joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb17263
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0xb172a5
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0xb9be18]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0xb9be18]
inc edx
cmp dword [ebp + 8], 0
jne 0xb17270
pop esi
not eax
pop ebp
ret

Function at 0xb18ef0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0xb18f15
cmp dword [ecx + 0x38], ebx
je 0xb18f15
cmp eax, dword [ecx + 0x10]
jae 0xb18f15
cmp dword [ecx + 0x14], 1
jne 0xb18f15
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0xb18f17
xor edi, edi
cmp edi, ebx
je 0xb18ffa
cmp esi, ebx
je 0xb18ffa
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00b18699
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0xb18fa6
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00b57030
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0xb18fcb
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00b57030
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0xb18ffc
xor eax, eax
pop edi
pop ebx
ret

Function at 0xb19a11
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb271c], 1
jne 0xb19a96
or dword [0xbb271c], 1
mov dword [0xbb1518], 0x1411193e
mov dword [0xbb151c], 0xc581c1d
mov dword [0xbb1520], 0xa1b5817
mov dword [0xbb1524], 0x1d0c191d
mov dword [0xbb1528], 0x190d1458
mov dword [0xbb152c], 0x190c0b58
mov dword [0xbb1530], 0x50581d0c
mov dword [0xbb1534], 0x130a170f
mov dword [0xbb1538], 0xc580a1d
mov dword [0xbb153c], 0x191d0a10
mov dword [0xbb1540], 0x5842511c
mov byte [0xbb1544], 0x78
xor eax, eax
mov cl, byte [eax + 0xbb1518]
xor cl, 0x78
mov byte [eax + 0xbb15e0], cl
inc eax
cmp eax, 0x2d
jb 0xb19a98
mov eax, 0xbb15e0
ret
Function at 0xb19ab3
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb270c], 1
jne 0xb19b1a
or dword [0xbb270c], 1
mov dword [0xbb1554], 0x1d581736
mov dword [0xbb1558], 0xa170a0a
mov dword [0xbb155c], 0xb1d1558
mov dword [0xbb1560], 0x1d1f190b
mov dword [0xbb1564], 0xc1d0a58
mov dword [0xbb1568], 0x1d160a0d
mov dword [0xbb156c], 0x11a581c
mov dword [0xbb1570], 0x1a171258
mov byte [0xbb1574], 0x78
xor eax, eax
mov cl, byte [eax + 0xbb1554]
xor cl, 0x78
mov byte [eax + 0xbb161c], cl
inc eax
cmp eax, 0x21
jb 0xb19b1c
mov eax, 0xbb161c
ret

Function at 0xb19b37
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2700], 1
jne 0xb19ba0
or dword [0xbb2700], 1
mov dword [0xbb15a0], 0x58190d34
mov dword [0xbb15a4], 0x170a0a1d
mov dword [0xbb15a8], 0xd0a580a
mov dword [0xbb15ac], 0x16111616
mov dword [0xbb15b0], 0xa1d581f
mov dword [0xbb15b4], 0x580a170a
mov dword [0xbb15b8], 0x1c161910
mov dword [0xbb15bc], 0x420a1d14
mov word [0xbb15c0], 0x7858
xor eax, eax
mov cl, byte [eax + 0xbb15a0]
xor cl, 0x78
mov byte [eax + 0xbb1668], cl
inc eax
cmp eax, 0x22
jb 0xb19ba2
mov eax, 0xbb1668
ret

