joyce8/EMBER2024-capa huggingface dataset:
Function at 0x227d68
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x291f3e
call fcn.00290f48
sub esp, 0x64
test byte [0x2c6a30], 1
jne 0x227d95
or dword [0x2c6a30], 1
mov word [0x2c1db0], 0x3e56
mov byte [0x2c1db2], 0x73
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x2c1db0]
xor cl, 0x73
mov byte [eax + 0x2c23a0], cl
inc eax
cmp eax, 3
jb 0x227d9c
mov esi, 0x2c23a0
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x227dc8
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00224b8d
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0022cf4e
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00224c23
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x227e0f
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.00256a28
pop ecx
pop ecx
cmp eax, ebx
je 0x227e60
cmp eax, 3
jne 0x227e4d
call fcn.00227f67
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0026ac65
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x2b3490
lea eax, [ebp - 0x1c]
push eax
call fcn.00274b66
cmp eax, 4
jne 0x227e59
call fcn.0022801a
jmp 0x227e29
call fcn.002280cd
jmp 0x227e29
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0025845e
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x227f17
push ebx
call fcn.00228151
push eax
push 0xffffffffffffffff
push esi
call fcn.002571bf
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00224c02
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x227ecf
call fcn.00228198
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0022cfbf
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.00225af9
jmp 0x227e3f
cmp edi, 4
jne 0x227eee
call fcn.002281f7
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0022cfbf
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x227ec2
cmp edi, 6
jne 0x227f0d
call fcn.0022825c
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0022cfbf
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x227ec2
call fcn.002282e0
jmp 0x227e29
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.0025781a
pop ecx
pop ecx
test eax, eax
je 0x227f38
push ebx
push edi
push esi
call fcn.002579de
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.00257614
sub edi, eax
push edi
push esi
call fcn.0025762a
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00224c23
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x227f67
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a2c], 1
jne 0x227fff
or dword [0x2c6a2c], 1
mov dword [0x2c1db4], 0x1f1a1235
mov dword [0x2c1db8], 0x7531716
mov dword [0x2c1dbc], 0x516531c
mov dword [0x2c1dc0], 0x12061f12
mov dword [0x2c1dc4], 0x11531607
mov dword [0x2c1dc8], 0x71c1c
mov dword [0x2c1dcc], 0x3120107
mov dword [0x2c1dd0], 0x12011553
mov dword [0x2c1dd4], 0x1d161e14
mov dword [0x2c1dd8], 0x535f07
mov dword [0x2c1ddc], 0x12071d0a
mov dword [0x2c1de0], 0x116530b
mov dword [0x2c1de4], 0x73011c01
mov cl, byte [eax + 0x2c1db4]
xor cl, 0x73
mov byte [eax + 0x2c23a4], cl
inc eax
cmp eax, 0x34
jb 0x227fff
mov eax, 0x2c23a4
ret

Function at 0x22801a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a28], 1
jne 0x2280b2
or dword [0x2c6a28], 1
mov dword [0x2c1de8], 0x1f1a1235
mov dword [0x2c1dec], 0x7531716
mov dword [0x2c1df0], 0x516531c
mov dword [0x2c1df4], 0x12061f12
mov dword [0x2c1df8], 0x11531607
mov dword [0x2c1dfc], 0x71c1c
mov dword [0x2c1e00], 0x3120107
mov dword [0x2c1e04], 0x12011553
mov dword [0x2c1e08], 0x1d161e14
mov dword [0x2c1e0c], 0x1e535f07
mov dword [0x2c1e10], 0x11c1e16
mov dword [0x2c1e14], 0x116530a
mov dword [0x2c1e18], 0x73011c01
mov cl, byte [eax + 0x2c1de8]
xor cl, 0x73
mov byte [eax + 0x2c23d8], cl
inc eax
cmp eax, 0x34
jb 0x2280b2
mov eax, 0x2c23d8
ret

Function at 0x2280cd
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a24], 1
jne 0x228136
or dword [0x2c6a24], 1
mov dword [0x2c1e1c], 0x1d181d26
mov dword [0x2c1e20], 0x531d041c
mov dword [0x2c1e24], 0x1c010116
mov dword [0x2c1e28], 0x1d1a5301
mov dword [0x2c1e2c], 0x12061f53
mov dword [0x2c1e30], 0x1c1f2c3f
mov dword [0x2c1e34], 0x7001712
mov dword [0x2c1e38], 0x141d1a01
mov byte [0x2c1e3c], 0x73
mov cl, byte [eax + 0x2c1e1c]
xor cl, 0x73
mov byte [eax + 0x2c240c], cl
inc eax
cmp eax, 0x21
jb 0x228136
mov eax, 0x2c240c
ret

