joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412299
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4920], 1
jne 0x4122d0
or dword [0x4a4920], 1
mov dword [0x4a0ae8], 0x5c555e4f
mov dword [0x4a0aec], 0x4a0c4358
mov dword [0x4a0af0], 0x4940454d
mov word [0x4a0af4], 0x2c48
xor eax, eax
mov cl, byte [eax + 0x4a0ae8]
xor cl, 0x2c
mov byte [eax + 0x4a0bfc], cl
inc eax
cmp eax, 0xe
jb 0x4122d2
mov eax, 0x4a0bfc
ret

Function at 0x4122ed
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a491c], 1
jne 0x412324
or dword [0x4a491c], 1
mov dword [0x4a0af8], 0x5c555e4f
mov dword [0x4a0afc], 0x4a0c4358
mov dword [0x4a0b00], 0x4940454d
mov word [0x4a0b04], 0x2c48
xor eax, eax
mov cl, byte [eax + 0x4a0af8]
xor cl, 0x2c
mov byte [eax + 0x4a0c0c], cl
inc eax
cmp eax, 0xe
jb 0x412326
mov eax, 0x4a0c0c
ret

Function at 0x4123f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4918], 1
jne 0x412429
or dword [0x4a4918], 1
mov dword [0x4a0b08], 0x5c555e4f
mov dword [0x4a0b0c], 0x4a0c4358
mov dword [0x4a0b10], 0x4940454d
mov word [0x4a0b14], 0x2c48
xor eax, eax
mov cl, byte [eax + 0x4a0b08]
xor cl, 0x2c
mov byte [eax + 0x4a0c1c], cl
inc eax
cmp eax, 0xe
jb 0x41242b
mov eax, 0x4a0c1c
ret

Function at 0x4125d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4914], 1
jne 0x41260a
or dword [0x4a4914], 1
mov dword [0x4a0b18], 0x5c555e4f
mov dword [0x4a0b1c], 0x4a0c4358
mov dword [0x4a0b20], 0x4940454d
mov word [0x4a0b24], 0x2c48
xor eax, eax
mov cl, byte [eax + 0x4a0b18]
xor cl, 0x2c
mov byte [eax + 0x4a0c2c], cl
inc eax
cmp eax, 0xe
jb 0x41260c
mov eax, 0x4a0c2c
ret

Function at 0x412627
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4910], 1
jne 0x41265e
or dword [0x4a4910], 1
mov dword [0x4a0b28], 0x5c555e4f
mov dword [0x4a0b2c], 0x4a0c4358
mov dword [0x4a0b30], 0x4940454d
mov word [0x4a0b34], 0x2c48
xor eax, eax
mov cl, byte [eax + 0x4a0b28]
xor cl, 0x2c
mov byte [eax + 0x4a0c3c], cl
inc eax
cmp eax, 0xe
jb 0x412660
mov eax, 0x4a0c3c
ret
Function at 0x41267b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x47026d
call fcn.0046f99c
sub esp, 0x10
push ebx
push esi
mov esi, 0x110
push esi
call fcn.0044a1a0
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4126ac
push esi
push 0
push ebx
call fcn.0044cca0
add esp, 0xc
mov esi, ebx
jmp 0x4126ae
xor esi, esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov dword [esi + 0x100], eax
mov eax, dword [edi + 8]
sub eax, 0x14
test byte [0x4a4908], 1
mov dword [esi + 0x104], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x108], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x10c], eax
jne 0x4126fd
or dword [0x4a4908], 1
mov dword [0x4a0b4c], 0x4e43404e
mov byte [0x4a0b50], 0x2c
xor eax, eax
mov cl, byte [eax + 0x4a0b4c]
xor cl, 0x2c
mov byte [eax + 0x4a0c4c], cl
inc eax
cmp eax, 5
jb 0x4126ff
push 0
push 0x4a0c4c
push esi
push 0x412341
push dword [edi]
call fcn.00436fe7
add esp, 0x14
test eax, eax
je 0x412767
push 0
call fcn.00412857
push eax
push 0xffffffffffffffff
push dword [edi]
call fcn.00435c8f
mov dword [ebp + 8], eax
add esp, 0x10
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00449745
push 0x4914a0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
call fcn.004535e6
push esi
call fcn.0044a063
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41277e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test byte [0x4a4900], 1
jne 0x4127bb
or dword [0x4a4900], 1
mov dword [0x4a0b64], 0x5c555e4f
mov dword [0x4a0b68], 0x4a0c4358
mov dword [0x4a0b6c], 0x4940454d
mov word [0x4a0b70], 0x2c48
xor eax, eax
mov cl, byte [eax + 0x4a0b64]
xor cl, 0x2c
mov byte [eax + 0x4a0c64], cl
inc eax
cmp eax, 0xe
jb 0x4127bd
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0x4a0c64
call fcn.00449745
push 0x4914a0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], vtable.std::runtime_error.0
call fcn.004535e6
int3

