joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe14941
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.00e89b70
push ebx
push esi
push edi
call dword [0xea6094]
test byte [0xed83f0], 1
mov dword [ebp - 4], eax
jne 0xe14988
or dword [0xed83f0], 1
mov dword [0xed20fc], 0xdad1d382
mov dword [0xed2100], 0x81dbd2cb
mov dword [0xed2104], 0xbe808181
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0xed20fc]
xor cl, 0xbe
mov byte [eax + 0xed27a8], cl
inc eax
cmp eax, 0xc
jb 0xe1498c
test byte [0xed83ec], 1
mov dword [ebp - 8], 0xed27a8
jne 0xe149d6
or dword [0xed83ec], 1
mov dword [0xed2108], 0xd3c7cd82
mov dword [0xed210c], 0x81d2d1dc
mov dword [0xed2110], 0xbe808181
xor eax, eax
mov cl, byte [eax + 0xed2108]
xor cl, 0xbe
mov byte [eax + 0xed27b4], cl
inc eax
cmp eax, 0xc
jb 0xe149d8
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0xed27b4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00e7b980
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0xea63bc]
test eax, eax
je 0xe14a3d
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.00e7b980
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0xea63c4]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0xe14a89
mov ecx, dword [ebp - 0x1c]
test byte [0xed83e8], 1
jne 0xe14ac0
or dword [0xed83e8], 1
mov dword [0xed2114], 0x9b9ece9b
mov dword [0xed2118], 0xcd9b9fcd
mov dword [0xed211c], 0x9bc68e95
mov word [0xed2120], 0xbec6
xor eax, eax
mov dl, byte [eax + 0xed2114]
xor dl, 0xbe
mov byte [eax + 0xed27c0], dl
inc eax
cmp eax, 0xe
jb 0xe14ac2
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0xed27c0
push dword [ebp + 0xc]
call fcn.00e7725d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0xea63c8]
test eax, eax
je 0xe14b39
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00e14b86
push eax
push dword [ebp + 0xc]
call fcn.00e7725d
add esp, 0x14
test byte [0xed83e0], 1
jne 0xe14b59
or dword [0xed83e0], 1
mov word [0xed2134], 0xb4b3
mov byte [0xed2136], 0xbe
xor eax, eax
mov cl, byte [eax + 0xed2134]
xor cl, 0xbe
mov byte [eax + 0xed27e0], cl
inc eax
cmp eax, 3
jb 0xe14b5b
push dword [ebp + 0xc]
push 0xed27e0
call fcn.00e76ed1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xe14b86
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83e4], 1
jne 0xe14bbe
or dword [0xed83e4], 1
mov dword [0xed2124], 0xcd9b969e
mov dword [0xed2128], 0x9eda9b84
mov dword [0xed212c], 0xc68e9e95
mov dword [0xed2130], 0xbe97c69b
xor eax, eax
mov cl, byte [eax + 0xed2124]
xor cl, 0xbe
mov byte [eax + 0xed27d0], cl
inc eax
cmp eax, 0x10
jb 0xe14bc0
mov eax, 0xed27d0
ret

Function at 0xe15e34
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83d4], 1
jne 0xe15e89
or dword [0xed83d4], 1
mov dword [0xed2804], 0x85938089
mov dword [0xed2808], 0x84938096
mov dword [0xed280c], 0x9182809d
mov dword [0xed2810], 0x92859d88
mov dword [0xed2814], 0x979d9585
mov dword [0xed2818], 0x9e998e83
mov word [0xed281c], 0xc19e
xor eax, eax
mov cl, byte [eax + 0xed2804]
xor cl, 0xc1
mov byte [eax + 0xed2a04], cl
inc eax
cmp eax, 0x1a
jb 0xe15e8b
mov eax, 0xed2a04
ret

Function at 0xe15f9a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83d0], 1
jne 0xe15fc4
or dword [0xed83d0], 1
mov dword [0xed2820], 0xa0968c97
mov word [0xed2824], 0xa4b3
mov byte [0xed2826], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed2820]
xor cl, 0xc1
mov byte [eax + 0xed2a20], cl
inc eax
cmp eax, 7
jb 0xe15fc6
mov eax, 0xed2a20
ret

