd8], 0x676d
mov cl, byte [eax + 0xbacdcc]
xor cl, 0x67
mov byte [eax + 0xbad478], cl
inc eax
cmp eax, 0xe
jb 0xaf3eb7
mov eax, 0xbad478
ret

Function at 0xaf3ed2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d84], 1
jne 0xaf3f09
or dword [0xbb2d84], 1
mov dword [0xbacddc], 0x6150637
mov dword [0xbacde0], 0x213020a
mov dword [0xbacde4], 0x6a5d1415
mov word [0xbacde8], 0x676d
xor eax, eax
mov cl, byte [eax + 0xbacddc]
xor cl, 0x67
mov byte [eax + 0xbad488], cl
inc eax
cmp eax, 0xe
jb 0xaf3f0b
mov eax, 0xbad488
ret

Function at 0xaf3f26
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d80], 1
jne 0xaf3f6f
or dword [0xbb2d80], 1
mov dword [0xbacdec], 0x1506376e
mov dword [0xbacdf0], 0x13020a06
mov dword [0xbacdf4], 0x423c1502
mov dword [0xbacdf8], 0x475d3a03
mov dword [0xbacdfc], 0x6d6a1742
mov byte [0xbace00], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacdec]
xor cl, 0x67
mov byte [eax + 0xbad498], cl
inc eax
cmp eax, 0x15
jb 0xaf3f71
mov eax, 0xbad498
ret

Function at 0xaf3f8c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d7c], 1
jne 0xaf3fc4
or dword [0xbb2d7c], 1
mov dword [0xbace04], 0x472f2234
mov dword [0xbace08], 0xb060926
mov dword [0xbace0c], 0x140e141e
mov dword [0xbace10], 0x676d6a5d
xor eax, eax
mov cl, byte [eax + 0xbace04]
xor cl, 0x67
mov byte [eax + 0xbad4b0], cl
inc eax
cmp eax, 0x10
jb 0xaf3fc6
mov eax, 0xbad4b0
ret
Function at 0xaf3fe4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d78], 1
jne 0xaf402c
or dword [0xbb2d78], 1
mov dword [0xbace14], 0xd05286e
mov dword [0xbace18], 0x47130402
mov dword [0xbace1c], 0x2171e13
mov dword [0xbace20], 0x1442475d
mov word [0xbace24], 0x6d6a
mov byte [0xbace26], 0x67
xor eax, eax
mov cl, byte [eax + 0xbace14]
xor cl, 0x67
mov byte [eax + 0xbad4c0], cl
inc eax
cmp eax, 0x13
jb 0xaf402e
mov eax, 0xbad4c0
ret

Function at 0xaf4049
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d74], 1
jne 0xaf40b2
or dword [0xbb2d74], 1
mov dword [0xbace28], 0xe06216e
mov dword [0xbace2c], 0x4703020b
mov dword [0xbace30], 0x1470813
mov dword [0xbace34], 0x80b0b08
mov dword [0xbace38], 0x8174710
mov dword [0xbace3c], 0x213090e
mov dword [0xbace40], 0xf044715
mov dword [0xbace44], 0x6a090e06
mov word [0xbace48], 0x676d
xor eax, eax
mov cl, byte [eax + 0xbace28]
xor cl, 0x67
mov byte [eax + 0xbad4d4], cl
inc eax
cmp eax, 0x22
jb 0xaf40b4
mov eax, 0xbad4d4
ret

Function at 0xaf40cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d70], 1
jne 0xaf40f2
or dword [0xbb2d70], 1
mov dword [0xbace4c], 0x3131427
mov word [0xbace50], 0x6727
xor eax, eax
mov cl, byte [eax + 0xbace4c]
xor cl, 0x67
mov byte [eax + 0xbad4f8], cl
inc eax
cmp eax, 6
jb 0xaf40f4
mov eax, 0xbad4f8
ret

Function at 0xaf410f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d6c], 1
jne 0xaf4146
or dword [0xbb2d6c], 1
mov dword [0xbace54], 0x13091215
mov dword [0xbace58], 0x38020a0e
mov dword [0xbace5c], 0x8151502
mov word [0xbace60], 0x6715
xor eax, eax
mov cl, byte [eax + 0xbace54]
xor cl, 0x67
mov byte [eax + 0xbad500], cl
inc eax
cmp eax, 0xe
jb 0xaf4148
mov eax, 0xbad500
ret