Function at 0xb19bbd
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26fc], 1
jne 0xb19c0f
or dword [0xbb26fc], 1
mov dword [0xbb15c4], 0x34190d14
mov dword [0xbb15c8], 0x19171427
mov dword [0xbb15cc], 0xa0c0b1c
mov dword [0xbb15d0], 0x581f1611
mov dword [0xbb15d4], 0x1411191e
mov word [0xbb15d8], 0x1c1d
mov byte [0xbb15da], 0x78
xor eax, eax
mov cl, byte [eax + 0xbb15c4]
xor cl, 0x78
mov byte [eax + 0xbb168c], cl
inc eax
cmp eax, 0x17
jb 0xb19c11
mov eax, 0xbb168c
ret
Function at 0xb1a90d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb7add1
call fcn.00b79c88
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0xb8212c]
test eax, eax
jne 0xb1a955
call fcn.00b1aaae
mov ecx, dword [ebp + 8]
push eax
call fcn.00af6ac9
mov eax, dword [ebp + 8]
jmp 0xb1aa9f
test byte [0xbb26f0], 1
jne 0xb1a976
or dword [0xbb26f0], 1
mov dword [0xbb16c8], 0x59737470
mov byte [0xbb16cc], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb16c8]
xor cl, 0x79
mov byte [eax + 0xbb1e9c], cl
inc eax
cmp eax, 5
jb 0xb1a978
push 0xf
mov esi, 0xbb1e9c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0xb1a9a3
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00af4c72
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00af4ce7
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00b1fdc8
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00af4d08
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00af4d08
push dword [ebp - 0x10]
call dword [0xb820e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.00b1adf9
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.00b1ab17
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00af6b06
add esp, 0xc
push 0xb9d2a8
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.00afd6c3
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.00afb5c5
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00af4d08
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00af4d08
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00af4d08
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00af4c28
push ebx
push 1
mov ecx, esi
call fcn.00af4d08
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0xb1aaae
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26f4], 1
jne 0xb1aafa
or dword [0xbb26f4], 1
mov dword [0xbb16b0], 0x1c0b172c
mov dword [0xbb16b4], 0x171e161a
mov dword [0xbb16b8], 0x1d1c0310
mov dword [0xbb16bc], 0xb0b1c59
mov dword [0xbb16c0], 0x1a590b16
mov dword [0xbb16c4], 0x791c1d16
xor eax, eax
mov cl, byte [eax + 0xbb16b0]
xor cl, 0x79
mov byte [eax + 0xbb1e84], cl
inc eax
cmp eax, 0x18
jb 0xb1aafc
mov eax, 0xbb1e84
ret

Function at 0xb1ab17
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26ec], 1
jne 0xb1ab55
or dword [0xbb26ec], 1
mov dword [0xbb16d0], 0xb1c5159
mov dword [0xbb16d4], 0x590b160b
mov dword [0xbb16d8], 0x1c1d161a
mov word [0xbb16dc], 0x5943
mov byte [0xbb16de], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb16d0]
xor cl, 0x79
mov byte [eax + 0xbb1ea4], cl
inc eax
cmp eax, 0xf
jb 0xb1ab57
mov eax, 0xbb1ea4
ret
Function at 0xb1adf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0xbb26e8], 1
jne 0xb1ae24
or dword [0xbb26e8], 1
mov dword [0xbb16e0], 0x1d15155c
mov byte [0xbb16e4], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb16e0]
xor cl, 0x79
mov byte [eax + 0xbb1eb4], cl
inc eax
cmp eax, 5
jb 0xb1ae26
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0xbb1eb4
push eax
call fcn.00b1fe21
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00af4ce7
mov eax, esi
leave
ret

Function at 0xb1afc8
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26e4], 1
jne 0xb1b024
or dword [0xbb26e4], 1
mov dword [0xbb16e8], 0x340d1c3e
mov dword [0xbb16ec], 0x150c1d16
mov dword [0xbb16f0], 0x15103f1c
mov dword [0xbb16f4], 0x1418371c
mov dword [0xbb16f8], 0x181f591c
mov dword [0xbb16fc], 0x1d1c1510
mov word [0xbb1700], 0x5943
mov byte [0xbb1702], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb16e8]
xor cl, 0x79
mov byte [eax + 0xbb1ebc], cl
inc eax
cmp eax, 0x1b
jb 0xb1b026
mov eax, 0xbb1ebc
ret

Function at 0xb1b041
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb26e0], 1
jne 0xb1b0a0
or dword [0xbb26e0], 1
mov dword [0xbb1704], 0x3a0d1c2a
mov dword [0xbb1708], 0x1c0b0b0c
mov dword [0xbb170c], 0x103d0d17
mov dword [0xbb1710], 0xd1a1c0b
mov dword [0xbb1714], 0x59000b16
mov dword [0xbb1718], 0x1510181f
mov dword [0xbb171c], 0x59431d1c
mov byte [0xbb1720], 0x79
mov cl, byte [eax + 0xbb1704]
xor cl, 0x79
mov byte [eax + 0xbb1ed8], cl
inc eax
cmp eax, 0x1d
jb 0xb1b0a0
mov eax, 0xbb1ed8
ret