Function at 0xe15fe4
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83cc], 1
jne 0xe16011
or dword [0xed83cc], 1
mov dword [0xed2828], 0xb5b3a897
mov dword [0xed282c], 0x91ada0b4
mov word [0xed2830], 0xc182
xor eax, eax
mov cl, byte [eax + 0xed2828]
xor cl, 0xc1
mov byte [eax + 0xed2a28], cl
inc eax
cmp eax, 0xa
jb 0xe16013
mov eax, 0xed2a28
ret

Function at 0xe1602e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83c8], 1
jne 0xe16062
or dword [0xed83c8], 1
mov dword [0xed2834], 0xb5b3a897
mov dword [0xed2838], 0x83ada0b4
mov word [0xed283c], 0xb9ae
mov byte [0xed283e], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed2834]
xor cl, 0xc1
mov byte [eax + 0xed2a34], cl
inc eax
cmp eax, 0xb
jb 0xe16064
mov eax, 0xed2a34
ret

Function at 0xe1607f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83c4], 1
jne 0xe160a3
or dword [0xed83c4], 1
mov dword [0xed2840], 0xa4afa486
mov dword [0xed2844], 0xc1a2a8b3
xor eax, eax
mov cl, byte [eax + 0xed2840]
xor cl, 0xc1
mov byte [eax + 0xed2a40], cl
inc eax
cmp eax, 8
jb 0xe160a5
mov eax, 0xed2a40
ret
Function at 0xe160c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xe9e201
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0xed83c0], 1
push esi
jne 0xe16113
or dword [0xed83c0], 1
mov dword [0xed2848], 0xada5b5af
mov dword [0xed284c], 0xada5efad
mov word [0xed2850], 0xc1ad
xor eax, eax
mov cl, byte [eax + 0xed2848]
xor cl, 0xc1
mov byte [eax + 0xed2a48], cl
inc eax
cmp eax, 0xa
jb 0xe16115
push 0xed2a48
call dword [0xea60cc]
mov esi, eax
test esi, esi
jne 0xe16187
call dword [0xea60a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.00e162ce
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00e15c05
push 0xec2d20
mov eax, esi
push eax
call fcn.00e80985
call fcn.00e16334
push eax
push esi
call dword [0xea60c8]
test eax, eax
jne 0xe161e4
call dword [0xea60a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00e163a6
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00e15c05
push 0xec2d20
mov eax, esi
jmp 0xe16181
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0xe1626c
cmp dword [esp + 4], 0x18
jne 0xe1626c
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0xea60c4]
test eax, eax
jne 0xe162bb
call dword [0xea60a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.00e164e6
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00e15c05
push 0xec2d20
mov eax, esi
jmp 0xe16181
call dword [0xea60a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00e16459
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00e15c05
push 0xec2d20
mov eax, esi
jmp 0xe16181
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xe162ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83bc], 1
jne 0xe16317
or dword [0xed83bc], 1
mov dword [0xed2854], 0xa5a0ae8d
mov dword [0xed2858], 0xb3a3a88d
mov dword [0xed285c], 0xe1b8b3a0
mov dword [0xed2860], 0xada8a0a7
mov dword [0xed2864], 0xe1fba5a4
mov byte [0xed2868], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed2854]
xor cl, 0xc1
mov byte [eax + 0xed2a54], cl
inc eax
cmp eax, 0x15
jb 0xe16319
mov eax, 0xed2a54
ret
Function at 0xe16334
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83b8], 1
jne 0xe16389
or dword [0xed83b8], 1
mov dword [0xed286c], 0xb490b58f
mov dword [0xed2870], 0x88b8b3a4
mov dword [0xed2874], 0xb3aea7af
mov dword [0xed2878], 0xa8b5a0ac
mov dword [0xed287c], 0xb391afae
mov dword [0xed2880], 0xb2a4a2ae
mov word [0xed2884], 0xc1b2
xor eax, eax
mov cl, byte [eax + 0xed286c]
xor cl, 0xc1
mov byte [eax + 0xed2a6c], cl
inc eax
cmp eax, 0x1a
jb 0xe1638b
mov eax, 0xed2a6c
ret

