joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaf475c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d2c], 1
jne 0xaf47d6
or dword [0xbb2d2c], 1
mov dword [0xbacfbc], 0x4061334
mov dword [0xbacfc0], 0x1203470c
mov dword [0xbacfc4], 0x247170a
mov dword [0xbacfc8], 0x15081515
mov dword [0xbacfcc], 0x1e34475d
mov dword [0xbacfd0], 0xe092e0a
mov dword [0xbacfd4], 0xb060e13
mov dword [0xbacfd8], 0x47021d0e
mov dword [0xbacfdc], 0xb0e0601
mov word [0xbacfe0], 0x302
mov byte [0xbacfe2], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacfbc]
xor cl, 0x67
mov byte [eax + 0xbad668], cl
inc eax
cmp eax, 0x27
jb 0xaf47d8
mov eax, 0xbad668
ret

Function at 0xaf47f3
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d28], 1
jne 0xaf4859
or dword [0xbb2d28], 1
mov dword [0xbacfe4], 0xe0c145b
mov dword [0xbacfe8], 0x3021717
mov dword [0xbacfec], 0x6150147
mov dword [0xbacff0], 0x474b020a
mov dword [0xbacff4], 0x10472437
mov dword [0xbacff8], 0x9471406
mov dword [0xbacffc], 0x590b0b12
mov word [0xbad000], 0x6d6a
mov byte [0xbad002], 0x67
xor eax, eax
mov cl, byte [eax + 0xbacfe4]
xor cl, 0x67
mov byte [eax + 0xbad690], cl
inc eax
cmp eax, 0x1f
jb 0xaf485b
mov eax, 0xbad690
ret

Function at 0xaf4876
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d24], 1
jne 0xaf4909
or dword [0xbb2d24], 1
mov dword [0xbad004], 0xe0c145b
mov dword [0xbad008], 0x3021717
mov dword [0xbad00c], 0x6150147
mov dword [0xbad010], 0x474b020a
mov dword [0xbad014], 0x10472437
mov dword [0xbad018], 0x14471406
mov dword [0xbad01c], 0x47020a06
mov dword [0xbad020], 0x15471406
mov dword [0xbad024], 0x15121302
mov dword [0xbad028], 0x3064709
mov dword [0xbad02c], 0x14021503
mov dword [0xbad030], 0x6d6a5914
mov byte [0xbad034], 0x67
xor eax, eax
mov cl, byte [eax + 0xbad004]
xor cl, 0x67
mov byte [eax + 0xbad6b0], cl
inc eax
cmp eax, 0x31
jb 0xaf490b
mov eax, 0xbad6b0
ret
Function at 0xaf4926
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.00b66ab0
push ebx
push esi
push edi
call dword [0xb82094]
test byte [0xbb2d20], 1
mov dword [ebp - 4], eax
jne 0xaf496d
or dword [0xbb2d20], 1
mov dword [0xbad038], 0x3080a5b
mov dword [0xbad03c], 0x58020b12
mov dword [0xbad040], 0x67595858
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0xbad038]
xor cl, 0x67
mov byte [eax + 0xbad6e4], cl
inc eax
cmp eax, 0xc
jb 0xaf4971
test byte [0xbb2d1c], 1
mov dword [ebp - 8], 0xbad6e4
jne 0xaf49bb
or dword [0xbb2d1c], 1
mov dword [0xbad044], 0xa1e145b
mov dword [0xbad048], 0x580b0805
mov dword [0xbad04c], 0x67595858
xor eax, eax
mov cl, byte [eax + 0xbad044]
xor cl, 0x67
mov byte [eax + 0xbad6f0], cl
inc eax
cmp eax, 0xc
jb 0xaf49bd
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0xbad6f0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00b56f70
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0xb823b0]
test eax, eax
je 0xaf4a22
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.00b56f70
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0xb823bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0xaf4a6e
mov ecx, dword [ebp - 0x1c]
test byte [0xbb2d18], 1
jne 0xaf4aa5
or dword [0xbb2d18], 1
mov dword [0xbad050], 0x42471742
mov dword [0xbad054], 0x14424614
mov dword [0xbad058], 0x421f574c
mov word [0xbad05c], 0x671f
xor eax, eax
mov dl, byte [eax + 0xbad050]
xor dl, 0x67
mov byte [eax + 0xbad6fc], dl
inc eax
cmp eax, 0xe
jb 0xaf4aa7
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0xbad6fc
push dword [ebp + 0xc]
call fcn.00b5419d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0xb823a4]
test eax, eax
je 0xaf4b1e
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00af4b6b
push eax
push dword [ebp + 0xc]
call fcn.00b5419d
add esp, 0x14
test byte [0xbb2d10], 1
jne 0xaf4b3e
or dword [0xbb2d10], 1
mov word [0xbad070], 0x6d6a
mov byte [0xbad072], 0x67
xor eax, eax
mov cl, byte [eax + 0xbad070]
xor cl, 0x67
mov byte [eax + 0xbad71c], cl
inc eax
cmp eax, 3
jb 0xaf4b40
push dword [ebp + 0xc]
push 0xbad71c
call fcn.00b53e11
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xaf4b6b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d14], 1
jne 0xaf4ba3
or dword [0xbb2d14], 1
mov dword [0xbad060], 0x14424f47
mov dword [0xbad064], 0x4703425d
mov dword [0xbad068], 0x1f57474c
mov dword [0xbad06c], 0x674e1f42
xor eax, eax
mov cl, byte [eax + 0xbad060]
xor cl, 0x67
mov byte [eax + 0xbad70c], cl
inc eax
cmp eax, 0x10
jb 0xaf4ba5
mov eax, 0xbad70c
ret