Function at 0xb1b1b2
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0xbb26dc], 1
jne 0xb1b211
or dword [0xbb26dc], 1
mov dword [0xbb1724], 0x3a0d1c3e
mov dword [0xbb1728], 0x1c0b0b0c
mov dword [0xbb172c], 0x103d0d17
mov dword [0xbb1730], 0xd1a1c0b
mov dword [0xbb1734], 0x59000b16
mov dword [0xbb1738], 0x1510181f
mov dword [0xbb173c], 0x59431d1c
mov byte [0xbb1740], 0x79
mov cl, byte [eax + 0xbb1724]
xor cl, 0x79
mov byte [eax + 0xbb1ef8], cl
inc eax
cmp eax, 0x1d
jb 0xb1b211
mov eax, 0xbb1ef8
ret
Function at 0xb1b3ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26d8], 1
jne 0xb1b539
mov eax, 0xd825
mov ecx, eax
mov word [0xbb1748], cx
mov word [0xbb174a], cx
add ecx, 5
mov word [0xbb174c], cx
lea ecx, [eax - 0x18]
mov word [0xbb174e], cx
add ecx, 0xfffffffe
lea edx, [eax - 0x15]
mov word [0xbb1750], cx
push ebx
mov ecx, edx
mov word [0xbb1752], cx
add ecx, 7
push esi
mov esi, ecx
lea ecx, [eax - 6]
mov word [0xbb1754], si
lea esi, [eax - 7]
mov word [0xbb1756], si
mov word [0xbb1764], cx
add esi, 0xfffffff8
add edx, 5
mov ecx, esi
push edi
lea edi, [eax - 9]
mov word [0xbb1766], cx
mov ecx, eax
mov word [0xbb175c], dx
mov edx, edi
mov word [0xbb1768], cx
mov word [0xbb176a], cx
add ecx, 0x24
mov word [0xbb175e], dx
mov edx, ecx
or dword [0xbb26d8], 1
mov word [0xbb176c], dx
lea edx, [eax + 0x28]
mov ebx, edx
mov word [0xbb176e], bx
mov ebx, ecx
mov word [0xbb1770], bx
lea ebx, [eax + 0x1b]
mov word [0xbb177e], ax
mov word [0xbb1772], bx
mov ebx, ecx
mov ecx, eax
add eax, 4
mov word [0xbb1780], ax
lea eax, [ecx - 8]
mov word [0xbb1786], ax
add eax, 0xffffffef
mov word [0xbb1788], ax
lea eax, [ecx - 0xb]
mov word [0xbb178a], ax
add eax, 0xfffffff3
mov word [0xbb178c], ax
lea eax, [ecx + 0x12]
mov word [0xbb178e], ax
add eax, 0xffffffe1
pop edi
mov word [0xbb1790], ax
lea eax, [ecx + 0x54]
pop esi
mov word [0xbb1774], bx
mov dword [0xbb1758], 0xd810d83f
mov dword [0xbb1760], 0xd817d830
mov word [0xbb1776], dx
mov dword [0xbb1778], 0xd849d83b
mov word [0xbb177c], cx
mov dword [0xbb1782], 0xd816d80b
mov dword [0xbb1792], 0xd81cd814
mov word [0xbb1796], ax
pop ebx
xor eax, eax
mov ecx, 0xd879
xor cx, word [eax + 0xbb1748]
add eax, 2
mov word [eax + 0xbb1f16], cx
cmp eax, 0x50
jb 0xb1b53b
mov eax, 0xbb1f18
ret

Function at 0xb1b55c
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26d4], 1
jne 0xb1b5b1
or dword [0xbb26d4], 1
mov dword [0xbb1798], 0xf591637
mov dword [0xbb179c], 0x100a0b1c
mov dword [0xbb17a0], 0x10591716
mov dword [0xbb17a4], 0x59161f17
mov dword [0xbb17a8], 0x10180f18
mov dword [0xbb17ac], 0x151b1815
mov word [0xbb17b0], 0x791c
xor eax, eax
mov cl, byte [eax + 0xbb1798]
xor cl, 0x79
mov byte [eax + 0xbb1f68], cl
inc eax
cmp eax, 0x1a
jb 0xb1b5b3
mov eax, 0xbb1f68
ret