Function at 0x4127fb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a490c], 1
jne 0x41283a
or dword [0x4a490c], 1
mov dword [0x4a0b38], 0x734d5940
mov dword [0x4a0b3c], 0x404d4f5c
mov dword [0x4a0b40], 0x4d4a0c40
mov dword [0x4a0b44], 0x48494045
mov byte [0x4a0b48], 0x2c
xor eax, eax
mov cl, byte [eax + 0x4a0b38]
xor cl, 0x2c
mov byte [eax + 0x4a0c74], cl
inc eax
cmp eax, 0x11
jb 0x41283c
mov eax, 0x4a0c74
ret

Function at 0x412857
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4904], 1
jne 0x41288f
or dword [0x4a4904], 1
mov dword [0x4a0b54], 0x734d5940
mov dword [0x4a0b58], 0x484d4340
mov dword [0x4a0b5c], 0x454d4a0c
mov dword [0x4a0b60], 0x2c484940
xor eax, eax
mov cl, byte [eax + 0x4a0b54]
xor cl, 0x2c
mov byte [eax + 0x4a0c54], cl
inc eax
cmp eax, 0x10
jb 0x412891
mov eax, 0x4a0c54
ret
Function at 0x415b4d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4858], 1
jne 0x415bf7
or dword [0x4a4858], 1
mov dword [0x4a10d4], 0x5d4c416a
mov dword [0x4a10d8], 0x465b5f56
mov dword [0x4a10dc], 0x5d0f4140
mov dword [0x4a10e0], 0x4a5a5e4a
mov dword [0x4a10e4], 0x4b4a5b5c
mov dword [0x4a10e8], 0x5b5a4d0f
mov dword [0x4a10ec], 0x46475b0f
mov dword [0x4a10f0], 0x475b0f5c
mov dword [0x4a10f4], 0x4b4e4a5d
mov dword [0x4a10f8], 0x5c4e470f
mov dword [0x4a10fc], 0xf40410f
mov dword [0x4a1100], 0x5f565d4c
mov dword [0x4a1104], 0x460f405b
mov dword [0x4a1108], 0x4e5b5c41
mov dword [0x4a110c], 0x2f4a4c41
xor eax, eax
mov cl, byte [eax + 0x4a10d4]
xor cl, 0x2f
mov byte [eax + 0x4a11f8], cl
inc eax
cmp eax, 0x3c
jb 0x415bf9
mov eax, 0x4a11f8
ret

Function at 0x415c14
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4854], 1
jne 0x415c6a
or dword [0x4a4854], 1
mov dword [0x4a1110], 0x43464e69
mov dword [0x4a1114], 0x5b0f4b4a
mov dword [0x4a1118], 0x414a0f40
mov dword [0x4a111c], 0x5f565d4c
mov dword [0x4a1120], 0x405f0f5b
mov dword [0x4a1124], 0x4d0f5b5c
mov dword [0x4a1128], 0x2f564b40
xor eax, eax
mov cl, byte [eax + 0x4a1110]
xor cl, 0x2f
mov byte [eax + 0x4a1234], cl
inc eax
cmp eax, 0x1c
jb 0x415c6c
mov eax, 0x4a1234
ret

Function at 0x415c87
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4850], 1
jne 0x415cf0
or dword [0x4a4850], 1
mov dword [0x4a112c], 0x43464e69
mov dword [0x4a1130], 0x5b0f4b4a
mov dword [0x4a1134], 0x4a4b0f40
mov dword [0x4a1138], 0x5f565d4c
mov dword [0x4a113c], 0x4a5c0f5b
mov dword [0x4a1140], 0x5d4a595d
mov dword [0x4a1144], 0x5c4a5d0f
mov dword [0x4a1148], 0x5c41405f
mov word [0x4a114c], 0x2f4a
xor eax, eax
mov cl, byte [eax + 0x4a112c]
xor cl, 0x2f
mov byte [eax + 0x4a1250], cl
inc eax
cmp eax, 0x22
jb 0x415cf2
mov eax, 0x4a1250
ret