Function at 0xaf5e1b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d04], 1
jne 0xaf5e70
or dword [0xbb2d04], 1
mov dword [0xbad740], 0x2c3a2920
mov dword [0xbad744], 0x2d3a293f
mov dword [0xbad748], 0x382b2934
mov dword [0xbad74c], 0x3b2c3421
mov dword [0xbad750], 0x3e343c2c
mov dword [0xbad754], 0x3730272a
mov word [0xbad758], 0x6837
xor eax, eax
mov cl, byte [eax + 0xbad740]
xor cl, 0x68
mov byte [eax + 0xbad940], cl
inc eax
cmp eax, 0x1a
jb 0xaf5e72
mov eax, 0xbad940
ret

Function at 0xaf5f81
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2d00], 1
jne 0xaf5fab
or dword [0xbb2d00], 1
mov dword [0xbad75c], 0x93f253e
mov word [0xbad760], 0xd1a
mov byte [0xbad762], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad75c]
xor cl, 0x68
mov byte [eax + 0xbad95c], cl
inc eax
cmp eax, 7
jb 0xaf5fad
mov eax, 0xbad95c
ret

Function at 0xaf5fc8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cfc], 1
jne 0xaf5ff5
or dword [0xbb2cfc], 1
mov dword [0xbad764], 0x1c1a013e
mov dword [0xbad768], 0x3804091d
mov word [0xbad76c], 0x682b
xor eax, eax
mov cl, byte [eax + 0xbad764]
xor cl, 0x68
mov byte [eax + 0xbad964], cl
inc eax
cmp eax, 0xa
jb 0xaf5ff7
mov eax, 0xbad964
ret

Function at 0xaf6012
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cf8], 1
jne 0xaf6046
or dword [0xbb2cf8], 1
mov dword [0xbad770], 0x1c1a013e
mov dword [0xbad774], 0x2a04091d
mov word [0xbad778], 0x1007
mov byte [0xbad77a], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad770]
xor cl, 0x68
mov byte [eax + 0xbad970], cl
inc eax
cmp eax, 0xb
jb 0xaf6048
mov eax, 0xbad970
ret

