joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002e27
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
xor ebx, ebx
cmp ebx, dword [ebp + 0xc]
jae 0x10002ee3
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 0x1c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
push eax
mov eax, dword [ebp + 8]
add eax, ebx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10002ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x10002ed8
cmp byte [edi + 0x40], 0
push 0xffffffffffffffff
je 0x10002e9d
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x10002ea6
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
jne 0x10002ec4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1c]
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10002ed8
jmp 0x10002ec9
cmp esi, 0xffffffff
jne 0x10002ed3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002ed8
mov esi, 0x3e3
add ebx, dword [ebp - 4]
test esi, esi
je 0x10002e36
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10003c2f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
mov esi, eax
mov dword [ebp - 0x258], eax
push edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10003c55
sub esi, ecx
sar esi, 1
lea edi, [esi + 0x107]
lea eax, [edi + edi]
call fcn.10004930
mov ebx, esp
test ebx, ebx
jne 0x10003c7f
xor al, al
jmp 0x10003d89
push dword [ebp - 0x258]
push edi
push ebx
call fcn.100014b4
push 0x100214c8
push edi
push ebx
call fcn.10001436
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10003d78
inc esi
lea esi, [ebx + esi*2]
lea eax, [ebp - 0x228]
push eax
push 0x106
push esi
call fcn.100014b4
test byte [ebp - 0x254], 0x10
je 0x10003d4c
mov ecx, 0x100214d0
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003d01
test dx, dx
je 0x10003cfd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003d01
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003cdb
xor eax, eax
jmp 0x10003d06
sbb eax, eax
or eax, 1
test eax, eax
je 0x10003d53
mov ecx, 0x100214d4
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003d3b
test dx, dx
je 0x10003d37
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003d3b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003d15
xor eax, eax
jmp 0x10003d40
sbb eax, eax
or eax, 1
test eax, eax
je 0x10003d53
push ebx
call fcn.10003c2f
jmp 0x10003d53
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003d6f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x10003cb5
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
lea esp, [ebp - 0x264]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004917
mov esp, ebp
pop ebp
ret 4

Function at 0x10003da2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10003dc1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10003dc1
test al, 0x10
je 0x10003dc1
mov al, 1
jmp 0x10003dc3
xor al, al
pop ebp
ret 4
Function at 0x100060a4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x100224d0
push str.FlsAlloc
push 0
call fcn.10006024
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100060d6
push dword [ebp + 8]
mov ecx, esi
call fcn.100054a3
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x10006118
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x100224f4
push str.FlsGetValue
push 2
call fcn.10006024
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x10006149
mov ecx, esi
call fcn.100054a3
call esi
jmp 0x1000614f
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x10006152
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x10022508
push str.FlsSetValue
push 3
call fcn.10006024
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x10006186
mov ecx, esi
call fcn.100054a3
call esi
jmp 0x1000618c
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x73b02370
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x5a523bf3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x87116f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x87121c
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x8711c3
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x87120b
mov esi, dword [ebp - 4]
jns 0x8711ea
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x8711fa
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x8711cc
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x8711a3
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x871235
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 8]
add ebx, ecx
add ebx, dword [ebp + 8]
cmp dword [eax + 0x10], edi
cmovb edi, dword [eax + 0x10]
sub edi, dword [ebp + 8]
cmp edi, 1
jbe 0x871284
lea eax, [ebp + 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x871024]
mov edx, edi
mov ecx, ebx
call fcn.00871048
pop ecx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ebp
ret
Function at 0x871288
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
xor edx, edx
mov ecx, edi
mov ebx, dword [edi + 0x3c]
add ebx, edi
mov dword [ebp - 4], ebx
movzx esi, word [ebx + 0x14]
add esi, 0x18
add esi, ebx
sub eax, dword [0x87101c]
mov dword [ebp - 0x10], eax
sbb edx, edx
mov dword [ebp - 0x14], esi
neg eax
mov dword [ebp - 0xc], edx
adc edx, 0
neg edx
push edx
mov edx, dword [ebx + 0xa0]
push eax
mov eax, dword [esi + 0xc]
add eax, dword [0x871028]
push eax
push dword [ebx + 0xa4]
call fcn.008710ab
push esi
push dword [0x871028]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esp, 0x18
add esi, 0x28
cmp eax, 1
jbe 0x87131b
push esi
push dword [0x87102c]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 2
jbe 0x871338
push esi
push dword [0x871030]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 3
jbe 0x871355
push esi
push dword [0x871034]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 4
jbe 0x871372
push esi
push dword [0x871038]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 5
jbe 0x87138f
push esi
push dword [0x87103c]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 6
jbe 0x8713ac
push esi
push dword [0x871040]
mov ecx, edi
call fcn.00871235
mov eax, dword [0x871020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 7
jbe 0x8713c1
push esi
push dword [0x871044]
mov ecx, edi
call fcn.00871235
pop ecx
pop ecx
cmp dword [0x871014], 0
je 0x87140a
add ebx, 0x88
cmp dword [ebx], 0
je 0x871407
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 8
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x871014]
mov dword [ebx], eax
mov eax, dword [0x871018]
mov dword [ecx + 0x8c], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push ebx
call esi
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0xc]
mov edx, dword [ebx + 0xa0]
push dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [0x871028]
push eax
push dword [ebx + 0xa4]
call fcn.008710ab
mov edx, dword [0x871004]
add esp, 0x10
push dword [0x871010]
push dword [0x87100c]
push ecx
mov ecx, edi
call fcn.0087116f
mov eax, dword [section..text]
add esp, 0xc
add eax, edi
call eax
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x87253b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9384f0], 1
mov ecx, 0xdca2
jne 0x8725c2
or dword [0x9384f0], 1
lea eax, [ecx - 0x1b]
mov edx, eax
add eax, 0x77
mov word [0x931a98], ax
mov word [0x931a8c], dx
add edx, 0x6f
lea eax, [ecx + 0x24]
mov word [0x931a9a], ax
add eax, 0x11
mov word [0x931a9c], ax
mov word [0x931a8e], dx
lea edx, [ecx + 0x45]
lea eax, [ecx + 0x2d]
mov word [0x931a9e], ax
mov word [0x931a90], dx
add edx, 8
add eax, 3
mov word [0x931aa0], ax
lea eax, [ecx + 0x5b]
mov word [0x931aa2], ax
mov eax, ecx
mov word [0x931a92], dx
mov dword [0x931a94], 0xdc87dcf2
mov word [0x931aa4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x931a8c]
add eax, 2
mov word [eax + 0x932136], dx
cmp eax, 0x1a
jb 0x8725c4
mov eax, 0x932138
ret