Function at 0x416066
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a484c], 1
jne 0x4160c5
or dword [0x4a484c], 1
mov dword [0x4a1150], 0x6b637d7a
mov dword [0x4a1154], 0x43415840
mov dword [0x4a1158], 0x7b4b4e40
mov dword [0x4a115c], 0x43466940
mov dword [0x4a1160], 0x4e490f4a
mov dword [0x4a1164], 0x4b4a4346
mov dword [0x4a1168], 0x5d470f15
mov word [0x4a116c], 0x2f12
xor eax, eax
mov cl, byte [eax + 0x4a1150]
xor cl, 0x2f
mov byte [eax + 0x4a1274], cl
inc eax
cmp eax, 0x1e
jb 0x4160c7
mov eax, 0x4a1274
ret

Function at 0x416d60
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4834], 1
jne 0x416dac
or dword [0x4a4834], 1
mov dword [0x4a12f0], 0x7c445577
mov dword [0x4a12f4], 0x79444351
mov dword [0x4a12f8], 0x4445405e
mov dword [0x4a12fc], 0x5f565e79
mov dword [0x4a1300], 0x59515610
mov dword [0x4a1304], 0x3054555c
xor eax, eax
mov cl, byte [eax + 0x4a12f0]
xor cl, 0x30
mov byte [eax + 0x4a137c], cl
inc eax
cmp eax, 0x18
jb 0x416dae
mov eax, 0x4a137c
ret
Function at 0x417306
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a481c], 1
jne 0x41736c
or dword [0x4a481c], 1
mov dword [0x4a1408], 0x535c4862
mov dword [0x4a140c], 0x52115d5e
mov dword [0x4a1410], 0x555d445e
mov dword [0x4a1414], 0x455e5f11
mov dword [0x4a1418], 0x11545311
mov dword [0x4a141c], 0x5e425443
mov dword [0x4a1420], 0x5554475d
mov word [0x4a1424], 0x110b
mov byte [0x4a1426], 0x31
xor eax, eax
mov cl, byte [eax + 0x4a1408]
xor cl, 0x31
mov byte [eax + 0x4a1448], cl
inc eax
cmp eax, 0x1f
jb 0x41736e
mov eax, 0x4a1448
ret

Function at 0x4180ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4800], 1
jne 0x418133
or dword [0x4a4800], 1
mov dword [0x4a14f8], 0x50475f78
mov dword [0x4a14fc], 0x1155585d
mov dword [0x4a1500], 0x50455055
mov dword [0x4a1504], 0x4b584211
mov dword [0x4a1508], 0x5e571154
mov dword [0x4a150c], 0x58461143
mov dword [0x4a1510], 0x63115455
mov dword [0x4a1514], 0x626e7674
mov word [0x4a1518], 0x316b
xor eax, eax
mov cl, byte [eax + 0x4a14f8]
xor cl, 0x31
mov byte [eax + 0x4a16a4], cl
inc eax
cmp eax, 0x22
jb 0x418135
mov eax, 0x4a16a4
ret

Function at 0x418150
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a47fc], 1
jne 0x4181b0
or dword [0x4a47fc], 1
mov dword [0x4a151c], 0x50475f78
mov dword [0x4a1520], 0x1155585d
mov dword [0x4a1524], 0x50455055
mov dword [0x4a1528], 0x4b584211
mov dword [0x4a152c], 0x5e571154
mov dword [0x4a1530], 0x74631143
mov dword [0x4a1534], 0x66756e76
mov dword [0x4a1538], 0x3175637e
xor eax, eax
mov cl, byte [eax + 0x4a151c]
xor cl, 0x31
mov byte [eax + 0x4a16c8], cl
inc eax
cmp eax, 0x20
jb 0x4181b2
mov eax, 0x4a16c8
ret