Function at 0xaf6063
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cf4], 1
jne 0xaf6087
or dword [0xbb2cf4], 1
mov dword [0xbad77c], 0xd060d2f
mov dword [0xbad780], 0x680b011a
xor eax, eax
mov cl, byte [eax + 0xbad77c]
xor cl, 0x68
mov byte [eax + 0xbad97c], cl
inc eax
cmp eax, 8
jb 0xaf6089
mov eax, 0xbad97c
ret
Function at 0xaf60a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xb7b2cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push esi
xor esi, esi
test byte [0xbb2cf0], 1
push edi
mov dword [esp + 0xc], esi
jne 0xaf60fa
or dword [0xbb2cf0], 1
mov dword [0xbad784], 0x40c1c06
mov dword [0xbad788], 0x40c4604
mov word [0xbad78c], 0x6804
xor eax, eax
mov cl, byte [eax + 0xbad784]
xor cl, 0x68
mov byte [eax + 0xbad984], cl
inc eax
cmp eax, 0xa
jb 0xaf60fc
push 0xbad984
call dword [0xb820cc]
mov edi, eax
cmp edi, esi
jne 0xaf616e
call dword [0xb820a8]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], esi
call fcn.00af62b5
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0xbc], 1
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
push eax
call fcn.00b5d8c5
call fcn.00af631b
push eax
push edi
call dword [0xb820c8]
cmp eax, esi
jne 0xaf61cb
call dword [0xb820a8]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], 2
call fcn.00af638d
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0xbc], 3
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
jmp 0xaf6168
lea ecx, [esp + 0xc]
push ecx
push 0x18
lea ecx, [esp + 0x68]
push ecx
push esi
push dword [ebp + 8]
call eax
test eax, eax
jne 0xaf6252
cmp dword [esp + 0xc], 0x18
jne 0xaf6252
push dword [esp + 0x74]
push esi
push 0x410
call dword [0xb820c4]
cmp eax, esi
jne 0xaf62a1
call dword [0xb820a8]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], 6
call fcn.00af64cd
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 0x1c]
mov byte [esp + 0xbc], 7
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
jmp 0xaf6168
call dword [0xb820a8]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], 4
call fcn.00af6440
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0xbc], 5
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
jmp 0xaf6168
mov ecx, dword [esp + 0xb4]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xaf62b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cec], 1
jne 0xaf62fe
or dword [0xbb2cec], 1
mov dword [0xbad790], 0xc090724
mov dword [0xbad794], 0x1a0a0124
mov dword [0xbad798], 0x48111a09
mov dword [0xbad79c], 0x401090e
mov dword [0xbad7a0], 0x48520c0d
mov byte [0xbad7a4], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad790]
xor cl, 0x68
mov byte [eax + 0xbad990], cl
inc eax
cmp eax, 0x15
jb 0xaf6300
mov eax, 0xbad990
ret
Function at 0xaf631b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2ce8], 1
jne 0xaf6370
or dword [0xbb2ce8], 1
mov dword [0xbad7a8], 0x1d391c26
mov dword [0xbad7ac], 0x21111a0d
mov dword [0xbad7b0], 0x1a070e06
mov dword [0xbad7b4], 0x11c0905
mov dword [0xbad7b8], 0x1a380607
mov dword [0xbad7bc], 0x1b0d0b07
mov word [0xbad7c0], 0x681b
xor eax, eax
mov cl, byte [eax + 0xbad7a8]
xor cl, 0x68
mov byte [eax + 0xbad9a8], cl
inc eax
cmp eax, 0x1a
jb 0xaf6372
mov eax, 0xbad9a8
ret

Function at 0xaf638d
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2ce4], 1
jne 0xaf6423
or dword [0xbb2ce4], 1
mov dword [0xbad7c4], 0x381c0d2f
mov dword [0xbad7c8], 0x290b071a
mov dword [0xbad7cc], 0xd1a0c0c
mov dword [0xbad7d0], 0xe481b1b
mov dword [0xbad7d4], 0xd040109
mov dword [0xbad7d8], 0x2640480c
mov dword [0xbad7dc], 0xd1d391c
mov dword [0xbad7e0], 0x621111a
mov dword [0xbad7e4], 0x51a070e
mov dword [0xbad7e8], 0x7011c09
mov dword [0xbad7ec], 0x71a3806
mov dword [0xbad7f0], 0x1b1b0d0b
mov dword [0xbad7f4], 0x68485241
xor eax, eax
mov cl, byte [eax + 0xbad7c4]
xor cl, 0x68
mov byte [eax + 0xbad9c4], cl
inc eax
cmp eax, 0x34
jb 0xaf6425
mov eax, 0xbad9c4
ret