Function at 0xaf4163
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d68], 1
jne 0xaf4193
or dword [0xbb2d68], 1
mov dword [0xbace64], 0x90615
mov dword [0xbace68], 0x15023802
mov dword [0xbace6c], 0x67150815
mov cl, byte [eax + 0xbace64]
xor cl, 0x67
mov byte [eax + 0xbad510], cl
inc eax
cmp eax, 0xc
jb 0xaf4193
mov eax, 0xbad510
ret

Function at 0xaf41ae
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d64], 1
jne 0xaf41ec
or dword [0xbb2d64], 1
mov dword [0xbace70], 0x15021108
mov dword [0xbace74], 0x10080b01
mov dword [0xbace78], 0x15150238
mov word [0xbace7c], 0x1508
mov byte [0xbace7e], 0x67
xor eax, eax
mov cl, byte [eax + 0xbace70]
xor cl, 0x67
mov byte [eax + 0xbad51c], cl
inc eax
cmp eax, 0xf
jb 0xaf41ee
mov eax, 0xbad51c
ret

Function at 0xaf4209
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d60], 1
jne 0xaf4241
or dword [0xbb2d60], 1
mov dword [0xbace80], 0x2030912
mov dword [0xbace84], 0x80b0115
mov dword [0xbace88], 0x15023810
mov dword [0xbace8c], 0x67150815
xor eax, eax
mov cl, byte [eax + 0xbace80]
xor cl, 0x67
mov byte [eax + 0xbad52c], cl
inc eax
cmp eax, 0x10
jb 0xaf4243
mov eax, 0xbad52c
ret
Function at 0xaf425e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d5c], 1
jne 0xaf428e
or dword [0xbb2d5c], 1
mov dword [0xbace90], 0xe00080b
mov dword [0xbace94], 0x15023804
mov dword [0xbace98], 0x67150815
mov cl, byte [eax + 0xbace90]
xor cl, 0x67
mov byte [eax + 0xbad53c], cl
inc eax
cmp eax, 0xc
jb 0xaf428e
mov eax, 0xbad53c
ret

Function at 0xaf42a9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d58], 1
jne 0xaf42de
or dword [0xbb2d58], 1
mov dword [0xbace9c], 0x60a0803
mov dword [0xbacea0], 0x238090e
mov dword [0xbacea4], 0x15081515
mov byte [0xbacea8], 0x67
xor eax, eax
mov cl, byte [eax + 0xbace9c]
xor cl, 0x67
mov byte [eax + 0xbad548], cl
inc eax
cmp eax, 0xd
jb 0xaf42e0
mov eax, 0xbad548
ret

Function at 0xaf42fb
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d54], 1
jne 0xaf433c
or dword [0xbb2d54], 1
mov dword [0xbaceac], 0x611090e
mov dword [0xbaceb0], 0x38030e0b
mov dword [0xbaceb4], 0x12001506
mov dword [0xbaceb8], 0x1309020a
mov byte [0xbacebc], 0x67
mov cl, byte [eax + 0xbaceac]
xor cl, 0x67
mov byte [eax + 0xbad558], cl
inc eax
cmp eax, 0x11
jb 0xaf433c
mov eax, 0xbad558
ret

Function at 0xaf4357
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d50], 1
jne 0xaf438e
or dword [0xbb2d50], 1
mov dword [0xbacec0], 0x9020b
mov dword [0xbacec4], 0x2380f13
mov dword [0xbacec8], 0x15081515
mov byte [0xbacecc], 0x67
mov cl, byte [eax + 0xbacec0]
xor cl, 0x67
mov byte [eax + 0xbad56c], cl
inc eax
cmp eax, 0xd
jb 0xaf438e
mov eax, 0xbad56c
ret

Function at 0xaf43a9
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d4c], 1
jne 0xaf43e0
or dword [0xbb2d4c], 1
mov dword [0xbaced0], 0x38131208
mov dword [0xbaced4], 0x15380108
mov dword [0xbaced8], 0x2000906
mov byte [0xbacedc], 0x67
mov cl, byte [eax + 0xbaced0]
xor cl, 0x67
mov byte [eax + 0xbad57c], cl
inc eax
cmp eax, 0xd
jb 0xaf43e0
mov eax, 0xbad57c
ret

Function at 0xaf43fb
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d48], 1
jne 0xaf4428
or dword [0xbb2d48], 1
mov dword [0xbacee0], 0x2041f02
mov dword [0xbacee4], 0x80e1317
mov word [0xbacee8], 0x6709
xor eax, eax
mov cl, byte [eax + 0xbacee0]
xor cl, 0x67
mov byte [eax + 0xbad58c], cl
inc eax
cmp eax, 0xa
jb 0xaf442a
mov eax, 0xbad58c
ret