Function at 0x418ec8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a47a0], 1
jne 0x418eec
or dword [0x4a47a0], 1
mov dword [0x4a182c], 0x4141575f
mov dword [0x4a1830], 0x32575553
xor eax, eax
mov cl, byte [eax + 0x4a182c]
xor cl, 0x32
mov byte [eax + 0x4a1b1c], cl
inc eax
cmp eax, 8
jb 0x418eee
mov eax, 0x4a1b1c
ret

Function at 0x419a51
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4798], 1
mov ecx, 0x8332
jne 0x419a92
or dword [0x4a4798], 1
lea eax, [ecx - 0x16]
mov word [0x4a183c], ax
add eax, 0x42
mov word [0x4a183e], ax
lea eax, [ecx + 0x2a]
mov word [0x4a1840], ax
add eax, 0xfffffffd
mov word [0x4a1842], ax
mov eax, ecx
mov word [0x4a1844], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a183c]
add eax, 2
mov word [eax + 0x4a1b2a], dx
cmp eax, 0xa
jb 0x419a94
mov eax, 0x4a1b2c
ret

Function at 0x419ab2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4794], 1
mov ecx, 0x8332
jne 0x419af3
or dword [0x4a4794], 1
lea eax, [ecx - 0x16]
mov word [0x4a1848], ax
add eax, 0x42
mov word [0x4a184a], ax
lea eax, [ecx + 0x2a]
mov word [0x4a184c], ax
add eax, 0xfffffffd
mov word [0x4a184e], ax
mov eax, ecx
mov word [0x4a1850], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a1848]
add eax, 2
mov word [eax + 0x4a1b36], dx
cmp eax, 0xa
jb 0x419af5
mov eax, 0x4a1b38
ret
Function at 0x41a083
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4790], 1
jne 0x41a0d6
or dword [0x4a4790], 1
mov dword [0x4a1854], 0x7e465775
mov dword [0x4a1858], 0x5e53515d
mov dword [0x4a185c], 0x545c7b57
mov dword [0x4a1860], 0x121b1a5d
mov dword [0x4a1864], 0x5e5b5354
mov dword [0x4a1868], 0x12085657
mov byte [0x4a186c], 0x32
xor eax, eax
mov cl, byte [eax + 0x4a1854]
xor cl, 0x32
mov byte [eax + 0x4a1b44], cl
inc eax
cmp eax, 0x19
jb 0x41a0d8
mov eax, 0x4a1b44
ret

Function at 0x41a2a4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a478c], 1
jne 0x41a341
or dword [0x4a478c], 1
mov dword [0x4a1870], 0x40717e7b
mov dword [0x4a1874], 0x57465357
mov dword [0x4a1878], 0x5f5d4074
mov dword [0x4a187c], 0x5a465362
mov dword [0x4a1880], 0x5b535412
mov dword [0x4a1884], 0x856575e
mov dword [0x4a1888], 0x46574012
mov dword [0x4a188c], 0x575c4047
mov dword [0x4a1890], 0x5c531256
mov dword [0x4a1894], 0x425f5712
mov dword [0x4a1898], 0x5b124b46
mov dword [0x4a189c], 0x125f5746
mov dword [0x4a18a0], 0x46415b5e
mov byte [0x4a18a4], 0x32
xor eax, eax
mov cl, byte [eax + 0x4a1870]
xor cl, 0x32
mov byte [eax + 0x4a1b60], cl
inc eax
cmp eax, 0x35
jb 0x41a343
mov eax, 0x4a1b60
ret

Function at 0x41a35e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4788], 1
jne 0x41a3c8
or dword [0x4a4788], 1
mov dword [0x4a18a8], 0x427d7a61
mov dword [0x4a18ac], 0x5d745c57
mov dword [0x4a18b0], 0x4057565e
mov dword [0x4a18b4], 0x61565c73
mov dword [0x4a18b8], 0x51575e57
mov dword [0x4a18bc], 0x57467b46
mov dword [0x4a18c0], 0x5412415f
mov dword [0x4a18c4], 0x575e5b53
mov dword [0x4a18c8], 0x32120856
xor eax, eax
mov cl, byte [eax + 0x4a18a8]
xor cl, 0x32
mov byte [eax + 0x4a1b98], cl
inc eax
cmp eax, 0x24
jb 0x41a3ca
mov eax, 0x4a1b98
ret