Function at 0xaf6440
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2ce0], 1
jne 0xaf64b0
or dword [0xbb2ce0], 1
mov dword [0xbad7f8], 0x1d391c26
mov dword [0xbad7fc], 0x21111a0d
mov dword [0xbad800], 0x1a070e06
mov dword [0xbad804], 0x11c0905
mov dword [0xbad808], 0x1a380607
mov dword [0xbad80c], 0x1b0d0b07
mov dword [0xbad810], 0x90e481b
mov dword [0xbad814], 0xc0d0401
mov word [0xbad818], 0x4852
mov byte [0xbad81a], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad7f8]
xor cl, 0x68
mov byte [eax + 0xbad9f8], cl
inc eax
cmp eax, 0x23
jb 0xaf64b2
mov eax, 0xbad9f8
ret

Function at 0xaf64cd
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cdc], 1
jne 0xaf6516
or dword [0xbb2cdc], 1
mov dword [0xbad81c], 0x60d1827
mov dword [0xbad820], 0xb071a38
mov dword [0xbad824], 0x481b1b0d
mov dword [0xbad828], 0x401090e
mov dword [0xbad82c], 0x48520c0d
mov byte [0xbad830], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad81c]
xor cl, 0x68
mov byte [eax + 0xbada1c], cl
inc eax
cmp eax, 0x15
jb 0xaf6518
mov eax, 0xbada1c
ret
Function at 0xaf6533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xb7b27a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0xbb2cd8], 1
push esi
push edi
jne 0xaf6590
or dword [0xbb2cd8], 1
mov dword [0xbad834], 0x61a0d03
mov dword [0xbad838], 0x5a5b040d
mov dword [0xbad83c], 0x4040c46
mov byte [0xbad840], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad834]
xor cl, 0x68
mov byte [eax + 0xbada34], cl
inc eax
cmp eax, 0xd
jb 0xaf6592
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0xbada34
call edi
mov esi, eax
test esi, esi
jne 0xaf6606
call dword [0xb820a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00af6768
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
push eax
call fcn.00b5d8c5
call fcn.00af67e5
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0xaf66d3
call fcn.00af6858
push eax
call edi
mov edi, eax
test edi, edi
jne 0xaf6677
call dword [0xb820a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.00af68a2
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
jmp 0xaf6600
call fcn.00af691c
push eax
push edi
call esi
test eax, eax
jne 0xaf66d3
call dword [0xb820a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00af698c
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
jmp 0xaf6600
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0xaf6735
call dword [0xb820a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00b1a90d
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00af6a45
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00af6b06
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00af5bec
push 0xb9ec40
mov eax, esi
jmp 0xaf6600
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00af4ce7
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xaf6768
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cd4], 1
jne 0xaf67c8
or dword [0xbb2cd4], 1
mov dword [0xbad844], 0xc090724
mov dword [0xbad848], 0x1a0a0124
mov dword [0xbad84c], 0x48111a09
mov dword [0xbad850], 0x401090e
mov dword [0xbad854], 0x40480c0d
mov dword [0xbad858], 0x61a0d03
mov dword [0xbad85c], 0x5a5b040d
mov dword [0xbad860], 0x68485241
xor eax, eax
mov cl, byte [eax + 0xbad844]
xor cl, 0x68
mov byte [eax + 0xbada44], cl
inc eax
cmp eax, 0x20
jb 0xaf67ca
mov eax, 0xbada44
ret
Function at 0xaf67e5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cd0], 1
jne 0xaf683b
or dword [0xbb2cd0], 1
mov dword [0xbad864], 0x2f5a5b23
mov dword [0xbad868], 0x1a381c0d
mov dword [0xbad86c], 0x1b0d0b07
mov dword [0xbad870], 0x905211b
mov dword [0xbad874], 0x12e0d0f
mov dword [0xbad878], 0x9260d04
mov dword [0xbad87c], 0x68290d05
xor eax, eax
mov cl, byte [eax + 0xbad864]
xor cl, 0x68
mov byte [eax + 0xbada64], cl
inc eax
cmp eax, 0x1c
jb 0xaf683d
mov eax, 0xbada64
ret