Function at 0xe163a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83b4], 1
jne 0xe1643c
or dword [0xed83b4], 1
mov dword [0xed2888], 0x91b5a486
mov dword [0xed288c], 0x80a2aeb3
mov dword [0xed2890], 0xa4b3a5a5
mov dword [0xed2894], 0xa7e1b2b2
mov dword [0xed2898], 0xa4ada8a0
mov dword [0xed289c], 0x8fe9e1a5
mov dword [0xed28a0], 0xa4b490b5
mov dword [0xed28a4], 0xaf88b8b3
mov dword [0xed28a8], 0xacb3aea7
mov dword [0xed28ac], 0xaea8b5a0
mov dword [0xed28b0], 0xaeb391af
mov dword [0xed28b4], 0xb2b2a4a2
mov dword [0xed28b8], 0xc1e1fbe8
xor eax, eax
mov cl, byte [eax + 0xed2888]
xor cl, 0xc1
mov byte [eax + 0xed2a88], cl
inc eax
cmp eax, 0x34
jb 0xe1643e
mov eax, 0xed2a88
ret

Function at 0xe16459
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83b0], 1
jne 0xe164c9
or dword [0xed83b0], 1
mov dword [0xed28bc], 0xb490b58f
mov dword [0xed28c0], 0x88b8b3a4
mov dword [0xed28c4], 0xb3aea7af
mov dword [0xed28c8], 0xa8b5a0ac
mov dword [0xed28cc], 0xb391afae
mov dword [0xed28d0], 0xb2a4a2ae
mov dword [0xed28d4], 0xa0a7e1b2
mov dword [0xed28d8], 0xa5a4ada8
mov word [0xed28dc], 0xe1fb
mov byte [0xed28de], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed28bc]
xor cl, 0xc1
mov byte [eax + 0xed2abc], cl
inc eax
cmp eax, 0x23
jb 0xe164cb
mov eax, 0xed2abc
ret

Function at 0xe164e6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83ac], 1
jne 0xe1652f
or dword [0xed83ac], 1
mov dword [0xed28e0], 0xafa4b18e
mov dword [0xed28e4], 0xa2aeb391
mov dword [0xed28e8], 0xe1b2b2a4
mov dword [0xed28ec], 0xada8a0a7
mov dword [0xed28f0], 0xe1fba5a4
mov byte [0xed28f4], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed28e0]
xor cl, 0xc1
mov byte [eax + 0xed2ae0], cl
inc eax
cmp eax, 0x15
jb 0xe16531
mov eax, 0xed2ae0
ret
Function at 0xe1654c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xe9e1ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0xed83a8], 1
push esi
push edi
jne 0xe165a9
or dword [0xed83a8], 1
mov dword [0xed28f8], 0xafb3a4aa
mov dword [0xed28fc], 0xf3f2ada4
mov dword [0xed2900], 0xadada5ef
mov byte [0xed2904], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed28f8]
xor cl, 0xc1
mov byte [eax + 0xed2af8], cl
inc eax
cmp eax, 0xd
jb 0xe165ab
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0xed2af8
call edi
mov esi, eax
test esi, esi
jne 0xe1661f
call dword [0xea60a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00e16781
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00e15c05
push 0xec2d20
mov eax, esi
push eax
call fcn.00e80985
call fcn.00e167fe
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0xe166ec
call fcn.00e16871
push eax
call edi
mov edi, eax
test edi, edi
jne 0xe16690
call dword [0xea60a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.00e168bb
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00e15c05
push 0xec2d20
mov eax, esi
jmp 0xe16619
call fcn.00e16935
push eax
push edi
call esi
test eax, eax
jne 0xe166ec
call dword [0xea60a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00e169a5
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00e15c05
push 0xec2d20
mov eax, esi
jmp 0xe16619
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0xe1674e
call dword [0xea60a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00e3dcfa
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00e16a5e
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00e16b1f
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00e15c05
push 0xec2d20
mov eax, esi
jmp 0xe16619
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00e14c8d
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xe16781
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83a4], 1
jne 0xe167e1
or dword [0xed83a4], 1
mov dword [0xed2908], 0xa5a0ae8d
mov dword [0xed290c], 0xb3a3a88d
mov dword [0xed2910], 0xe1b8b3a0
mov dword [0xed2914], 0xada8a0a7
mov dword [0xed2918], 0xe9e1a5a4
mov dword [0xed291c], 0xafb3a4aa
mov dword [0xed2920], 0xf3f2ada4
mov dword [0xed2924], 0xc1e1fbe8
xor eax, eax
mov cl, byte [eax + 0xed2908]
xor cl, 0xc1
mov byte [eax + 0xed2b08], cl
inc eax
cmp eax, 0x20
jb 0xe167e3
mov eax, 0xed2b08
ret
Function at 0xe167fe
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed83a0], 1
jne 0xe16854
or dword [0xed83a0], 1
mov dword [0xed2928], 0x86f3f28a
mov dword [0xed292c], 0xb391b5a4
mov dword [0xed2930], 0xb2a4a2ae
mov dword [0xed2934], 0xa0ac88b2
mov dword [0xed2938], 0xa887a4a6
mov dword [0xed293c], 0xa08fa4ad
mov dword [0xed2940], 0xc180a4ac
xor eax, eax
mov cl, byte [eax + 0xed2928]
xor cl, 0xc1
mov byte [eax + 0xed2b28], cl
inc eax
cmp eax, 0x1c
jb 0xe16856
mov eax, 0xed2b28
ret