Function at 0xb1b7a0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26d0], 1
jne 0xb1b7f5
or dword [0xbb26d0], 1
mov dword [0xbb17b4], 0xf591637
mov dword [0xbb17b8], 0x100a0b1c
mov dword [0xbb17bc], 0x10591716
mov dword [0xbb17c0], 0x59161f17
mov dword [0xbb17c4], 0x10180f18
mov dword [0xbb17c8], 0x151b1815
mov word [0xbb17cc], 0x791c
xor eax, eax
mov cl, byte [eax + 0xbb17b4]
xor cl, 0x79
mov byte [eax + 0xbb1f84], cl
inc eax
cmp eax, 0x1a
jb 0xb1b7f7
mov eax, 0xbb1f84
ret
Function at 0xb1b812
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26cc], 1
jne 0xb1b878
or dword [0xbb26cc], 1
mov dword [0xbb17d0], 0x180f1730
mov dword [0xbb17d4], 0x591d1015
mov dword [0xbb17d8], 0xa0b1c0f
mov dword [0xbb17dc], 0x59171610
mov dword [0xbb17e0], 0x161f1710
mov dword [0xbb17e4], 0x1e100a59
mov dword [0xbb17e8], 0xc0d1817
mov word [0xbb17ec], 0x1c0b
mov byte [0xbb17ee], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb17d0]
xor cl, 0x79
mov byte [eax + 0xbb1fa0], cl
inc eax
cmp eax, 0x1f
jb 0xb1b87a
mov eax, 0xbb1fa0
ret

Function at 0xb1bb7f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26c8], 1
jne 0xb1bbe5
or dword [0xbb26c8], 1
mov dword [0xbb17f0], 0x1510183f
mov dword [0xbb17f4], 0xd591d1c
mov dword [0xbb17f8], 0x1c1e5916
mov dword [0xbb17fc], 0x1c0d590d
mov dword [0xbb1800], 0x1f590914
mov dword [0xbb1804], 0x1c1d1516
mov dword [0xbb1808], 0x1809590b
mov word [0xbb180c], 0x110d
mov byte [0xbb180e], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb17f0]
xor cl, 0x79
mov byte [eax + 0xbb1fc0], cl
inc eax
cmp eax, 0x1f
jb 0xb1bbe7
mov eax, 0xbb1fc0
ret

Function at 0xb1bd57
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26c4], 1
jne 0xb1bda9
or dword [0xbb26c4], 1
mov dword [0xbb1810], 0x3f0d1c3e
mov dword [0xbb1814], 0x1c1d1516
mov dword [0xbb1818], 0xd18290b
mov dword [0xbb181c], 0x181f5911
mov dword [0xbb1820], 0x1d1c1510
mov word [0xbb1824], 0x5943
mov byte [0xbb1826], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb1810]
xor cl, 0x79
mov byte [eax + 0xbb1fe0], cl
inc eax
cmp eax, 0x17
jb 0xb1bdab
mov eax, 0xbb1fe0
ret

Function at 0xb1c073
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26c0], 1
mov edx, 0xd879
jne 0xb1c10a
or dword [0xbb26c0], 1
lea ecx, [edx - 0x1d]
mov eax, ecx
mov word [0xbb1828], ax
add eax, 0xffffffcd
mov word [0xbb182a], ax
push esi
lea eax, [edx - 0x6e]
mov esi, eax
add eax, 0xd
mov word [0xbb1834], ax
lea eax, [edx - 0x65]
mov word [0xbb1836], ax
add eax, 0x1a
mov word [0xbb1838], ax
lea eax, [edx - 0x2a]
mov word [0xbb182c], si
add esi, 0xb
mov word [0xbb183a], ax
add eax, 0xfffffffe
mov word [0xbb183c], ax
lea eax, [edx - 0x2f]
mov word [0xbb183e], ax
mov eax, edx
mov word [0xbb182e], si
mov dword [0xbb1830], 0xd80bd81e
mov dword [0xbb1840], 0xd85cd84b
mov word [0xbb1844], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0xbb1828]
add eax, 2
mov word [eax + 0xbb1ff6], cx
cmp eax, 0x1e
jb 0xb1c10c
mov eax, 0xbb1ff8
ret

