joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8e8739
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x954a60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0090c75b
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0090ab23
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.008e4e24
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.008eacc5
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x8e87c6
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0090f759
add esp, 0x10
test al, al
jne 0x8e880b
call fcn.008e8882
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.0092ba55
push 0x9744a8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00935956
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.008eacc5
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x8e884b
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x8e882a
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.008ea117
lea esi, [esp + 0x20]
call fcn.008eacac
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.008e4ce6
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8e8882
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c24], 1
jne 0x8e88cb
or dword [0x988c24], 1
mov dword [0x983f18], 0x879183a0
mov dword [0x983f1c], 0x86c2d6d4
mov dword [0x983f20], 0x868d8187
mov dword [0x983f24], 0x8384c287
mov dword [0x983f28], 0x86878e8b
mov byte [0x983f2c], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983f18]
xor cl, 0xe2
mov byte [eax + 0x984508], cl
inc eax
cmp eax, 0x15
jb 0x8e88cd
mov eax, 0x984508
ret

Function at 0x8e8fbf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c20], 1
jne 0x8e9014
or dword [0x988c20], 1
mov dword [0x983f30], 0x8e978da1
mov dword [0x983f34], 0x8d8cc286
mov dword [0x983f38], 0x928dc296
mov dword [0x983f3c], 0x81c28c87
mov dword [0x983f40], 0x8a918390
mov dword [0x983f44], 0x8f9786c2
mov word [0x983f48], 0xe292
xor eax, eax
mov cl, byte [eax + 0x983f30]
xor cl, 0xe2
mov byte [eax + 0x984520], cl
inc eax
cmp eax, 0x1a
jb 0x8e9016
mov eax, 0x984520
ret
Function at 0x8e9031
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c18], 1
jne 0x8e9054
or dword [0x988c18], 1
mov dword [0x983f50], 0x858d8ecd
mov word [0x983f54], 0xe2cd
xor eax, eax
mov cl, byte [eax + 0x983f50]
xor cl, 0xe2
mov byte [eax + 0x984540], cl
inc eax
cmp eax, 6
jb 0x8e9056
mov eax, 0x984540
ret

Function at 0x8e9071
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c14], 1
jne 0x8e90ec
or dword [0x988c14], 1
mov dword [0x983f58], 0x9296968a
mov dword [0x983f5c], 0x83cdcdd8
mov dword [0x983f60], 0x9b8e838c
mov dword [0x983f64], 0x91818b96
mov dword [0x983f68], 0x968785cc
mov dword [0x983f6c], 0x8c958d86
mov dword [0x983f70], 0x96918796
mov dword [0x983f74], 0x8f8d81cc
mov dword [0x983f78], 0xcdd094cd
mov dword [0x983f7c], 0xcd858d8e
mov byte [0x983f80], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983f58]
xor cl, 0xe2
mov byte [eax + 0x984548], cl
inc eax
cmp eax, 0x29
jb 0x8e90ee
mov eax, 0x984548
ret

Function at 0x8e9109
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c10], 1
jne 0x8e9134
or dword [0x988c10], 1
mov dword [0x983f84], 0x91c4df81
mov dword [0x983f88], 0xdf96c4df
mov byte [0x983f8c], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983f84]
xor cl, 0xe2
mov byte [eax + 0x984574], cl
inc eax
cmp eax, 9
jb 0x8e9136
mov eax, 0x984574
ret

Function at 0x8e9151
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988c00], 1
jne 0x8e91d9
or dword [0x988c00], 1
mov dword [0x983fa0], 0x968c8da1
mov dword [0x983fa4], 0xcf968c87
mov dword [0x983fa8], 0x87929bb6
mov dword [0x983fac], 0x9283c2d8
mov dword [0x983fb0], 0x818b8e92
mov dword [0x983fb4], 0x8d8b9683
mov dword [0x983fb8], 0xcf9acd8c
mov dword [0x983fbc], 0xcf959595
mov dword [0x983fc0], 0x8f908d84
mov dword [0x983fc4], 0x8e9097cf
mov dword [0x983fc8], 0x8d818c87
mov dword [0x983fcc], 0xe2868786
xor eax, eax
mov cl, byte [eax + 0x983fa0]
xor cl, 0xe2
mov byte [eax + 0x984590], cl
inc eax
cmp eax, 0x30
jb 0x8e91db
mov eax, 0x984590
ret