Function at 0x8725e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9384e8], 1
jne 0x872610
or dword [0x9384e8], 1
mov dword [0x931ab4], 0xc6cdcf9e
mov dword [0x931ab8], 0x9dc7ced7
mov dword [0x931abc], 0xa29c9d9d
xor eax, eax
mov cl, byte [eax + 0x931ab4]
xor cl, 0xa2
mov byte [eax + 0x932160], cl
inc eax
cmp eax, 0xc
jb 0x872612
mov eax, 0x932160
ret

Function at 0x87262d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9384e4], 1
mov edx, 0xdca2
jne 0x8726ed
push esi
lea ecx, [edx - 0x22]
mov eax, ecx
mov word [0x931ac0], ax
add eax, 2
or dword [0x9384e4], 1
mov word [0x931ac2], ax
lea eax, [edx - 0x13]
mov esi, eax
mov word [0x931ac4], si
mov word [0x931ac6], ax
add eax, 0x32
mov word [0x931ac8], ax
lea eax, [edx + 0x2e]
mov esi, eax
mov word [0x931aca], si
add esi, 0xfffffff3
mov word [0x931acc], si
lea esi, [edx + 0x2f]
mov word [0x931ace], si
add esi, 0xfffffff9
mov word [0x931ad0], si
lea esi, [edx + 0x5b]
mov word [0x931ad2], si
mov esi, eax
mov word [0x931ad4], si
add esi, 0xfffffff7
add eax, 6
mov word [0x931ad6], si
lea esi, [edx + 0x30]
mov word [0x931ade], ax
mov eax, edx
mov word [0x931ad8], si
mov dword [0x931ada], 0xdcd0dccd
mov dword [0x931ae0], 0xdc80dc9f
mov word [0x931ae4], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x931ac0]
add eax, 2
mov word [eax + 0x93216a], cx
cmp eax, 0x26
jb 0x8726ef
mov eax, 0x93216c
ret
Function at 0x8727d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0x9384e0], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xdca2
jne 0x87280e
or dword [0x9384e0], 1
lea eax, [ecx + 0x33]
mov word [0x931ae8], ax
add eax, 0xffffffeb
mov word [0x931aea], ax
mov eax, ecx
mov word [0x931aec], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x931ae8]
add eax, 2
mov word [eax + 0x932192], dx
cmp eax, 6
jb 0x872812
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x872835
mov eax, dword [eax]
push 0x932194
push eax
lea eax, [esp + 0x18]
push eax
call fcn.008d6887
add esp, 0xc
test eax, eax
jne 0x872900
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00873563
push dword [esp + 0x10]
call fcn.00872909
push eax
call fcn.008d6de1
push dword [esp + 0x18]
call fcn.008d736d
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.008db890
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x90608c]
test eax, eax
jne 0x8728ee
call dword [0x9060a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0089dc19
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x8728d2
mov eax, dword [eax]
push eax
call fcn.00872949
push eax
call fcn.008d70b1
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.00874c70
jmp 0x872900
push dword [esp + 0x18]
mov esi, dword [0x9060bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x872909
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9384dc], 1
jne 0x87292c
or dword [0x9384dc], 1
mov dword [0x931af0], 0xece7a8af
mov word [0x931af4], 0xa2e6
xor eax, eax
mov cl, byte [eax + 0x931af0]
xor cl, 0xa2
mov byte [eax + 0x93219c], cl
inc eax
cmp eax, 6
jb 0x87292e
mov eax, 0x93219c
ret