Function at 0x41a69d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a477c], 1
jne 0x41a6fc
or dword [0x4a477c], 1
mov dword [0x4a18dc], 0x62465775
mov dword [0x4a18e0], 0x53714045
mov dword [0x4a18e4], 0x5b505342
mov dword [0x4a18e8], 0x5b465b5e
mov dword [0x4a18ec], 0x1b1a4157
mov dword [0x4a18f0], 0x5b535412
mov dword [0x4a18f4], 0x856575e
mov word [0x4a18f8], 0x3212
xor eax, eax
mov cl, byte [eax + 0x4a18dc]
xor cl, 0x32
mov byte [eax + 0x4a1bcc], cl
inc eax
cmp eax, 0x1e
jb 0x41a6fe
mov eax, 0x4a1bcc
ret

Function at 0x41b228
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a470c], 1
mov ecx, 0x8333
jne 0x41b29d
or dword [0x4a470c], 1
lea eax, [ecx + 0x2c]
mov word [0x4a1dc0], ax
add eax, 0xffffffe7
mov word [0x4a1dc2], ax
lea eax, [ecx + 0x1f]
mov word [0x4a1dc4], ax
add eax, 0x1a
mov word [0x4a1dc6], ax
lea eax, [ecx + 0x11]
mov edx, eax
mov word [0x4a1dc8], dx
add edx, 0x16
mov word [0x4a1dca], dx
lea edx, [ecx + 0x2a]
mov word [0x4a1dcc], dx
add edx, 0xfffffffa
mov eax, ecx
mov word [0x4a1dce], dx
mov dword [0x4a1dd0], 0x8344835c
mov word [0x4a1dd4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a1dc0]
add eax, 2
mov word [eax + 0x4a2022], dx
cmp eax, 0x16
jb 0x41b29f
mov eax, 0x4a2024
ret
Function at 0x41b2bd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4708], 1
mov edx, 0x8333
jne 0x41b361
or dword [0x4a4708], 1
lea ecx, [edx + 0x2c]
mov eax, ecx
mov word [0x4a1dd8], ax
add eax, 0xffffffe7
mov word [0x4a1dda], ax
lea eax, [edx + 0x1f]
mov word [0x4a1ddc], ax
add eax, 0x1a
push esi
mov esi, eax
mov word [0x4a1de8], ax
lea eax, [edx + 0x11]
mov ecx, eax
mov word [0x4a1dea], cx
add ecx, 0x16
mov word [0x4a1dde], si
lea esi, [edx + 0x28]
mov word [0x4a1dec], cx
lea ecx, [edx + 0x2a]
mov word [0x4a1de0], si
add esi, 0xffffffec
mov word [0x4a1dee], cx
add ecx, 0xfffffffa
mov eax, edx
mov word [0x4a1de2], si
mov dword [0x4a1de4], 0x835f835e
mov word [0x4a1df0], cx
mov dword [0x4a1df2], 0x8344835c
mov word [0x4a1df6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4a1dd8]
add eax, 2
mov word [eax + 0x4a203a], cx
cmp eax, 0x20
jb 0x41b363
mov eax, 0x4a203c
ret

Function at 0x41b5a5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4704], 1
jne 0x41b5ee
or dword [0x4a4704], 1
mov dword [0x4a1df8], 0x1352467f
mov dword [0x4a1dfc], 0x5c414156
mov dword [0x4a1e00], 0x5d5a1341
mov dword [0x4a1e04], 0x575d4413
mov dword [0x4a1e08], 0x505c4143
mov byte [0x4a1e0c], 0x33
xor eax, eax
mov cl, byte [eax + 0x4a1df8]
xor cl, 0x33
mov byte [eax + 0x4a205c], cl
inc eax
cmp eax, 0x15
jb 0x41b5f0
mov eax, 0x4a205c
ret

Function at 0x41d6e4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a467c], 1
jne 0x41d725
or dword [0x4a467c], 1
mov dword [0x4a2288], 0x43145b7a
mov dword [0x4a228c], 0x5b505a5d
mov dword [0x4a2290], 0x5b571443
mov dword [0x4a2294], 0x4c51405a
mov word [0x4a2298], 0x3440
xor eax, eax
mov cl, byte [eax + 0x4a2288]
xor cl, 0x34
mov byte [eax + 0x4a2514], cl
inc eax
cmp eax, 0x12
jb 0x41d727
mov eax, 0x4a2514
ret