Function at 0x8e91f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bfc], 1
jne 0x8e9221
or dword [0x988bfc], 1
mov dword [0x983fd0], 0xb6b1adb2
mov dword [0x983fd4], 0xc28d96c2
mov byte [0x983fd8], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983fd0]
xor cl, 0xe2
mov byte [eax + 0x9845c0], cl
inc eax
cmp eax, 9
jb 0x8e9223
mov eax, 0x9845c0
ret

Function at 0x8e923e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bf8], 1
jne 0x8e9287
or dword [0x988bf8], 1
mov dword [0x983fdc], 0x8b8384c2
mov dword [0x983fe0], 0xc286878e
mov dword [0x983fe4], 0x8a968b95
mov dword [0x983fe8], 0x839691c2
mov dword [0x983fec], 0xc2919796
mov byte [0x983ff0], 0xe2
xor eax, eax
mov cl, byte [eax + 0x983fdc]
xor cl, 0xe2
mov byte [eax + 0x9845cc], cl
inc eax
cmp eax, 0x15
jb 0x8e9289
mov eax, 0x9845cc
ret
Function at 0x8e92be
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9532ca
call fcn.00951d38
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x8e946f
cmp dword [ebp + 0x10], ebx
je 0x8e946f
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.008ea60d
push eax
push 0x972c70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.008e547a
push 0x972c6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.008e54b0
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.008e4e24
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.008e4e24
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x8e93ca
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.008ea60d
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.008ea62f
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x8e937e
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.008ee0c3
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.008e4e24
inc bl
jne 0x8e9436
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.008e4e24
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x8e9345
test byte [0x988bf0], 1
jne 0x8e93f7
or dword [0x988bf0], 1
mov dword [0x984000], 0xc2968dac
mov dword [0x984004], 0x8c978d84
mov word [0x984008], 0xe286
xor eax, eax
mov cl, byte [eax + 0x984000]
xor cl, 0xe2
mov byte [eax + 0x9845f0], cl
inc eax
cmp eax, 0xa
jb 0x8e93f9
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x9845f0
call fcn.0092ba55
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x9744a8
lea eax, [ebp - 0x44]
push eax
call fcn.00935956
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.008ea62f
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.008e4e24
push 1
lea esi, [ebp - 0x2c]
call fcn.008e4e24
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.008e9494
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0092ba55
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x9744a8
lea eax, [ebp - 0x38]
jmp 0x8e9430

Function at 0x8e9494
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bf4], 1
jne 0x8e94c1
or dword [0x988bf4], 1
mov dword [0x983ff4], 0xc2968dac
mov dword [0x983ff8], 0x8c978d84
mov word [0x983ffc], 0xe286
xor eax, eax
mov cl, byte [eax + 0x983ff4]
xor cl, 0xe2
mov byte [eax + 0x9845e4], cl
inc eax
cmp eax, 0xa
jb 0x8e94c3
mov eax, 0x9845e4
ret
Function at 0x8e9c78
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bec], 1
mov ecx, 0xbce2
jne 0x8e9d02
or dword [0x988bec], 1
lea eax, [ecx - 0x61]
mov word [0x98400c], ax
add eax, 0xf
mov edx, eax
mov word [0x98400e], dx
lea edx, [ecx - 0x5f]
mov word [0x984010], dx
add edx, 0xe
mov word [0x984012], dx
lea edx, [ecx - 0x58]
mov word [0x984014], dx
add edx, 0x33
mov word [0x984016], dx
mov edx, eax
mov word [0x984018], dx
lea edx, [ecx - 0x5b]
lea eax, [ecx - 0x4c]
mov word [0x98401a], dx
mov word [0x984022], ax
add edx, 0xb
mov eax, ecx
mov word [0x98401c], dx
mov dword [0x98401e], 0xbc90bc8d
mov word [0x984024], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x98400c]
add eax, 2
mov word [eax + 0x9845fa], dx
cmp eax, 0x1a
jb 0x8e9d04
mov eax, 0x9845fc
ret

