joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f636b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cd4], 1
jne 0x3f63c0
or dword [0x498cd4], 1
mov dword [0x4937a8], 0x2e0a2f15
mov dword [0x4937ac], 0x1222293e
mov dword [0x4937b0], 0x29343d35
mov dword [0x4937b4], 0x322f3a36
mov dword [0x4937b8], 0x290b3534
mov dword [0x4937bc], 0x283e3834
mov word [0x4937c0], 0x5b28
xor eax, eax
mov cl, byte [eax + 0x4937a8]
xor cl, 0x5b
mov byte [eax + 0x4939a8], cl
inc eax
cmp eax, 0x1a
jb 0x3f63c2
mov eax, 0x4939a8
ret

Function at 0x3f63dd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cd0], 1
jne 0x3f6473
or dword [0x498cd0], 1
mov dword [0x4937c4], 0xb2f3e1c
mov dword [0x4937c8], 0x1a383429
mov dword [0x4937cc], 0x3e293f3f
mov dword [0x4937d0], 0x3d7b2828
mov dword [0x4937d4], 0x3e37323a
mov dword [0x4937d8], 0x15737b3f
mov dword [0x4937dc], 0x3e2e0a2f
mov dword [0x4937e0], 0x35122229
mov dword [0x4937e4], 0x3629343d
mov dword [0x4937e8], 0x34322f3a
mov dword [0x4937ec], 0x34290b35
mov dword [0x4937f0], 0x28283e38
mov dword [0x4937f4], 0x5b7b6172
xor eax, eax
mov cl, byte [eax + 0x4937c4]
xor cl, 0x5b
mov byte [eax + 0x4939c4], cl
inc eax
cmp eax, 0x34
jb 0x3f6475
mov eax, 0x4939c4
ret

Function at 0x3f6490
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ccc], 1
jne 0x3f6500
or dword [0x498ccc], 1
mov dword [0x4937f8], 0x2e0a2f15
mov dword [0x4937fc], 0x1222293e
mov dword [0x493800], 0x29343d35
mov dword [0x493804], 0x322f3a36
mov dword [0x493808], 0x290b3534
mov dword [0x49380c], 0x283e3834
mov dword [0x493810], 0x3a3d7b28
mov dword [0x493814], 0x3f3e3732
mov word [0x493818], 0x7b61
mov byte [0x49381a], 0x5b
xor eax, eax
mov cl, byte [eax + 0x4937f8]
xor cl, 0x5b
mov byte [eax + 0x4939f8], cl
inc eax
cmp eax, 0x23
jb 0x3f6502
mov eax, 0x4939f8
ret