Function at 0x228151
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6a20], 1
jne 0x22817b
or dword [0x2c6a20], 1
mov dword [0x2c1e40], 0x1d1c1d4f
mov word [0x2c1e44], 0x4d16
mov byte [0x2c1e46], 0x73
xor eax, eax
mov cl, byte [eax + 0x2c1e40]
xor cl, 0x73
mov byte [eax + 0x2c2430], cl
inc eax
cmp eax, 7
jb 0x22817d
mov eax, 0x2c2430
ret

Function at 0x228198
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6a1c], 1
jne 0x2281da
or dword [0x2c6a1c], 1
mov dword [0x2c1e48], 0x5312063f
mov dword [0x2c1e4c], 0x71d0601
mov dword [0x2c1e50], 0x53161e1a
mov dword [0x2c1e54], 0x1c010116
mov dword [0x2c1e58], 0x73534901
xor eax, eax
mov cl, byte [eax + 0x2c1e48]
xor cl, 0x73
mov byte [eax + 0x2c2438], cl
inc eax
cmp eax, 0x14
jb 0x2281dc
mov eax, 0x2c2438
ret
Function at 0x2281f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6a18], 1
jne 0x22823f
or dword [0x2c6a18], 1
mov dword [0x2c1e5c], 0x5312063f
mov dword [0x2c1e60], 0x1c1e161e
mov dword [0x2c1e64], 0x16530a01
mov dword [0x2c1e68], 0x11c0101
mov word [0x2c1e6c], 0x5349
mov byte [0x2c1e6e], 0x73
xor eax, eax
mov cl, byte [eax + 0x2c1e5c]
xor cl, 0x73
mov byte [eax + 0x2c244c], cl
inc eax
cmp eax, 0x13
jb 0x228241
mov eax, 0x2c244c
ret

Function at 0x22825c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a14], 1
jne 0x2282c5
or dword [0x2c6a14], 1
mov dword [0x2c1e70], 0x5312063f
mov dword [0x2c1e74], 0x1c010116
mov dword [0x2c1e78], 0x1d1a5301
mov dword [0x2c1e7c], 0x16171a00
mov dword [0x2c1e80], 0x1011653
mov dword [0x2c1e84], 0x1b53011c
mov dword [0x2c1e88], 0x1f171d12
mov dword [0x2c1e8c], 0x53490116
mov byte [0x2c1e90], 0x73
mov cl, byte [eax + 0x2c1e70]
xor cl, 0x73
mov byte [eax + 0x2c2460], cl
inc eax
cmp eax, 0x21
jb 0x2282c5
mov eax, 0x2c2460
ret

Function at 0x2282e0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c6a10], 1
jne 0x22833c
or dword [0x2c6a10], 1
mov dword [0x2c1e94], 0x1d181d26
mov dword [0x2c1e98], 0x531d041c
mov dword [0x2c1e9c], 0x1c010116
mov dword [0x2c1ea0], 0x1d1a5301
mov dword [0x2c1ea4], 0x12061f53
mov dword [0x2c1ea8], 0x1210032c
mov word [0x2c1eac], 0x1f1f
mov byte [0x2c1eae], 0x73
xor eax, eax
mov cl, byte [eax + 0x2c1e94]
xor cl, 0x73
mov byte [eax + 0x2c2484], cl
inc eax
cmp eax, 0x1b
jb 0x22833e
mov eax, 0x2c2484
ret