Function at 0xaf6858
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2ccc], 1
jne 0xaf6885
or dword [0xbb2ccc], 1
mov dword [0xbad880], 0x18091b18
mov dword [0xbad884], 0x40c4601
mov word [0xbad888], 0x6804
xor eax, eax
mov cl, byte [eax + 0xbad880]
xor cl, 0x68
mov byte [eax + 0xbada80], cl
inc eax
cmp eax, 0xa
jb 0xaf6887
mov eax, 0xbada80
ret

Function at 0xaf68a2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cc8], 1
jne 0xaf68ff
or dword [0xbb2cc8], 1
mov dword [0xbad88c], 0xc090724
mov dword [0xbad890], 0x1a0a0124
mov dword [0xbad894], 0x48111a09
mov dword [0xbad898], 0x401090e
mov dword [0xbad89c], 0x40480c0d
mov dword [0xbad8a0], 0x18091b18
mov dword [0xbad8a4], 0x48524101
mov byte [0xbad8a8], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad88c]
xor cl, 0x68
mov byte [eax + 0xbada8c], cl
inc eax
cmp eax, 0x1d
jb 0xaf6901
mov eax, 0xbada8c
ret

Function at 0xaf691c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cc4], 1
jne 0xaf696f
or dword [0xbb2cc4], 1
mov dword [0xbad8ac], 0x381c0d2f
mov dword [0xbad8b0], 0xd0b071a
mov dword [0xbad8b4], 0x5211b1b
mov dword [0xbad8b8], 0x2e0d0f09
mov dword [0xbad8bc], 0x260d0401
mov dword [0xbad8c0], 0x290d0509
mov byte [0xbad8c4], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad8ac]
xor cl, 0x68
mov byte [eax + 0xbadaac], cl
inc eax
cmp eax, 0x19
jb 0xaf6971
mov eax, 0xbadaac
ret

Function at 0xaf698c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cc0], 1
jne 0xaf6a28
or dword [0xbb2cc0], 1
mov dword [0xbad8c8], 0x381c0d2f
mov dword [0xbad8cc], 0x290b071a
mov dword [0xbad8d0], 0xd1a0c0c
mov dword [0xbad8d4], 0xe481b1b
mov dword [0xbad8d8], 0xd040109
mov dword [0xbad8dc], 0x2f40480c
mov dword [0xbad8e0], 0x1a381c0d
mov dword [0xbad8e4], 0x1b0d0b07
mov dword [0xbad8e8], 0x905211b
mov dword [0xbad8ec], 0x12e0d0f
mov dword [0xbad8f0], 0x9260d04
mov dword [0xbad8f4], 0x41290d05
mov word [0xbad8f8], 0x4852
mov byte [0xbad8fa], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad8c8]
xor cl, 0x68
mov byte [eax + 0xbadac8], cl
inc eax
cmp eax, 0x33
jb 0xaf6a2a
mov eax, 0xbadac8
ret