Function at 0x41d742
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4678], 1
jne 0x41d783
or dword [0x4a4678], 1
mov dword [0x4a229c], 0x43145b7a
mov dword [0x4a22a0], 0x5b505a5d
mov dword [0x4a22a4], 0x5b571443
mov dword [0x4a22a8], 0x4c51405a
mov word [0x4a22ac], 0x3440
xor eax, eax
mov cl, byte [eax + 0x4a229c]
xor cl, 0x34
mov byte [eax + 0x4a2528], cl
inc eax
cmp eax, 0x12
jb 0x41d785
mov eax, 0x4a2528
ret

Function at 0x41d7a0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4674], 1
jne 0x41d7e8
or dword [0x4a4674], 1
mov dword [0x4a22b0], 0x56145b7a
mov dword [0x4a22b4], 0x47435b46
mov dword [0x4a22b8], 0x57144651
mov dword [0x4a22bc], 0x51405a5b
mov word [0x4a22c0], 0x404c
mov byte [0x4a22c2], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a22b0]
xor cl, 0x34
mov byte [eax + 0x4a253c], cl
inc eax
cmp eax, 0x13
jb 0x41d7ea
mov eax, 0x4a253c
ret

Function at 0x41d85e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4670], 1
jne 0x41d89f
or dword [0x4a4670], 1
mov dword [0x4a22c4], 0x51145b7a
mov dword [0x4a22c8], 0x51595158
mov dword [0x4a22cc], 0x5c14405a
mov dword [0x4a22d0], 0x58505a55
mov word [0x4a22d4], 0x3451
xor eax, eax
mov cl, byte [eax + 0x4a22c4]
xor cl, 0x34
mov byte [eax + 0x4a2550], cl
inc eax
cmp eax, 0x12
jb 0x41d8a1
mov eax, 0x4a2550
ret
Function at 0x41d8bc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a466c], 1
jne 0x41d8fd
or dword [0x4a466c], 1
mov dword [0x4a22d8], 0x51145b7a
mov dword [0x4a22dc], 0x51595158
mov dword [0x4a22e0], 0x5c14405a
mov dword [0x4a22e4], 0x58505a55
mov word [0x4a22e8], 0x3451
xor eax, eax
mov cl, byte [eax + 0x4a22d8]
xor cl, 0x34
mov byte [eax + 0x4a2564], cl
inc eax
cmp eax, 0x12
jb 0x41d8ff
mov eax, 0x4a2564
ret

Function at 0x41e8cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a464c], 1
jne 0x41e918
or dword [0x4a464c], 1
mov dword [0x4a2380], 0x6b405153
mov dword [0x4a2384], 0x47555857
mov dword [0x4a2388], 0x59557a47
mov dword [0x4a238c], 0x55521451
mov dword [0x4a2390], 0x5051585d
mov byte [0x4a2394], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a2380]
xor cl, 0x34
mov byte [eax + 0x4a260c], cl
inc eax
cmp eax, 0x15
jb 0x41e91a
mov eax, 0x4a260c
ret

Function at 0x41e935
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4648], 1
jne 0x41e977
or dword [0x4a4648], 1
mov dword [0x4a2398], 0x75405153
mov dword [0x4a239c], 0x5d464040
mov dword [0x4a23a0], 0x51404156
mov dword [0x4a23a4], 0x5d555214
mov dword [0x4a23a8], 0x34505158
xor eax, eax
mov cl, byte [eax + 0x4a2398]
xor cl, 0x34
mov byte [eax + 0x4a2624], cl
inc eax
cmp eax, 0x14
jb 0x41e979
mov eax, 0x4a2624
ret

Function at 0x41ec40
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4640], 1
jne 0x41ec89
or dword [0x4a4640], 1
mov dword [0x4a23b8], 0x6b404144
mov dword [0x4a23bc], 0x47555857
mov dword [0x4a23c0], 0x59557a47
mov dword [0x4a23c4], 0x55521451
mov dword [0x4a23c8], 0x5051585d
mov byte [0x4a23cc], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a23b8]
xor cl, 0x34
mov byte [eax + 0x4a2644], cl
inc eax
cmp eax, 0x15
jb 0x41ec8b
mov eax, 0x4a2644
ret