Function at 0xe16871
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed839c], 1
jne 0xe1689e
or dword [0xed839c], 1
mov dword [0xed2944], 0xb1a0b2b1
mov dword [0xed2948], 0xada5efa8
mov word [0xed294c], 0xc1ad
xor eax, eax
mov cl, byte [eax + 0xed2944]
xor cl, 0xc1
mov byte [eax + 0xed2b44], cl
inc eax
cmp eax, 0xa
jb 0xe168a0
mov eax, 0xed2b44
ret

Function at 0xe168bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed8398], 1
jne 0xe16918
or dword [0xed8398], 1
mov dword [0xed2950], 0xa5a0ae8d
mov dword [0xed2954], 0xb3a3a88d
mov dword [0xed2958], 0xe1b8b3a0
mov dword [0xed295c], 0xada8a0a7
mov dword [0xed2960], 0xe9e1a5a4
mov dword [0xed2964], 0xb1a0b2b1
mov dword [0xed2968], 0xe1fbe8a8
mov byte [0xed296c], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed2950]
xor cl, 0xc1
mov byte [eax + 0xed2b50], cl
inc eax
cmp eax, 0x1d
jb 0xe1691a
mov eax, 0xed2b50
ret

Function at 0xe16935
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed8394], 1
jne 0xe16988
or dword [0xed8394], 1
mov dword [0xed2970], 0x91b5a486
mov dword [0xed2974], 0xa4a2aeb3
mov dword [0xed2978], 0xac88b2b2
mov dword [0xed297c], 0x87a4a6a0
mov dword [0xed2980], 0x8fa4ada8
mov dword [0xed2984], 0x80a4aca0
mov byte [0xed2988], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed2970]
xor cl, 0xc1
mov byte [eax + 0xed2b70], cl
inc eax
cmp eax, 0x19
jb 0xe1698a
mov eax, 0xed2b70
ret

Function at 0xe169a5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed8390], 1
jne 0xe16a41
or dword [0xed8390], 1
mov dword [0xed298c], 0x91b5a486
mov dword [0xed2990], 0x80a2aeb3
mov dword [0xed2994], 0xa4b3a5a5
mov dword [0xed2998], 0xa7e1b2b2
mov dword [0xed299c], 0xa4ada8a0
mov dword [0xed29a0], 0x86e9e1a5
mov dword [0xed29a4], 0xb391b5a4
mov dword [0xed29a8], 0xb2a4a2ae
mov dword [0xed29ac], 0xa0ac88b2
mov dword [0xed29b0], 0xa887a4a6
mov dword [0xed29b4], 0xa08fa4ad
mov dword [0xed29b8], 0xe880a4ac
mov word [0xed29bc], 0xe1fb
mov byte [0xed29be], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed298c]
xor cl, 0xc1
mov byte [eax + 0xed2b8c], cl
inc eax
cmp eax, 0x33
jb 0xe16a43
mov eax, 0xed2b8c
ret