Function at 0xb1c12a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26bc], 1
mov ecx, 0xd879
jne 0xb1c16b
or dword [0xbb26bc], 1
lea eax, [ecx - 0x77]
mov word [0xbb1848], ax
add eax, 7
mov word [0xbb184a], ax
lea eax, [ecx - 0x5a]
mov word [0xbb184c], ax
add eax, 0xffffffe5
mov word [0xbb184e], ax
mov eax, ecx
mov word [0xbb1850], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbb1848]
add eax, 2
mov word [eax + 0xbb2016], dx
cmp eax, 0xa
jb 0xb1c16d
mov eax, 0xbb2018
ret
Function at 0xb1c18b
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26b8], 1
mov ecx, 0xd879
jne 0xb1c1de
or dword [0xbb26b8], 1
lea eax, [ecx - 0x77]
mov word [0xbb1854], ax
add eax, 7
mov word [0xbb1856], ax
lea eax, [ecx - 0x5a]
mov word [0xbb1858], ax
add eax, 0x2b
mov word [0xbb185a], ax
lea eax, [ecx - 0x2e]
mov word [0xbb185c], ax
add eax, 0xffffffb9
mov word [0xbb185e], ax
mov eax, ecx
mov word [0xbb1860], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbb1854]
add eax, 2
mov word [eax + 0xbb2022], dx
cmp eax, 0xe
jb 0xb1c1e0
mov eax, 0xbb2024
ret

Function at 0xb1c1fe
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26b4], 1
mov ecx, 0xd879
jne 0xb1c251
or dword [0xbb26b4], 1
lea eax, [ecx - 0x77]
mov word [0xbb1864], ax
add eax, 7
mov word [0xbb1866], ax
lea eax, [ecx - 0x5a]
mov word [0xbb1868], ax
add eax, 0x30
mov word [0xbb186a], ax
lea eax, [ecx - 0x2c]
mov word [0xbb186c], ax
add eax, 0xffffffb7
mov word [0xbb186e], ax
mov eax, ecx
mov word [0xbb1870], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbb1864]
add eax, 2
mov word [eax + 0xbb2032], dx
cmp eax, 0xe
jb 0xb1c253
mov eax, 0xbb2034
ret

Function at 0xb1c271
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26b0], 1
mov ecx, 0xd879
jne 0xb1c2b2
or dword [0xbb26b0], 1
lea eax, [ecx - 0x77]
mov word [0xbb1874], ax
add eax, 7
mov word [0xbb1876], ax
lea eax, [ecx - 0x5a]
mov word [0xbb1878], ax
add eax, 0xffffffe5
mov word [0xbb187a], ax
mov eax, ecx
mov word [0xbb187c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbb1874]
add eax, 2
mov word [eax + 0xbb2042], dx
cmp eax, 0xa
jb 0xb1c2b4
mov eax, 0xbb2044
ret