Function at 0x41eca6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a463c], 1
jne 0x41ece8
or dword [0x4a463c], 1
mov dword [0x4a23d0], 0x75405147
mov dword [0x4a23d4], 0x5d464040
mov dword [0x4a23d8], 0x51404156
mov dword [0x4a23dc], 0x5d555214
mov dword [0x4a23e0], 0x34505158
xor eax, eax
mov cl, byte [eax + 0x4a23d0]
xor cl, 0x34
mov byte [eax + 0x4a265c], cl
inc eax
cmp eax, 0x14
jb 0x41ecea
mov eax, 0x4a265c
ret
Function at 0x41fd72
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x470808
call fcn.0046f99c
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x4a45c0], 1
mov edi, eax
jne 0x41fdbf
or dword [0x4a45c0], 1
mov dword [0x4a2a38], 0x5f585f41
mov dword [0x4a2a3c], 0x18425358
mov dword [0x4a2a40], 0x365a5a52
xor ecx, ecx
mov al, byte [ecx + 0x4a2a38]
xor al, 0x36
mov byte [ecx + 0x4a2cec], al
inc ecx
cmp ecx, 0xc
jb 0x41fdc1
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x4a2cec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x1b00
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x41fe0d
call fcn.0041fe83
mov edi, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00421cb8
pop ecx
pop ecx
jmp 0x41fe72
test byte [0x4a45b8], 1
jne 0x41fe2d
or dword [0x4a45b8], 1
mov word [0x4a2a60], 0x160c
mov byte [0x4a2a62], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2a60]
xor cl, 0x36
mov byte [eax + 0x4a2d14], cl
inc eax
cmp eax, 3
jb 0x41fe2f
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x4a2d14
push eax
call fcn.00421cb8
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0040c434
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403c75
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41fe83
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45bc], 1
jne 0x41fed8
or dword [0x4a45bc], 1
mov dword [0x4a2a44], 0x57701e16
mov dword [0x4a2a48], 0x52535a5f
mov dword [0x4a2a4c], 0x16594216
mov dword [0x4a2a50], 0x5b445950
mov dword [0x4a2a54], 0x53164257
mov dword [0x4a2a58], 0x44594444
mov word [0x4a2a5c], 0x361f
xor eax, eax
mov cl, byte [eax + 0x4a2a44]
xor cl, 0x36
mov byte [eax + 0x4a2cf8], cl
inc eax
cmp eax, 0x1a
jb 0x41feda
mov eax, 0x4a2cf8
ret
Function at 0x41ff0a
Capabilities:
Create http request

Disassembly:
mov eax, 0x4712a3
call fcn.0046f99c
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 4], edi
mov dword [ebp - 4], edi
mov dword [ebx + 8], 0x490228
mov byte [ebx + 0xc], 1
mov dword [ebx + 0x24], 0xf
mov dword [ebx + 0x20], edi
mov byte [ebx + 0x10], 0
mov byte [ebp - 4], 1
mov dword [ebx], 0x49022c
mov dword [ebx + 8], 0x490230
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x41ff5e
mov esi, dword [eax]
jmp 0x41ff60
mov esi, eax
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, 0x10
jb 0x41ff6c
mov eax, dword [eax]
push ecx
push eax
lea esi, [ebp - 0x40]
call fcn.00421d26
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x41ff85
mov eax, esi
push edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x41ffdf
call fcn.0041fffe
push eax
lea ecx, [ebp - 0x18]
call fcn.0041fc81
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004496da
push eax
lea ecx, [ebx + 0x10]
call fcn.00403c54
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebx + 0xc], 0
call fcn.004497ca
push 0x4915c0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x48fda0
call fcn.004535e6
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.00403da6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x41fffe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45b4], 1
jne 0x420047
or dword [0x4a45b4], 1
mov dword [0x4a2a64], 0x7e585f61
mov dword [0x4a2a68], 0x79464242
mov dword [0x4a2a6c], 0x1e585346
mov dword [0x4a2a70], 0x5750161f
mov dword [0x4a2a74], 0x52535a5f
mov byte [0x4a2a78], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2a64]
xor cl, 0x36
mov byte [eax + 0x4a2d18], cl
inc eax
cmp eax, 0x15
jb 0x420049
mov eax, 0x4a2d18
ret