Function at 0x8e9d22
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988be8], 1
jne 0x8e9d4d
or dword [0x988be8], 1
mov dword [0x984028], 0x8c908789
mov dword [0x98402c], 0xd0d18e87
mov byte [0x984030], 0xe2
xor eax, eax
mov cl, byte [eax + 0x984028]
xor cl, 0xe2
mov byte [eax + 0x984618], cl
inc eax
cmp eax, 9
jb 0x8e9d4f
mov eax, 0x984618
ret

Function at 0x8e9d6a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988be4], 1
jne 0x8e9dd3
or dword [0x988be4], 1
mov dword [0x984034], 0xb29687b1
mov dword [0x984038], 0x87818d90
mov dword [0x98403c], 0x91b79191
mov dword [0x984040], 0x8daf9087
mov dword [0x984044], 0x9aa78786
mov dword [0x984048], 0x96928781
mov dword [0x98404c], 0xb28c8d8b
mov dword [0x984050], 0x818b8e8d
mov word [0x984054], 0xe29b
xor eax, eax
mov cl, byte [eax + 0x984034]
xor cl, 0xe2
mov byte [eax + 0x984624], cl
inc eax
cmp eax, 0x22
jb 0x8e9dd5
mov eax, 0x984624
ret

Function at 0x8e9df0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988be0], 1
jne 0x8e9e59
or dword [0x988be0], 1
mov dword [0x984058], 0xb29687a5
mov dword [0x98405c], 0x87818d90
mov dword [0x984060], 0x91b79191
mov dword [0x984064], 0x8daf9087
mov dword [0x984068], 0x9aa78786
mov dword [0x98406c], 0x96928781
mov dword [0x984070], 0xb28c8d8b
mov dword [0x984074], 0x818b8e8d
mov word [0x984078], 0xe29b
xor eax, eax
mov cl, byte [eax + 0x984058]
xor cl, 0xe2
mov byte [eax + 0x984648], cl
inc eax
cmp eax, 0x22
jb 0x8e9e5b
mov eax, 0x984648
ret

Function at 0x8e9e76
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bdc], 1
jne 0x8e9ecc
or dword [0x988bdc], 1
mov dword [0x98407c], 0xc2878ead
mov dword [0x984080], 0x968b8c8b
mov dword [0x984084], 0x8b8e838b
mov dword [0x984088], 0x8b968398
mov dword [0x98408c], 0x84c28c8d
mov dword [0x984090], 0x878e8b83
mov dword [0x984094], 0xe2c2d886
xor eax, eax
mov cl, byte [eax + 0x98407c]
xor cl, 0xe2
mov byte [eax + 0x98466c], cl
inc eax
cmp eax, 0x1c
jb 0x8e9ece
mov eax, 0x98466c
ret
Function at 0x8e9ee9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bd8], 1
mov ecx, 0xbce2
jne 0x8e9f18
or dword [0x988bd8], 1
lea eax, [ecx - 0x5f]
mov word [0x984098], ax
add eax, 0x4d
mov word [0x98409a], ax
mov eax, ecx
mov word [0x98409c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x984098]
add eax, 2
mov word [eax + 0x984686], dx
cmp eax, 6
jb 0x8e9f1a
mov eax, 0x984688
ret