Function at 0xaf4445
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d44], 1
jne 0xaf44a4
or dword [0xbb2d44], 1
mov dword [0xbaceec], 0x313146e
mov dword [0xbacef0], 0x1f025d5d
mov dword [0xbacef4], 0x13170204
mov dword [0xbacef8], 0x5d09080e
mov dword [0xbacefc], 0x60f105d
mov dword [0xbacf00], 0x5d4e4f13
mov dword [0xbacf04], 0x6a144247
mov word [0xbacf08], 0x676d
xor eax, eax
mov cl, byte [eax + 0xbaceec]
xor cl, 0x67
mov byte [eax + 0xbad598], cl
inc eax
cmp eax, 0x1e
jb 0xaf44a6
mov eax, 0xbad598
ret
Function at 0xaf44c1
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d40], 1
jne 0xaf4537
or dword [0xbb2d40], 1
mov dword [0xbacf0c], 0xe06216e
mov dword [0xbacf10], 0x4703020b
mov dword [0xbacf14], 0x470813
mov dword [0xbacf18], 0x14471302
mov dword [0xbacf1c], 0x5d5d0313
mov dword [0xbacf20], 0x2041f02
mov dword [0xbacf24], 0x80e1317
mov dword [0xbacf28], 0x105d5d09
mov dword [0xbacf2c], 0x4f13060f
mov dword [0xbacf30], 0x676d6a4e
mov cl, byte [eax + 0xbacf0c]
xor cl, 0x67
mov byte [eax + 0xbad5b8], cl
inc eax
cmp eax, 0x28
jb 0xaf4537
mov eax, 0xbad5b8
ret

Function at 0xaf4552
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d3c], 1
jne 0xaf4586
or dword [0xbb2d3c], 1
mov dword [0xbacf34], 0xa080438
mov dword [0xbacf38], 0x15150238
mov word [0xbacf3c], 0x1508
mov byte [0xbacf3e], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacf34]
xor cl, 0x67
mov byte [eax + 0xbad5e0], cl
inc eax
cmp eax, 0xb
jb 0xaf4588
mov eax, 0xbad5e0
ret

Function at 0xaf45a3
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d38], 1
jne 0xaf460e
or dword [0xbb2d38], 1
mov dword [0xbacf40], 0x804386e
mov dword [0xbacf44], 0x1502380a
mov dword [0xbacf48], 0x5d150815
mov dword [0xbacf4c], 0x1515225d
mov dword [0xbacf50], 0x22a1508
mov dword [0xbacf54], 0x61414
mov dword [0xbacf58], 0x5d4e4f02
mov dword [0xbacf5c], 0x6a144247
mov word [0xbacf60], 0x676d
mov cl, byte [eax + 0xbacf40]
xor cl, 0x67
mov byte [eax + 0xbad5ec], cl
inc eax
cmp eax, 0x22
jb 0xaf460e
mov eax, 0xbad5ec
ret

Function at 0xaf4629
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2d34], 1
jne 0xaf46a9
or dword [0xbb2d34], 1
mov dword [0xbacf64], 0xe06216e
mov dword [0xbacf68], 0x4703020b
mov dword [0xbacf6c], 0x470813
mov dword [0xbacf70], 0x38471302
mov dword [0xbacf74], 0x380a0804
mov dword [0xbacf78], 0x8151502
mov dword [0xbacf7c], 0x225d5d15
mov dword [0xbacf80], 0x15081515
mov dword [0xbacf84], 0x1414022a
mov dword [0xbacf88], 0x4f020006
mov dword [0xbacf8c], 0x676d6a4e
mov cl, byte [eax + 0xbacf64]
xor cl, 0x67
mov byte [eax + 0xbad610], cl
inc eax
cmp eax, 0x2c
jb 0xaf46a9
mov eax, 0xbad610
ret

Function at 0xaf46c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d30], 1
jne 0xaf473f
or dword [0xbb2d30], 1
mov dword [0xbacf90], 0x4061334
mov dword [0xbacf94], 0x1203470c
mov dword [0xbacf98], 0x247170a
mov dword [0xbacf9c], 0x15081515
mov dword [0xbacfa0], 0x824475d
mov dword [0xbacfa4], 0x1f021309
mov dword [0xbacfa8], 0x4023513
mov dword [0xbacfac], 0x47031508
mov dword [0xbacfb0], 0x47140610
mov dword [0xbacfb4], 0xb0b1209
mov byte [0xbacfb8], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacf90]
xor cl, 0x67
mov byte [eax + 0xbad63c], cl
inc eax
cmp eax, 0x29
jb 0xaf4741
mov eax, 0xbad63c
ret