Function at 0xaf6a45
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2cbc], 1
jne 0xaf6aac
or dword [0xbb2cbc], 1
mov dword [0xbad8fc], 0x381c0d2f
mov dword [0xbad900], 0xd0b071a
mov dword [0xbad904], 0x5211b1b
mov dword [0xbad908], 0x2e0d0f09
mov dword [0xbad90c], 0x60d0401
mov dword [0xbad910], 0x480d0509
mov dword [0xbad914], 0x401090e
mov dword [0xbad918], 0x48520c0d
mov byte [0xbad91c], 0x68
xor eax, eax
mov cl, byte [eax + 0xbad8fc]
xor cl, 0x68
mov byte [eax + 0xbadafc], cl
inc eax
cmp eax, 0x21
jb 0xaf6aae
mov eax, 0xbadafc
ret
Function at 0xaf765f
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2cb8], 1
jne 0xaf7847
or dword [0xbb2cb8], 1
mov dword [0xbadb28], 0x1a470600
mov dword [0xbadb2c], 0x1c060d1d
mov dword [0xbadb30], 0xc1a531d
mov dword [0xbadb34], 0x1c0b1f1d
mov dword [0xbadb38], 0x74e410f
mov dword [0xbadb3c], 0x63404e06
mov dword [0xbadb40], 0x20a0819
mov dword [0xbadb44], 0x470c0e08
mov dword [0xbadb48], 0x11d0819
mov dword [0xbadb4c], 0x4e495449
mov dword [0xbadb50], 0xc1b634e
mov dword [0xbadb54], 0x1b001c18
mov dword [0xbadb58], 0x1a4e410c
mov dword [0xbadb5c], 0xa001b1d
mov dword [0xbadb60], 0x63404e1d
mov dword [0xbadb64], 0x80a0605
mov dword [0xbadb68], 0x451a4905
mov dword [0xbadb6c], 0x54491b49
mov dword [0xbadb70], 0xa191149
mov dword [0xbadb74], 0x41050508
mov dword [0xbadb78], 0xa071c0f
mov dword [0xbadb7c], 0x706001d
mov dword [0xbadb80], 0x1b494041
mov dword [0xbadb84], 0x1b1c1d0c
mov dword [0xbadb88], 0xc1b4907
mov dword [0xbadb8c], 0x1b001c18
mov dword [0xbadb90], 0x4c4e410c
mov dword [0xbadb94], 0x47404e24
mov dword [0xbadb98], 0x7000804
mov dword [0xbadb9c], 0x8363641
mov dword [0xbadba0], 0x401a0e1b
mov dword [0xbadba4], 0xd070c49
mov dword [0xbadba8], 0xc0d4945
mov dword [0xbadbac], 0x470e1c0b
mov dword [0xbadbb0], 0xa081b1d
mov dword [0xbadbb4], 0xa080b0c
mov dword [0xbadbb8], 0x634002
mov dword [0xbadbbc], 0x607490f
mov dword [0xbadbc0], 0x491a491d
mov dword [0xbadbc4], 0x70c011d
mov dword [0xbadbc8], 0x1b1b0c49
mov dword [0xbadbcc], 0x1b411b06
mov dword [0xbadbd0], 0x70c4940
mov dword [0xbadbd4], 0xc1b630d
mov dword [0xbadbd8], 0x71b1c1d
mov word [0xbadbdc], 0x1b49
mov byte [0xbadbde], 0x69
mov cl, byte [eax + 0xbadb28]
xor cl, 0x69
mov byte [eax + 0xbae120], cl
inc eax
cmp eax, 0xb7
jb 0xaf7847
mov eax, 0xbae120
ret
Function at 0xaf7864
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb2cb4], 1
jne 0xaf7aec
or dword [0xbb2cb4], 1
mov dword [0xbadbe0], 0x1a470600
mov dword [0xbadbe4], 0x1c060d1d
mov dword [0xbadbe8], 0xc1a531d
mov dword [0xbadbec], 0x1c0b1f1d
mov dword [0xbadbf0], 0x74e410f
mov dword [0xbadbf4], 0x63404e06
mov dword [0xbadbf8], 0x20a0819
mov dword [0xbadbfc], 0x470c0e08
mov dword [0xbadc00], 0x11d0819
mov dword [0xbadc04], 0x634e4e54
mov dword [0xbadc08], 0x1c180c1b
mov dword [0xbadc0c], 0x410c1b00