Function at 0x8e9f38
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bd0], 1
jne 0x8e9fa8
or dword [0x988bd0], 1
mov dword [0x9840a8], 0x8e8b83a4
mov dword [0x9840ac], 0x96c28687
mov dword [0x9840b0], 0x8c8bc28d
mov dword [0x9840b4], 0x838b968b
mov dword [0x9840b8], 0x87988b8e
mov dword [0x9840bc], 0x948c87c2
mov dword [0x9840c0], 0x8c8d908b
mov dword [0x9840c4], 0x968c878f
mov word [0x9840c8], 0xc2d8
mov byte [0x9840ca], 0xe2
xor eax, eax
mov cl, byte [eax + 0x9840a8]
xor cl, 0xe2
mov byte [eax + 0x984698], cl
inc eax
cmp eax, 0x23
jb 0x8e9faa
mov eax, 0x984698
ret

Function at 0x8e9fc6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bc8], 1
jne 0x8ea011
or dword [0x988bc8], 1
mov dword [0x9840d4], 0x838a8cb7
mov dword [0x9840d8], 0x878e868c
mov dword [0x9840dc], 0x9a87c286
mov dword [0x9840e0], 0x96928781
mov dword [0x9840e4], 0xd88c8d8b
mov word [0x9840e8], 0xe2c2
xor eax, eax
mov cl, byte [eax + 0x9840d4]
xor cl, 0xe2
mov byte [eax + 0x9846c4], cl
inc eax
cmp eax, 0x16
jb 0x8ea013
mov eax, 0x9846c4
ret

Function at 0x8ea02e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bc4], 1
jne 0x8ea081
or dword [0x988bc4], 1
mov dword [0x9840ec], 0x838a8cb7
mov dword [0x9840f0], 0x878e868c
mov dword [0x9840f4], 0x9a87c286
mov dword [0x9840f8], 0x96928781
mov dword [0x9840fc], 0xd88c8d8b
mov dword [0x984100], 0xe891c7c2
mov byte [0x984104], 0xe2
xor eax, eax
mov cl, byte [eax + 0x9840ec]
xor cl, 0xe2
mov byte [eax + 0x9846dc], cl
inc eax
cmp eax, 0x19
jb 0x8ea083
mov eax, 0x9846dc
ret

Function at 0x8ea09e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bc0], 1
jne 0x8ea0d6
or dword [0x988bc0], 1
mov dword [0x984108], 0x809796b1
mov dword [0x98410c], 0x8b9a87c2
mov dword [0x984110], 0xc7cac296
mov dword [0x984114], 0xe2e8cb86
xor eax, eax
mov cl, byte [eax + 0x984108]
xor cl, 0xe2
mov byte [eax + 0x9846f8], cl
inc eax
cmp eax, 0x10
jb 0x8ea0d8
mov eax, 0x9846f8
ret
Function at 0x8ebae7
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x952ad9
call fcn.00951d38
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x8ebbcb
cmp byte [edi + 0x49], bl
je 0x8ebbcb
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x8ebb1e
xor al, al
jmp 0x8ebbcd
push esi
lea esi, [ebp - 0x2c]
call fcn.008eb5e0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x8ebb6e
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x8ebb73
dec eax
je 0x8ebb77
dec eax
dec eax
je 0x8ebbc7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.008e4ce6
mov al, bl
pop esi
jmp 0x8ebbcd
mov edx, dword [ebp - 0x2c]
jmp 0x8ebb38
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x8ebb83
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x8ebba9
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x8ebb96
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0092d82e
add esp, 0x10
cmp esi, eax
jne 0x8ebb5b
cmp byte [edi + 0x49], 0
je 0x8ebbc7
test esi, esi
jne 0x8ebb2a
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.008eb6b9
jmp 0x8ebb2a
mov bl, 1
jmp 0x8ebb5d
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x8f040f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bbc], 1
jne 0x8f0483
or dword [0x988bbc], 1
mov dword [0x984718], 0x8f968ca0
mov dword [0x98471c], 0x8c8dc387
mov dword [0x984720], 0x8684c397
mov dword [0x984724], 0x8a87c397
mov dword [0x984728], 0x878a9390
mov dword [0x98472c], 0xc3858cc3
mov dword [0x984730], 0x8b97868e
mov dword [0x984734], 0xc4c3878c
mov dword [0x984738], 0x8f8f8280
mov dword [0x98473c], 0xe3c3d9c4
xor eax, eax
mov cl, byte [eax + 0x984718]
xor cl, 0xe3
mov byte [eax + 0x98485c], cl
inc eax
cmp eax, 0x28
jb 0x8f0485
mov eax, 0x98485c
ret