Function at 0x22857a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a0c], 1
jne 0x2285c5
or dword [0x2c6a0c], 1
mov dword [0x2c1eb0], 0x16001231
mov dword [0x2c1eb4], 0x17534745
mov dword [0x2c1eb8], 0x171c1016
mov dword [0x2c1ebc], 0x12155316
mov dword [0x2c1ec0], 0x17161f1a
mov byte [0x2c1ec4], 0x73
mov cl, byte [eax + 0x2c1eb0]
xor cl, 0x73
mov byte [eax + 0x2c24a0], cl
inc eax
cmp eax, 0x15
jb 0x2285c5
mov eax, 0x2c24a0
ret
Function at 0x2285e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x293a69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0024b986
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.00249d50
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.00224d61
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.0022ab4f
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x22866d
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0024e986
add esp, 0x10
test al, al
jne 0x2286b2
call fcn.00228729
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.0026ac65
push 0x2b3490
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00274b66
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.0022ab4f
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x2286f2
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x2286d1
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.00229fbd
lea esi, [esp + 0x20]
call fcn.00224b2a
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00224c23
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x228729
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a08], 1
jne 0x228774
or dword [0x2c6a08], 1
mov dword [0x2c1ec8], 0x16001231
mov dword [0x2c1ecc], 0x17534745
mov dword [0x2c1ed0], 0x171c1016
mov dword [0x2c1ed4], 0x12155316
mov dword [0x2c1ed8], 0x17161f1a
mov byte [0x2c1edc], 0x73
mov cl, byte [eax + 0x2c1ec8]
xor cl, 0x73
mov byte [eax + 0x2c24b8], cl
inc eax
cmp eax, 0x15
jb 0x228774
mov eax, 0x2c24b8
ret

Function at 0x228e66
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c6a04], 1
jne 0x228ebd
or dword [0x2c6a04], 1
mov dword [0x2c1ee0], 0x1f061c30
mov dword [0x2c1ee4], 0x1c1d5317
mov dword [0x2c1ee8], 0x31c5307
mov dword [0x2c1eec], 0x10531d16
mov dword [0x2c1ef0], 0x1b001201
mov dword [0x2c1ef4], 0x1e061753
mov word [0x2c1ef8], 0x7303
mov cl, byte [eax + 0x2c1ee0]
xor cl, 0x73
mov byte [eax + 0x2c24d0], cl
inc eax
cmp eax, 0x1a
jb 0x228ebd
mov eax, 0x2c24d0
ret
Function at 0x228ed8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69fc], 1
jne 0x228efb
or dword [0x2c69fc], 1
mov dword [0x2c1f00], 0x141c1f5c
mov word [0x2c1f04], 0x735c
xor eax, eax
mov cl, byte [eax + 0x2c1f00]
xor cl, 0x73
mov byte [eax + 0x2c24f0], cl
inc eax
cmp eax, 6
jb 0x228efd
mov eax, 0x2c24f0
ret

Function at 0x228f18
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69f8], 1
jne 0x228f95
or dword [0x2c69f8], 1
mov dword [0x2c1f08], 0x307071b
mov dword [0x2c1f0c], 0x125c5c49
mov dword [0x2c1f10], 0xa1f121d
mov dword [0x2c1f14], 0x101a07
mov dword [0x2c1f18], 0x716145d
mov dword [0x2c1f1c], 0x1d041c17
mov dword [0x2c1f20], 0x7001607
mov dword [0x2c1f24], 0x1e1c105d
mov dword [0x2c1f28], 0x5c41055c
mov dword [0x2c1f2c], 0x5c141c1f
mov byte [0x2c1f30], 0x73
mov cl, byte [eax + 0x2c1f08]
xor cl, 0x73
mov byte [eax + 0x2c24f8], cl
inc eax
cmp eax, 0x29
jb 0x228f95
mov eax, 0x2c24f8
ret

Function at 0x228fb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69f4], 1
jne 0x228fdd
or dword [0x2c69f4], 1
mov dword [0x2c1f34], 0x554e10
mov dword [0x2c1f38], 0x4e07554e
mov byte [0x2c1f3c], 0x73
mov cl, byte [eax + 0x2c1f34]
xor cl, 0x73
mov byte [eax + 0x2c2524], cl
inc eax
cmp eax, 9
jb 0x228fdd
mov eax, 0x2c2524
ret

Function at 0x228ff8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69e4], 1
jne 0x229080
or dword [0x2c69e4], 1
mov dword [0x2c1f50], 0x71d1c30
mov dword [0x2c1f54], 0x5e071d16
mov dword [0x2c1f58], 0x16030a27
mov dword [0x2c1f5c], 0x3125349
mov dword [0x2c1f60], 0x101a1f03
mov dword [0x2c1f64], 0x1c1a0712
mov dword [0x2c1f68], 0x5e0b5c1d
mov dword [0x2c1f6c], 0x5e040404
mov dword [0x2c1f70], 0x1e011c15
mov dword [0x2c1f74], 0x1f01065e
mov dword [0x2c1f78], 0x1c101d16
mov dword [0x2c1f7c], 0x73171617
xor eax, eax
mov cl, byte [eax + 0x2c1f50]
xor cl, 0x73
mov byte [eax + 0x2c2540], cl
inc eax
cmp eax, 0x30
jb 0x229082
mov eax, 0x2c2540
ret