Function at 0x872949
Capabilities:
Encode data using xor

Disassembly:
test byte [0x9384d8], 1
jne 0x8729ce
or dword [0x9384d8], 1
mov dword [0x931af8], 0xcecbc3e4
mov dword [0x931afc], 0xd682c6c7
mov dword [0x931b00], 0xd0c182cd
mov dword [0x931b04], 0xc7d6c3c7
mov dword [0x931b08], 0xc3d0c182
mov dword [0x931b0c], 0xd082cad1
mov dword [0x931b10], 0xd0cdd2c7
mov dword [0x931b14], 0x82d0c7d6
mov dword [0x931b18], 0xc1cdd0d2
mov dword [0x931b1c], 0x98d1d1c7
mov dword [0x931b20], 0xa8d18782
mov byte [0x931b24], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931af8]
xor cl, 0xa2
mov byte [eax + 0x9321a4], cl
inc eax
cmp eax, 0x2d
jb 0x8729d0
mov eax, 0x9321a4
ret
Function at 0x873a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938478], 1
jne 0x873acd
or dword [0x938478], 1
mov dword [0x931da4], 0xd7c6cdef
mov dword [0x931da8], 0x8298c7ce
mov dword [0x931dac], 0xa8afd187
mov byte [0x931db0], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931da4]
xor cl, 0xa2
mov byte [eax + 0x932450], cl
inc eax
cmp eax, 0xd
jb 0x873acf
mov eax, 0x932450
ret

Function at 0x873aea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938474], 1
jne 0x873b29
or dword [0x938474], 1
mov dword [0x931db4], 0xc7d0caf6
mov dword [0x931db8], 0x8298c6c3
mov dword [0x931dbc], 0xda87da92
mov dword [0x931dc0], 0xa8afa8af
mov byte [0x931dc4], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931db4]
xor cl, 0xa2
mov byte [eax + 0x932460], cl
inc eax
cmp eax, 0x11
jb 0x873b2b
mov eax, 0x932460
ret

Function at 0x873b46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938470], 1
jne 0x873b84
or dword [0x938470], 1
mov dword [0x931dc8], 0xc7c1dae7
mov dword [0x931dcc], 0xcdcbd6d2
mov dword [0x931dd0], 0xc68782cc
mov word [0x931dd4], 0xa8af
mov byte [0x931dd6], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931dc8]
xor cl, 0xa2
mov byte [eax + 0x932474], cl
inc eax
cmp eax, 0xf
jb 0x873b86
mov eax, 0x932474
ret

Function at 0x873ba1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93846c], 1
jne 0x873bdf
or dword [0x93846c], 1
mov dword [0x931dd8], 0xc3c1cdee
mov dword [0x931ddc], 0xcccdcbd6
mov dword [0x931de0], 0xd2878298
mov word [0x931de4], 0xa8af
mov byte [0x931de6], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931dd8]
xor cl, 0xa2
mov byte [eax + 0x932484], cl
inc eax
cmp eax, 0xf
jb 0x873be1
mov eax, 0x932484
ret

Function at 0x873bfc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938468], 1
jne 0x873c3d
or dword [0x938468], 1
mov dword [0x931de8], 0xc7d2dbf6
mov dword [0x931dec], 0xd1878298
mov dword [0x931df0], 0xda928a82
mov dword [0x931df4], 0xaf8bda87
mov word [0x931df8], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x931de8]
xor cl, 0xa2
mov byte [eax + 0x932494], cl
inc eax
cmp eax, 0x12
jb 0x873c3f
mov eax, 0x932494
ret