Function at 0xe16a5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed838c], 1
jne 0xe16ac5
or dword [0xed838c], 1
mov dword [0xed29c0], 0x91b5a486
mov dword [0xed29c4], 0xa4a2aeb3
mov dword [0xed29c8], 0xac88b2b2
mov dword [0xed29cc], 0x87a4a6a0
mov dword [0xed29d0], 0xafa4ada8
mov dword [0xed29d4], 0xe1a4aca0
mov dword [0xed29d8], 0xada8a0a7
mov dword [0xed29dc], 0xe1fba5a4
mov byte [0xed29e0], 0xc1
xor eax, eax
mov cl, byte [eax + 0xed29c0]
xor cl, 0xc1
mov byte [eax + 0xed2bc0], cl
inc eax
cmp eax, 0x21
jb 0xe16ac7
mov eax, 0xed2bc0
ret
Function at 0xe1769a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed8388], 1
jne 0xe17880
or dword [0xed8388], 1
mov dword [0xed2be8], 0xb1ecadab
mov dword [0xed2bec], 0xb7ada6b6
mov dword [0xed2bf0], 0xa7b1f8b6
mov dword [0xed2bf4], 0xb7a0b4b6
mov dword [0xed2bf8], 0xace5eaa4
mov dword [0xed2bfc], 0xc8ebe5ad
mov dword [0xed2c00], 0xa9a1a3b2
mov dword [0xed2c04], 0xeca7a5a3
mov dword [0xed2c08], 0xaab6a3b2
mov dword [0xed2c0c], 0xe5e2ffe2
mov dword [0xed2c10], 0xa7b0c8e5
mov dword [0xed2c14], 0xb0abb7b3
mov dword [0xed2c18], 0xb1e5eaa7
mov dword [0xed2c1c], 0xa1abb0b6
mov dword [0xed2c20], 0xc8ebe5b6
mov dword [0xed2c24], 0xa3a1adae
mov dword [0xed2c28], 0xeeb1e2ae
mov dword [0xed2c2c], 0xffe2b0e2
mov dword [0xed2c30], 0xa1b2bae2
mov dword [0xed2c34], 0xeaaeaea3
mov dword [0xed2c38], 0xa1acb7a4
mov dword [0xed2c3c], 0xacadabb6
mov dword [0xed2c40], 0xb0e2ebea
mov dword [0xed2c44], 0xb0b7b6a7
mov dword [0xed2c48], 0xa7b0e2ac
mov dword [0xed2c4c], 0xb0abb7b3
mov dword [0xed2c50], 0xe7e5eaa7
mov dword [0xed2c54], 0xecebe58f
mov dword [0xed2c58], 0xacaba3af
mov dword [0xed2c5c], 0xa39d9dea
mov dword [0xed2c60], 0xebb1a5b0
mov dword [0xed2c64], 0xa6aca7e2
mov dword [0xed2c68], 0xa7a6e2ee
mov dword [0xed2c6c], 0xeca5b7a0
mov dword [0xed2c70], 0xa1a3b0b6
mov dword [0xed2c74], 0xa1a3a0a7
mov dword [0xed2c78], 0xabc8eba9
mov dword [0xed2c7c], 0xadace2a4
mov dword [0xed2c80], 0xe2b1e2b6
mov dword [0xed2c84], 0xaca7aab6
mov dword [0xed2c88], 0xb0b0a7e2
mov dword [0xed2c8c], 0xb0eab0ad
mov dword [0xed2c90], 0xaca7e2eb
mov dword [0xed2c94], 0xa7b0c8a6
mov dword [0xed2c98], 0xacb0b7b6
mov word [0xed2c9c], 0xb0e2
mov byte [0xed2c9e], 0xc2
xor eax, eax
mov cl, byte [eax + 0xed2be8]
xor cl, 0xc2
mov byte [eax + 0xed3318], cl
inc eax
cmp eax, 0xb7
jb 0xe17882
mov eax, 0xed3318
ret
Function at 0xe1789f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed8384], 1
jne 0xe17b44
or dword [0xed8384], 1
or al, 0xff
mov dword [0xed2ca0], 0xb1ecadab
mov dword [0xed2ca4], 0xb7ada6b6
mov dword [0xed2ca8], 0xa7b1f8b6
mov dword [0xed2cac], 0xb7a0b4b6
mov dword [0xed2cb0], 0xace5eaa4
mov dword [0xed2cb4], 0xc8ebe5ad
mov dword [0xed2cb8], 0xa9a1a3b2
mov dword [0xed2cbc], 0xeca7a5a3
mov dword [0xed2cc0], 0xaab6a3b2
mov byte [0xed2cc4], al
mov dword [0xed2cc5], 0xb0c8e5e5
mov dword [0xed2cc9], 0xabb7b3a7
mov dword [0xed2ccd], 0xe5eaa7b0
mov dword [0xed2cd1], 0xabb0b6b1