Function at 0x22909d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69e0], 1
jne 0x2290c8
or dword [0x2c69e0], 1
mov dword [0x2c1f80], 0x27203c23
mov dword [0x2c1f84], 0x531c0753
mov byte [0x2c1f88], 0x73
xor eax, eax
mov cl, byte [eax + 0x2c1f80]
xor cl, 0x73
mov byte [eax + 0x2c2570], cl
inc eax
cmp eax, 9
jb 0x2290ca
mov eax, 0x2c2570
ret

Function at 0x2290e5
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69dc], 1
jne 0x229130
or dword [0x2c69dc], 1
mov dword [0x2c1f8c], 0x1a121553
mov dword [0x2c1f90], 0x5317161f
mov dword [0x2c1f94], 0x1b071a04
mov dword [0x2c1f98], 0x12070053
mov dword [0x2c1f9c], 0x53000607
mov byte [0x2c1fa0], 0x73
mov cl, byte [eax + 0x2c1f8c]
xor cl, 0x73
mov byte [eax + 0x2c257c], cl
inc eax
cmp eax, 0x15
jb 0x229130
mov eax, 0x2c257c
ret
Function at 0x229165
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2924cc
call fcn.00290f48
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x229316
cmp dword [ebp + 0x10], ebx
je 0x229316
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0022a4b0
push eax
push 0x2b1c48
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.002253b7
push 0x2b1c44
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.002253ed
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.00224d61
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00224d61
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x229271
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0022a4b0
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0022a4d2
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x229225
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0022df46
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.00224d61
inc bl
jne 0x2292dd
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.00224d61
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x2291ec
test byte [0x2c69d4], 1
jne 0x22929e
or dword [0x2c69d4], 1
mov dword [0x2c1fb0], 0x53071c3d
mov dword [0x2c1fb4], 0x1d061c15
mov word [0x2c1fb8], 0x7317
xor eax, eax
mov cl, byte [eax + 0x2c1fb0]
xor cl, 0x73
mov byte [eax + 0x2c25a0], cl
inc eax
cmp eax, 0xa
jb 0x2292a0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x2c25a0
call fcn.0026ac65
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x2b3490
lea eax, [ebp - 0x44]
push eax
call fcn.00274b66
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0022a4d2
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.00224d61
push 1
lea esi, [ebp - 0x2c]
call fcn.00224d61
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.0022933b
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0026ac65
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x2b3490
lea eax, [ebp - 0x38]
jmp 0x2292d7

Function at 0x22933b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69d8], 1
jne 0x229368
or dword [0x2c69d8], 1
mov dword [0x2c1fa4], 0x53071c3d
mov dword [0x2c1fa8], 0x1d061c15
mov word [0x2c1fac], 0x7317
xor eax, eax
mov cl, byte [eax + 0x2c1fa4]
xor cl, 0x73
mov byte [eax + 0x2c2594], cl
inc eax
cmp eax, 0xa
jb 0x22936a
mov eax, 0x2c2594
ret
Function at 0x229b1f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69d0], 1
mov ecx, 0x8773
jne 0x229ba9
or dword [0x2c69d0], 1
lea eax, [ecx - 0x63]
mov word [0x2c1fbc], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0x2c1fbe], dx
lea edx, [ecx - 0x61]
mov word [0x2c1fc0], dx
add edx, 0xffffffee
mov word [0x2c1fc2], dx
lea edx, [ecx - 0x58]
mov word [0x2c1fc4], dx
add edx, 0x11
mov word [0x2c1fc6], dx
mov edx, eax
mov word [0x2c1fc8], dx
lea edx, [ecx - 0x5d]
lea eax, [ecx - 0x6c]
mov word [0x2c1fca], dx
mov word [0x2c1fd2], ax
add edx, 0xffffffed
mov eax, ecx
mov word [0x2c1fcc], dx
mov dword [0x2c1fce], 0x8701871c
mov word [0x2c1fd4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2c1fbc]
add eax, 2
mov word [eax + 0x2c25aa], dx
cmp eax, 0x1a
jb 0x229bab
mov eax, 0x2c25ac
ret