Function at 0xb1c2d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26ac], 1
mov ecx, 0xd879
jne 0xb1c325
or dword [0xbb26ac], 1
lea eax, [ecx - 0x77]
mov word [0xbb1880], ax
add eax, 7
mov word [0xbb1882], ax
lea eax, [ecx - 0x5a]
mov word [0xbb1884], ax
add eax, 0x2b
mov word [0xbb1886], ax
lea eax, [ecx - 0x2e]
mov word [0xbb1888], ax
add eax, 0xffffffb9
mov word [0xbb188a], ax
mov eax, ecx
mov word [0xbb188c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbb1880]
add eax, 2
mov word [eax + 0xbb204e], dx
cmp eax, 0xe
jb 0xb1c327
mov eax, 0xbb2050
ret
Function at 0xb1c41f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26a8], 1
mov ecx, 0xd879
jne 0xb1c664
or dword [0xbb26a8], 1
lea eax, [ecx - 0x30]
mov word [0xbb1898], ax
dec eax
mov word [0xbb189a], ax
lea eax, [ecx - 0x2e]
mov word [0xbb189c], ax
dec eax
mov word [0xbb189e], ax
lea eax, [ecx - 0x2c]
mov word [0xbb18a0], ax
dec eax
mov word [0xbb18a2], ax
lea eax, [ecx - 0x2a]
mov word [0xbb18a4], ax
dec eax
mov word [0xbb18a6], ax
lea eax, [ecx - 0x38]
mov word [0xbb18a8], ax
dec eax
mov word [0xbb18aa], ax
lea eax, [ecx - 0x41]
mov word [0xbb18ac], ax
add eax, 3
mov word [0xbb18ae], ax
lea eax, [ecx - 0x3f]
mov word [0xbb18b0], ax
add eax, 3
mov word [0xbb18b2], ax
lea eax, [ecx - 0x3d]
mov word [0xbb18b4], ax
add eax, 3
mov word [0xbb18b6], ax
lea eax, [ecx - 0x3b]
mov word [0xbb18b8], ax
add eax, 0xfffffff3
mov word [0xbb18ba], ax
lea eax, [ecx - 0x49]
mov word [0xbb18bc], ax
add eax, 3
mov word [0xbb18be], ax
lea eax, [ecx - 0x47]
mov word [0xbb18c0], ax
add eax, 3
mov word [0xbb18c2], ax
lea eax, [ecx - 0x45]
mov word [0xbb18c4], ax
add eax, 3
mov word [0xbb18c6], ax
lea eax, [ecx - 0x43]
mov word [0xbb18c8], ax
add eax, 0xfffffff3
mov word [0xbb18ca], ax
lea eax, [ecx - 0x51]
mov word [0xbb18cc], ax
add eax, 3
mov word [0xbb18ce], ax
lea eax, [ecx - 0x4f]
mov word [0xbb18d0], ax
add eax, 3
mov word [0xbb18d2], ax
lea eax, [ecx - 0x4d]
mov word [0xbb18d4], ax
add eax, 3
mov word [0xbb18d6], ax
lea eax, [ecx - 0x4b]
mov word [0xbb18d8], ax
add eax, 0xfffffff3
mov word [0xbb18da], ax
lea eax, [ecx - 0x59]
mov word [0xbb18dc], ax
add eax, 3
mov word [0xbb18de], ax
lea eax, [ecx - 0x61]
mov word [0xbb18e0], ax
add eax, 3
mov word [0xbb18e2], ax
lea eax, [ecx - 0x5f]
mov word [0xbb18e4], ax
add eax, 3
mov word [0xbb18e6], ax
lea eax, [ecx - 0x5d]
mov word [0xbb18e8], ax
add eax, 3
mov word [0xbb18ea], ax
lea eax, [ecx - 0x5b]
mov word [0xbb18ec], ax
add eax, 0xfffffff3
mov word [0xbb18ee], ax
lea eax, [ecx - 0x69]
mov word [0xbb18f0], ax
add eax, 3
mov word [0xbb18f2], ax
lea eax, [ecx - 0x67]
mov word [0xbb18f4], ax
add eax, 3
mov word [0xbb18f6], ax
lea eax, [ecx - 0x65]
mov word [0xbb18f8], ax
add eax, 3
mov word [0xbb18fa], ax
lea eax, [ecx - 0x63]
mov word [0xbb18fc], ax
add eax, 0xfffffff3
mov word [0xbb18fe], ax
lea eax, [ecx - 0x71]
mov word [0xbb1900], ax
add eax, 3
mov word [0xbb1902], ax
lea eax, [ecx - 0x6f]
mov word [0xbb1904], ax
add eax, 3
mov word [0xbb1906], ax
lea eax, [ecx - 0x6d]
mov word [0xbb1908], ax
add eax, 3
mov word [0xbb190a], ax
lea eax, [ecx - 0x6b]
mov word [0xbb190c], ax
add eax, 0xfffffff3
mov word [0xbb190e], ax
lea eax, [ecx - 0x79]
mov word [0xbb1910], ax
add eax, 3
mov word [0xbb1912], ax
mov eax, ecx
mov word [0xbb1914], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0xbb1898]
add eax, 2
mov word [eax + 0xbb205e], dx
cmp eax, 0x7e
jb 0xb1c666
mov eax, 0xbb2060
ret
Function at 0xb1cd36
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26a4], 1
jne 0xb1cd9d
or dword [0xbb26a4], 1
mov dword [0xbb1918], 0x3260314
mov dword [0xbb191c], 0xb260910
mov dword [0xbb1920], 0x1c1d181c
mov dword [0xbb1924], 0x1710260b
mov dword [0xbb1928], 0x1f260d10
mov dword [0xbb192c], 0x511c1510
mov dword [0xbb1930], 0x181f5950
mov dword [0xbb1934], 0x1d1c1510
mov byte [0xbb1938], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb1918]
xor cl, 0x79
mov byte [eax + 0xbb20e0], cl
inc eax
cmp eax, 0x21
jb 0xb1cd9f
mov eax, 0xbb20e0
ret