Function at 0x873c5a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938464], 1
jne 0x873ce2
or dword [0x938464], 1
mov dword [0x931dfc], 0xc3d6c7e6
mov dword [0x931e00], 0x98d1cecb
mov dword [0x931e04], 0xcbd0f682
mov dword [0x931e08], 0xd682c6c7
mov dword [0x931e0c], 0xc7d082cd
mov dword [0x931e10], 0xc482c6c3
mov dword [0x931e14], 0x82cfcdd0
mov dword [0x931e18], 0xcdcfc7cf
mov dword [0x931e1c], 0xc382dbd0
mov dword [0x931e20], 0xc7d0c6c6
mov dword [0x931e24], 0x8782d1d1
mov dword [0x931e28], 0xa2a8afd2
xor eax, eax
mov cl, byte [eax + 0x931dfc]
xor cl, 0xa2
mov byte [eax + 0x9324a8], cl
inc eax
cmp eax, 0x30
jb 0x873ce4
mov eax, 0x9324a8
ret
Function at 0x873cff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938460], 1
jne 0x873d91
or dword [0x938460], 1
mov dword [0x931e2c], 0xc3d6c7e6
mov dword [0x931e30], 0x98d1cecb
mov dword [0x931e34], 0xcbd0f682
mov dword [0x931e38], 0xd682c6c7
mov dword [0x931e3c], 0xd0d582cd
mov dword [0x931e40], 0x82c7d6cb
mov dword [0x931e44], 0xcf82cdd6
mov dword [0x931e48], 0xd0cdcfc7
mov dword [0x931e4c], 0xc6c382db
mov dword [0x931e50], 0xd1c7d0c6
mov dword [0x931e54], 0xd28782d1
mov word [0x931e58], 0xa8af
mov byte [0x931e5a], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931e2c]
xor cl, 0xa2
mov byte [eax + 0x9324d8], cl
inc eax
cmp eax, 0x2f
jb 0x873d93
mov eax, 0x9324d8
ret

Function at 0x873dae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93845c], 1
jne 0x873e41
or dword [0x93845c], 1
mov dword [0x931e5c], 0xc3d6c7e6
mov dword [0x931e60], 0x98d1cecb
mov dword [0x931e64], 0xcbd0f682
mov dword [0x931e68], 0xd682c6c7
mov dword [0x931e6c], 0xdac782cd
mov dword [0x931e70], 0xd6d7c1c7
mov dword [0x931e74], 0xc7cf82c7
mov dword [0x931e78], 0xdbd0cdcf
mov dword [0x931e7c], 0x82d6c382
mov dword [0x931e80], 0xd0c6c6c3
mov dword [0x931e84], 0x82d1d1c7
mov dword [0x931e88], 0xa8afd287
mov byte [0x931e8c], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931e5c]
xor cl, 0xa2
mov byte [eax + 0x932508], cl
inc eax
cmp eax, 0x31
jb 0x873e43
mov eax, 0x932508
ret

Function at 0x873e5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938458], 1
jne 0x873e95
or dword [0x938458], 1
mov dword [0x931e90], 0xc5c3cee4
mov dword [0x931e94], 0x928298d1
mov dword [0x931e98], 0xafda87da
mov word [0x931e9c], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x931e90]
xor cl, 0xa2
mov byte [eax + 0x93253c], cl
inc eax
cmp eax, 0xe
jb 0x873e97
mov eax, 0x93253c
ret

Function at 0x873eb2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938454], 1
jne 0x873ee9
or dword [0x938454], 1
mov dword [0x931ea0], 0xc3d0c3f2
mov dword [0x931ea4], 0xc7d6c7cf
mov dword [0x931ea8], 0xaf98d1d0
mov word [0x931eac], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x931ea0]
xor cl, 0xa2
mov byte [eax + 0x93254c], cl
inc eax
cmp eax, 0xe
jb 0x873eeb
mov eax, 0x93254c
ret

Function at 0x873f06
Capabilities:
Encode data using xor

Disassembly:
test byte [0x938450], 1
jne 0x873f4f
or dword [0x938450], 1
mov dword [0x931eb0], 0xd0c3f2ab
mov dword [0x931eb4], 0xd6c7cfc3
mov dword [0x931eb8], 0x87f9d0c7
mov dword [0x931ebc], 0x8298ffc6
mov dword [0x931ec0], 0xa8afd287
mov byte [0x931ec4], 0xa2
xor eax, eax
mov cl, byte [eax + 0x931eb0]
xor cl, 0xa2
mov byte [eax + 0x93255c], cl
inc eax
cmp eax, 0x15
jb 0x873f51
mov eax, 0x93255c
ret

Function at 0x873f6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x93844c], 1
jne 0x873fa4
or dword [0x93844c], 1
mov dword [0x931ec8], 0x82eae7f1
mov dword [0x931ecc], 0xcec3cce3
mov dword [0x931ed0], 0xd1cbd1db
mov dword [0x931ed4], 0xa2a8af98
xor eax, eax
mov cl, byte [eax + 0x931ec8]
xor cl, 0xa2
mov byte [eax + 0x932574], cl
inc eax
cmp eax, 0x10
jb 0x873fa6
mov eax, 0x932574
ret