Function at 0x229bc9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69cc], 1
jne 0x229bf4
or dword [0x2c69cc], 1
mov dword [0x2c1fd8], 0x1d011618
mov dword [0x2c1fdc], 0x41401f16
mov byte [0x2c1fe0], 0x73
xor eax, eax
mov cl, byte [eax + 0x2c1fd8]
xor cl, 0x73
mov byte [eax + 0x2c25c8], cl
inc eax
cmp eax, 9
jb 0x229bf6
mov eax, 0x2c25c8
ret

Function at 0x229c11
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69c8], 1
jne 0x229c7c
or dword [0x2c69c8], 1
mov dword [0x2c1fe4], 0x23071620
mov dword [0x2c1fe8], 0x16101c01
mov dword [0x2c1fec], 0x260000
mov dword [0x2c1ff0], 0x1c3e0116
mov dword [0x2c1ff4], 0xb361617
mov dword [0x2c1ff8], 0x7031610
mov dword [0x2c1ffc], 0x231d1c1a
mov dword [0x2c2000], 0x101a1f1c
mov word [0x2c2004], 0x730a
mov cl, byte [eax + 0x2c1fe4]
xor cl, 0x73
mov byte [eax + 0x2c25d4], cl
inc eax
cmp eax, 0x22
jb 0x229c7c
mov eax, 0x2c25d4
ret

Function at 0x229c97
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69c4], 1
jne 0x229d02
or dword [0x2c69c4], 1
mov dword [0x2c2008], 0x23071634
mov dword [0x2c200c], 0x16101c01
mov dword [0x2c2010], 0x260000
mov dword [0x2c2014], 0x1c3e0116
mov dword [0x2c2018], 0xb361617
mov dword [0x2c201c], 0x7031610
mov dword [0x2c2020], 0x231d1c1a
mov dword [0x2c2024], 0x101a1f1c
mov word [0x2c2028], 0x730a
mov cl, byte [eax + 0x2c2008]
xor cl, 0x73
mov byte [eax + 0x2c25f8], cl
inc eax
cmp eax, 0x22
jb 0x229d02
mov eax, 0x2c25f8
ret

Function at 0x229d1d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69c0], 1
jne 0x229d73
or dword [0x2c69c0], 1
mov dword [0x2c202c], 0x53161f3c
mov dword [0x2c2030], 0x71a1d1a
mov dword [0x2c2034], 0x1a1f121a
mov dword [0x2c2038], 0x1a071209
mov dword [0x2c203c], 0x15531d1c
mov dword [0x2c2040], 0x161f1a12
mov dword [0x2c2044], 0x73534917
xor eax, eax
mov cl, byte [eax + 0x2c202c]
xor cl, 0x73
mov byte [eax + 0x2c261c], cl
inc eax
cmp eax, 0x1c
jb 0x229d75
mov eax, 0x2c261c
ret
Function at 0x229d90
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69bc], 1
mov ecx, 0x8773
jne 0x229dbf
or dword [0x2c69bc], 1
lea eax, [ecx - 0x61]
mov word [0x2c2048], ax
add eax, 0x2f
mov word [0x2c204a], ax
mov eax, ecx
mov word [0x2c204c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x2c2048]
add eax, 2
mov word [eax + 0x2c2636], dx
cmp eax, 6
jb 0x229dc1
mov eax, 0x2c2638
ret

Function at 0x229ddf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69b4], 1
jne 0x229e4f
or dword [0x2c69b4], 1
mov dword [0x2c2058], 0x1f1a1235
mov dword [0x2c205c], 0x7531716
mov dword [0x2c2060], 0x1d1a531c
mov dword [0x2c2064], 0x121a071a
mov dword [0x2c2068], 0x16091a1f
mov dword [0x2c206c], 0x51d1653
mov dword [0x2c2070], 0x1d1c011a
mov dword [0x2c2074], 0x71d161e
mov word [0x2c2078], 0x5349
mov byte [0x2c207a], 0x73
xor eax, eax
mov cl, byte [eax + 0x2c2058]
xor cl, 0x73
mov byte [eax + 0x2c2648], cl
inc eax
cmp eax, 0x23
jb 0x229e51
mov eax, 0x2c2648
ret