Function at 0xb1cdba
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb26a0], 1
jne 0xb1ce21
or dword [0xbb26a0], 1
mov dword [0xbb193c], 0x3260314
mov dword [0xbb1940], 0xb260910
mov dword [0xbb1944], 0x1c1d181c
mov dword [0xbb1948], 0x101f260b
mov dword [0xbb194c], 0xa261c15
mov dword [0xbb1950], 0x510d180d
mov dword [0xbb1954], 0x181f5950
mov dword [0xbb1958], 0x1d1c1510
mov byte [0xbb195c], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb193c]
xor cl, 0x79
mov byte [eax + 0xbb2104], cl
inc eax
cmp eax, 0x21
jb 0xb1ce23
mov eax, 0xbb2104
ret

Function at 0xb1ce3e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb269c], 1
jne 0xb1cebc
or dword [0xbb269c], 1
mov dword [0xbb1960], 0x3260314
mov dword [0xbb1964], 0xb260910
mov dword [0xbb1968], 0x1c1d181c
mov dword [0xbb196c], 0x11c260b
mov dword [0xbb1970], 0x1a180b0d
mov dword [0xbb1974], 0x101f260d
mov dword [0xbb1978], 0xd261c15
mov dword [0xbb197c], 0x1c112616
mov dword [0xbb1980], 0x50510918
mov dword [0xbb1984], 0x10181f59
mov dword [0xbb1988], 0x791d1c15
xor eax, eax
mov cl, byte [eax + 0xbb1960]
xor cl, 0x79
mov byte [eax + 0xbb2128], cl
inc eax
cmp eax, 0x2c
jb 0xb1cebe
mov eax, 0xbb2128
ret

Function at 0xb1ced9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2698], 1
jne 0xb1cf43
or dword [0xbb2698], 1
mov dword [0xbb198c], 0x1510183f
mov dword [0xbb1990], 0xd591d1c
mov dword [0xbb1994], 0xb1a5916
mov dword [0xbb1998], 0x1c0d181c
mov dword [0xbb199c], 0xa1c1d59
mov dword [0xbb19a0], 0x1817100d
mov dword [0xbb19a4], 0x1716100d
mov dword [0xbb19a8], 0xd180959
mov dword [0xbb19ac], 0x79594311
xor eax, eax
mov cl, byte [eax + 0xbb198c]
xor cl, 0x79
mov byte [eax + 0xbb2154], cl
inc eax
cmp eax, 0x24
jb 0xb1cf45
mov eax, 0xbb2154
ret

Function at 0xb1cf60
Capabilities:
Encode data using xor

Disassembly:
test byte [0xbb2694], 1
jne 0xb1cfc6
or dword [0xbb2694], 1
mov dword [0xbb19b0], 0x1510183f
mov dword [0xbb19b4], 0xd591d1c
mov dword [0xbb19b8], 0xb1a5916
mov dword [0xbb19bc], 0x1c0d181c
mov dword [0xbb19c0], 0xd0c1659
mov dword [0xbb19c4], 0x590d0c09
mov dword [0xbb19c8], 0x1c15101f
mov word [0xbb19cc], 0x5943
mov byte [0xbb19ce], 0x79
xor eax, eax
mov cl, byte [eax + 0xbb19b0]
xor cl, 0x79
mov byte [eax + 0xbb2178], cl
inc eax
cmp eax, 0x1f
jb 0xb1cfc8
mov eax, 0xbb2178
ret