mov dword [0xbadc10], 0x1b1d1a4e
mov dword [0xbadc14], 0x4e1d0a00
mov dword [0xbadc18], 0x6056340
mov dword [0xbadc1c], 0x4905080a
mov dword [0xbadc20], 0x54490504
mov dword [0xbadc24], 0x180c1b49
mov dword [0xbadc28], 0xc1b001c
mov dword [0xbadc2c], 0x5044e41
mov dword [0xbadc30], 0x563404e
mov dword [0xbadc34], 0x5080a06
mov dword [0xbadc38], 0x1b451a49
mov dword [0xbadc3c], 0x54490c45
mov dword [0xbadc40], 0xa191149
mov dword [0xbadc44], 0x41050508
mov dword [0xbadc48], 0xa071c0f
mov dword [0xbadc4c], 0x706001d
mov dword [0xbadc50], 0x1b494041
mov dword [0xbadc54], 0x1b1c1d0c
mov dword [0xbadc58], 0xc1b4907
mov dword [0xbadc5c], 0x1b001c18
mov dword [0xbadc60], 0x4c4e410c
mov dword [0xbadc64], 0x47404e24
mov dword [0xbadc68], 0x4c412f4c
mov dword [0xbadc6c], 0xc494028
mov dword [0xbadc70], 0x49450d07
mov dword [0xbadc74], 0x1c0b0c0d
mov dword [0xbadc78], 0x1b1d470e
mov dword [0xbadc7c], 0xb0c0a08
mov dword [0xbadc80], 0x40020a08
mov dword [0xbadc84], 0x490f0063
mov dword [0xbadc88], 0x491d0607
mov dword [0xbadc8c], 0x11d491a
mov dword [0xbadc90], 0x1b49070c
mov dword [0xbadc94], 0x1b1c1d0c
mov dword [0xbadc98], 0x74907
mov dword [0xbadc9c], 0x1b494505
mov dword [0xbadca0], 0xd070c49
mov dword [0xbadca4], 0x490f0063
mov dword [0xbadca8], 0x5417491b
mov dword [0xbadcac], 0x5000749
mov dword [0xbadcb0], 0xc011d49
mov dword [0xbadcb4], 0x491b4907
mov dword [0xbadcb8], 0x5044954
mov dword [0xbadcbc], 0x1d1a1d47
mov dword [0xbadcc0], 0xe07001b
mov dword [0xbadcc4], 0x49401b41
mov dword [0xbadcc8], 0x630d070c
mov dword [0xbadccc], 0x1c1d0c1b
mov dword [0xbadcd0], 0x1b49071b
mov word [0xbadcd4], 0xc45
mov byte [0xbadcd6], 0x69
mov cl, byte [eax + 0xbadbe0]
xor cl, 0x69
mov byte [eax + 0xbae1d8], cl
inc eax
cmp eax, 0xf7
jb 0xaf7aec
mov eax, 0xbae1d8
ret
Function at 0xaf7b09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0xbb2c74], 1
jne 0xaf7b30
or dword [0xbb2c74], 1
mov dword [0xbaddcc], 0x20a0819
mov dword [0xbaddd0], 0x690c0e08
xor eax, eax
mov cl, byte [eax + 0xbaddcc]
xor cl, 0x69
mov byte [eax + 0xbae3c4], cl
inc eax
cmp eax, 8
jb 0xaf7b32
push 0xbae3c4
push dword [ebp + 8]
call fcn.00b40c05
test byte [0xbb2c70], 1
pop ecx
pop ecx
jne 0xaf7b7a
or dword [0xbb2c70], 1
mov dword [0xbaddd4], 0x50c1b19
mov dword [0xbaddd8], 0x690d0806
xor eax, eax
mov cl, byte [eax + 0xbaddd4]
xor cl, 0x69
mov byte [eax + 0xbae3cc], cl
inc eax
cmp eax, 8
jb 0xaf7b7c
push esi
push 0xbae3cc
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00b40c79
add esp, 0xc
cmp dword [0xba8be0], 0
mov esi, 0xba8be0
je 0xaf7bdc
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00b40b25
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00b40ea6
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0xaf7bb5
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.00b4037a
pop ecx
pop ecx
pop esi
pop ebp
ret