mov dword [0xed2cd5], 0xebe5b6a1
mov dword [0xed2cd9], 0xa1adaec8
mov dword [0xed2cdd], 0xafe2aea3
mov word [0xed2ce1], 0xe2ae
mov byte [0xed2ce3], al
mov dword [0xed2ce4], 0xb3a7b0e2
mov dword [0xed2ce8], 0xa7b0abb7
mov dword [0xed2cec], 0xaeafe5ea
mov dword [0xed2cf0], 0xaec8ebe5
mov dword [0xed2cf4], 0xaea3a1ad
mov dword [0xed2cf8], 0xb0eeb1e2
mov word [0xed2cfc], 0xa7ee
mov byte [0xed2cfe], 0xe2
mov byte [0xed2cff], al
mov dword [0xed2d00], 0xa1b2bae2
mov dword [0xed2d04], 0xeaaeaea3
mov dword [0xed2d08], 0xa1acb7a4
mov dword [0xed2d0c], 0xacadabb6
mov dword [0xed2d10], 0xb0e2ebea
mov dword [0xed2d14], 0xb0b7b6a7
mov dword [0xed2d18], 0xa7b0e2ac
mov dword [0xed2d1c], 0xb0abb7b3
mov dword [0xed2d20], 0xe7e5eaa7
mov dword [0xed2d24], 0xecebe58f
mov dword [0xed2d28], 0xe7ea84e7
mov dword [0xed2d2c], 0xa7e2eb83
mov dword [0xed2d30], 0xe2eea6ac
mov dword [0xed2d34], 0xb7a0a7a6
mov dword [0xed2d38], 0xb0b6eca5
mov dword [0xed2d3c], 0xa0a7a1a3
mov dword [0xed2d40], 0xeba9a1a3
mov dword [0xed2d44], 0xe2a4abc8
mov dword [0xed2d48], 0xe2b6adac
mov dword [0xed2d4c], 0xaab6e2b1
mov dword [0xed2d50], 0xb0e2aca7
mov dword [0xed2d54], 0xb0b7b6a7
mov dword [0xed2d58], 0xabace2ac
mov dword [0xed2d5c], 0xb0e2eeae
mov dword [0xed2d60], 0xa6aca7e2
mov dword [0xed2d64], 0xe2a4abc8
mov word [0xed2d68], 0xe2b0
mov byte [0xed2d6a], 0xbc
mov byte [0xed2d6b], al
mov dword [0xed2d6c], 0xaeabace2
mov dword [0xed2d70], 0xa7aab6e2
mov dword [0xed2d74], 0xe2b0e2ac
mov byte [0xed2d78], al
mov dword [0xed2d79], 0xecaeafe2
mov dword [0xed2d7d], 0xb0b6b1b6
mov dword [0xed2d81], 0xeaa5acab
mov dword [0xed2d85], 0xa7e2ebb0
mov dword [0xed2d89], 0xb0c8a6ac
mov dword [0xed2d8d], 0xb0b7b6a7
mov dword [0xed2d91], 0xeeb0e2ac
mov word [0xed2d95], 0xc2a7
xor eax, eax
mov cl, byte [eax + 0xed2ca0]
xor cl, 0xc2
mov byte [eax + 0xed33d0], cl
inc eax
cmp eax, 0xf7
jb 0xe17b46
mov eax, 0xed33d0
ret
Function at 0xe17b63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0xed8344], 1
jne 0xe17b8a
or dword [0xed8344], 1
mov dword [0xed2e8c], 0xa9a1a3b2
mov dword [0xed2e90], 0xc2a7a5a3
xor eax, eax
mov cl, byte [eax + 0xed2e8c]
xor cl, 0xc2
mov byte [eax + 0xed35bc], cl
inc eax
cmp eax, 8
jb 0xe17b8c
push 0xed35bc
push dword [ebp + 8]
call fcn.00e63cc5
test byte [0xed8340], 1
pop ecx
pop ecx
jne 0xe17bd4
or dword [0xed8340], 1
mov dword [0xed2e94], 0xaea7b0b2
mov dword [0xed2e98], 0xc2a6a3ad
xor eax, eax
mov cl, byte [eax + 0xed2e94]
xor cl, 0xc2
mov byte [eax + 0xed35c4], cl
inc eax
cmp eax, 8
jb 0xe17bd6
push esi
push 0xed35c4
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00e63d39
add esp, 0xc
cmp dword [0xecdc20], 0
mov esi, 0xecdc20
je 0xe17c36
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00e63be5
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00e63f66
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0xe17c0f
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.00e6343a
pop ecx
pop ecx
pop esi
pop ebp
ret