Function at 0x229e6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69ac], 1
jne 0x229eb7
or dword [0x2c69ac], 1
mov dword [0x2c2084], 0x121b1d26
mov dword [0x2c2088], 0x161f171d
mov dword [0x2c208c], 0xb165317
mov dword [0x2c2090], 0x7031610
mov dword [0x2c2094], 0x491d1c1a
mov word [0x2c2098], 0x7353
xor eax, eax
mov cl, byte [eax + 0x2c2084]
xor cl, 0x73
mov byte [eax + 0x2c2674], cl
inc eax
cmp eax, 0x16
jb 0x229eb9
mov eax, 0x2c2674
ret

Function at 0x229ed4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69a8], 1
jne 0x229f29
or dword [0x2c69a8], 1
mov dword [0x2c209c], 0x121b1d26
mov dword [0x2c20a0], 0x161f171d
mov dword [0x2c20a4], 0xb165317
mov dword [0x2c20a8], 0x7031610
mov dword [0x2c20ac], 0x491d1c1a
mov dword [0x2c20b0], 0x79005653
mov byte [0x2c20b4], 0x73
mov cl, byte [eax + 0x2c209c]
xor cl, 0x73
mov byte [eax + 0x2c268c], cl
inc eax
cmp eax, 0x19
jb 0x229f29
mov eax, 0x2c268c
ret

Function at 0x229f44
Capabilities:
Encode data using xor

Disassembly:
test byte [0x2c69a4], 1
jne 0x229f7c
or dword [0x2c69a4], 1
mov dword [0x2c20b8], 0x11060720
mov dword [0x2c20bc], 0x1a0b1653
mov dword [0x2c20c0], 0x565b5307
mov dword [0x2c20c4], 0x73795a17
xor eax, eax
mov cl, byte [eax + 0x2c20b8]
xor cl, 0x73
mov byte [eax + 0x2c26a8], cl
inc eax
cmp eax, 0x10
jb 0x229f7e
mov eax, 0x2c26a8
ret
Function at 0x22b94a
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2921c4
call fcn.00290f48
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x22ba2e
cmp byte [edi + 0x49], bl
je 0x22ba2e
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x22b981
xor al, al
jmp 0x22ba30
push esi
lea esi, [ebp - 0x2c]
call fcn.0022b443
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x22b9d1
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x22b9d6
dec eax
je 0x22b9da
dec eax
dec eax
je 0x22ba2a
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00224c23
mov al, bl
pop esi
jmp 0x22ba30
mov edx, dword [ebp - 0x2c]
jmp 0x22b99b
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x22b9e6
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x22ba0c
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x22b9f9
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0026ca3e
add esp, 0x10
cmp esi, eax
jne 0x22b9be
cmp byte [edi + 0x49], 0
je 0x22ba2a
test esi, esi
jne 0x22b98d
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0022b51c
jmp 0x22b98d
mov bl, 1
jmp 0x22b9c0
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x23019d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c69a0], 1
jne 0x230213
or dword [0x2c69a0], 1
mov dword [0x2c26c8], 0x18011b37
mov dword [0x2c26cc], 0x1b1a5410
mov dword [0x2c26d0], 0x11135400
mov dword [0x2c26d4], 0x1d105400
mov dword [0x2c26d8], 0x101d0407
mov dword [0x2c26dc], 0x54121b54
mov dword [0x2c26e0], 0x1c001119
mov dword [0x2c26e4], 0x5354101b
mov dword [0x2c26e8], 0x18181517
mov dword [0x2c26ec], 0x74544e53
mov cl, byte [eax + 0x2c26c8]
xor cl, 0x74
mov byte [eax + 0x2c27dc], cl
inc eax
cmp eax, 0x28
jb 0x230213
mov eax, 0x2c27dc
ret

Function at 0x23022e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x2c699c], 1
jne 0x230297
or dword [0x2c699c], 1
mov dword [0x2c26f0], 0x181d1532
mov dword [0x2c26f4], 0x541011
mov dword [0x2c26f8], 0x1a1d541b
mov dword [0x2c26fc], 0x111f1b02
mov dword [0x2c2700], 0x111954
mov dword [0x2c2704], 0x54101b1c
mov dword [0x2c2708], 0x18151753
mov dword [0x2c270c], 0x544e5318
mov byte [0x2c2710], 0x74
mov cl, byte [eax + 0x2c26f0]
xor cl, 0x74
mov byte [eax + 0x2c2804], cl
inc eax
cmp eax, 0x21
jb 0x230297
mov eax, 0x2c2804
ret