Function at 0x8f04a0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bb8], 1
jne 0x8f0507
or dword [0x988bb8], 1
mov dword [0x984740], 0x8f8a82a5
mov dword [0x984744], 0x97c38786
mov dword [0x984748], 0x8d8ac38c
mov dword [0x98474c], 0x86888c95
mov dword [0x984750], 0x97868ec3
mov dword [0x984754], 0xc3878c8b
mov dword [0x984758], 0x8f8280c4
mov dword [0x98475c], 0xc3d9c48f
mov byte [0x984760], 0xe3
xor eax, eax
mov cl, byte [eax + 0x984740]
xor cl, 0xe3
mov byte [eax + 0x984884], cl
inc eax
cmp eax, 0x21
jb 0x8f0509
mov eax, 0x984884
ret
Function at 0x8f0524
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bb4], 1
jne 0x8f0584
or dword [0x988bb4], 1
mov dword [0x984764], 0x8c91b3e9
mov dword [0x984768], 0x8f818281
mov dword [0x98476c], 0x9687c39a
mov dword [0x984770], 0x8c97c386
mov dword [0x984774], 0x918090c3
mov dword [0x984778], 0xc397938a
mov dword [0x98477c], 0x8c919186
mov dword [0x984780], 0xe3c3d991
xor eax, eax
mov cl, byte [eax + 0x984764]
xor cl, 0xe3
mov byte [eax + 0x9848a8], cl
inc eax
cmp eax, 0x20
jb 0x8f0586
mov eax, 0x9848a8
ret

Function at 0x8f0b61
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x8f0ca6
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x988bb0], 1
jne 0x8f0bc3
or dword [0x988bb0], 1
mov eax, 0xbc90
mov word [0x984784], ax
add eax, 0xfffffff6
mov word [0x984786], ax
mov eax, 0xbc8d
mov word [0x984788], ax
add eax, 0xfffffffa
mov word [0x98478a], ax
mov eax, 0xbce3
mov word [0x98478c], ax
xor eax, eax
mov ecx, 0xbce3
xor cx, word [eax + 0x984784]
add eax, 2
mov word [eax + 0x9848c6], cx
cmp eax, 0xa
jb 0x8f0bc5
mov eax, dword [ebx + edi]
mov ecx, 0x9848c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x8f0c0c
test dx, dx
je 0x8f0c08
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x8f0c0c
add eax, esi
add ecx, esi
test dx, dx
jne 0x8f0be8
xor eax, eax
jmp 0x8f0c11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x8f0c1d
mov dword [edi], 0x385
jmp 0x8f0c95
call fcn.008f0cb6
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x8f0c49
test dx, dx
je 0x8f0c45
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x8f0c49
add ecx, esi
add eax, esi
test dx, dx
jne 0x8f0c25
xor eax, eax
jmp 0x8f0c4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x8f0c5a
mov dword [edi], 0x386
jmp 0x8f0c95
call fcn.008f0d89
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x8f0c86
test dx, dx
je 0x8f0c82
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x8f0c86
add ecx, esi
add eax, esi
test dx, dx
jne 0x8f0c62
xor eax, eax
jmp 0x8f0c8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x8f0caf
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x8f0b80
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x8f0ca8
Function at 0x8f0cb6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988bac], 1
jne 0x8f0d66
or dword [0x988bac], 1
mov eax, 0xbc82
mov word [0x984790], ax
add eax, 5
mov ecx, eax
mov word [0x984794], ax
mov eax, 0xbca6
mov word [0x984796], ax
add eax, 0xffffffef
mov word [0x984798], ax
mov eax, 0xbc86
mov word [0x984792], cx
mov ecx, eax
lea edx, [eax + 7]
mov word [0x98479a], cx
mov ecx, edx
push edi
mov word [0x98479c], cx
add ecx, 0xa
mov edi, ecx
mov word [0x98479e], di
lea edi, [eax + 0x29]
mov word [0x9847a0], di
add edi, 0xffffffdb
mov ecx, eax
add eax, 0xb
mov word [0x9847ae], ax
lea eax, [ecx + 0x5d]
mov word [0x9847a2], di
mov dword [0x9847a4], 0xbc97bc90
mov word [0x9847a8], cx
mov dword [0x9847aa], 0xbc86bc8d
mov word [0x9847b0], ax
pop edi
xor eax, eax
mov ecx, 0xbce3
xor cx, word [eax + 0x984790]
add eax, 2
mov word [eax + 0x9848d2], cx
cmp eax, 0x22
jb 0x8f0d68
mov eax, 0x9848d4
ret

Function at 0x8f0d89
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ba8], 1
mov ecx, 0xbce3
jne 0x8f0de3
or dword [0x988ba8], 1
lea eax, [ecx - 0x4e]
mov word [0x9847b4], ax
add eax, 0xfffffff1
mov word [0x9847b6], ax
lea eax, [ecx - 0x52]
mov word [0x9847b8], ax
dec eax
mov word [0x9847ba], ax
lea eax, [ecx - 0x59]
mov word [0x9847bc], ax
add eax, 2
mov word [0x9847be], ax
lea eax, [ecx - 0x56]
mov word [0x9847c0], ax
mov eax, ecx
mov word [0x9847c2], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x9847b4]
add eax, 2
mov word [eax + 0x9848f6], dx
cmp eax, 0x10
jb 0x8f0de5
mov eax, 0x9848f8
ret

Function at 0x8f17a2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ba4], 1
mov edx, 0xbce3
jne 0x8f1805
or dword [0x988ba4], 1
lea ecx, [edx - 0x5d]
mov eax, ecx
mov word [0x9847c4], ax
add eax, 0xb
push esi
mov esi, eax
lea eax, [edx - 0x34]
mov word [0x9847ce], ax
add eax, 0xffffffdb
mov word [0x9847d0], ax
mov eax, edx
mov word [0x9847c6], si
mov word [0x9847c8], si
mov dword [0x9847ca], 0xbc91bc8c
mov dword [0x9847d2], 0xbc86bc8d
mov word [0x9847d6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x9847c4]
add eax, 2
mov word [eax + 0x984906], cx
cmp eax, 0x14
jb 0x8f1807
mov eax, 0x984908
ret

Function at 0x8f1825
Capabilities:
Encode data using xor

Disassembly:
test byte [0x988ba0], 1
jne 0x8f18c1
or dword [0x988ba0], 1
mov edx, 0xbc86
mov eax, edx
mov word [0x9847d8], ax
add eax, 0xb
mov ecx, eax
mov word [0x9847da], cx
mov word [0x9847dc], cx
lea ecx, [edx + 6]
mov word [0x9847de], cx
mov ecx, eax
mov word [0x9847e0], cx
lea ecx, [edx + 0x1a]
mov word [0x9847e2], cx
add ecx, 0xffffffeb
mov word [0x9847e4], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x9847e6], di
mov edi, eax
mov word [0x9847ea], cx
mov word [0x9847f2], ax
add ecx, 0xfffffffe
lea eax, [edx + 0x5d]
mov word [0x9847e8], di
mov word [0x9847ec], cx
mov dword [0x9847ee], 0xbc86bc97
mov word [0x9847f4], ax
pop edi
xor eax, eax
mov ecx, 0xbce3
xor cx, word [eax + 0x9847d8]
add eax, 2
mov word [eax + 0x98491a], cx
cmp eax, 0x1e
jb 0x8f18c3
mov eax, 0x98491c
ret