Function at 0x3f651d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cc8], 1
jne 0x3f6566
or dword [0x498cc8], 1
mov dword [0x49381c], 0x353e2b14
mov dword [0x493820], 0x3834290b
mov dword [0x493824], 0x7b28283e
mov dword [0x493828], 0x37323a3d
mov dword [0x49382c], 0x7b613f3e
mov byte [0x493830], 0x5b
xor eax, eax
mov cl, byte [eax + 0x49381c]
xor cl, 0x5b
mov byte [eax + 0x493a1c], cl
inc eax
cmp eax, 0x15
jb 0x3f6568
mov eax, 0x493a1c
ret
Function at 0x3f6583
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46332c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x498cc4], 1
push esi
push edi
jne 0x3f65e0
or dword [0x498cc4], 1
mov dword [0x493834], 0x35293e30
mov dword [0x493838], 0x6968373e
mov dword [0x49383c], 0x37373f75
mov byte [0x493840], 0x5b
xor eax, eax
mov cl, byte [eax + 0x493834]
xor cl, 0x5b
mov byte [eax + 0x493a34], cl
inc eax
cmp eax, 0xd
jb 0x3f65e2
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x493a34
call edi
mov esi, eax
test esi, esi
jne 0x3f6656
call dword [0x46a0a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041a8c0
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.003f67b8
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.003f6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.003f5c3f
push 0x4844a8
mov eax, esi
push eax
call fcn.00445956
call fcn.003f6835
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x3f6723
call fcn.003f68a8
push eax
call edi
mov edi, eax
test edi, edi
jne 0x3f66c7
call dword [0x46a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0041a8c0
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.003f68f2
push eax
lea eax, [esp + 0x20]
push eax
call fcn.003f6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.003f5c3f
push 0x4844a8
mov eax, esi
jmp 0x3f6650
call fcn.003f696c
push eax
push edi
call esi
test eax, eax
jne 0x3f6723
call dword [0x46a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0041a8c0
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.003f69dc
push eax
lea eax, [esp + 0x20]
push eax
call fcn.003f6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.003f5c3f
push 0x4844a8
mov eax, esi
jmp 0x3f6650
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x3f6785
call dword [0x46a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0041a8c0
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.003f6a95
push eax
lea eax, [esp + 0x20]
push eax
call fcn.003f6b56
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.003f5c3f
push 0x4844a8
mov eax, esi
jmp 0x3f6650
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.003f4cc5
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x3f67b8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cc0], 1
jne 0x3f6818
or dword [0x498cc0], 1
mov dword [0x493844], 0x3f3a3417
mov dword [0x493848], 0x29393217
mov dword [0x49384c], 0x7b22293a
mov dword [0x493850], 0x37323a3d
mov dword [0x493854], 0x737b3f3e
mov dword [0x493858], 0x35293e30
mov dword [0x49385c], 0x6968373e
mov dword [0x493860], 0x5b7b6172
xor eax, eax
mov cl, byte [eax + 0x493844]
xor cl, 0x5b
mov byte [eax + 0x493a44], cl
inc eax
cmp eax, 0x20
jb 0x3f681a
mov eax, 0x493a44
ret
Function at 0x3f6835
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cbc], 1
jne 0x3f688b
or dword [0x498cbc], 1
mov dword [0x493864], 0x1c696810
mov dword [0x493868], 0x290b2f3e
mov dword [0x49386c], 0x283e3834
mov dword [0x493870], 0x3a361228
mov dword [0x493874], 0x321d3e3c
mov dword [0x493878], 0x3a153e37
mov dword [0x49387c], 0x5b1a3e36
xor eax, eax
mov cl, byte [eax + 0x493864]
xor cl, 0x5b
mov byte [eax + 0x493a64], cl
inc eax
cmp eax, 0x1c
jb 0x3f688d
mov eax, 0x493a64
ret

Function at 0x3f68a8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cb8], 1
jne 0x3f68d5
or dword [0x498cb8], 1
mov dword [0x493880], 0x2b3a282b
mov dword [0x493884], 0x373f7532
mov word [0x493888], 0x5b37
xor eax, eax
mov cl, byte [eax + 0x493880]
xor cl, 0x5b
mov byte [eax + 0x493a80], cl
inc eax
cmp eax, 0xa
jb 0x3f68d7
mov eax, 0x493a80
ret

Function at 0x3f68f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cb4], 1
jne 0x3f694f
or dword [0x498cb4], 1
mov dword [0x49388c], 0x3f3a3417
mov dword [0x493890], 0x29393217
mov dword [0x493894], 0x7b22293a
mov dword [0x493898], 0x37323a3d
mov dword [0x49389c], 0x737b3f3e
mov dword [0x4938a0], 0x2b3a282b
mov dword [0x4938a4], 0x7b617232
mov byte [0x4938a8], 0x5b
xor eax, eax
mov cl, byte [eax + 0x49388c]
xor cl, 0x5b
mov byte [eax + 0x493a8c], cl
inc eax
cmp eax, 0x1d
jb 0x3f6951
mov eax, 0x493a8c
ret

Function at 0x3f696c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cb0], 1
jne 0x3f69bf
or dword [0x498cb0], 1
mov dword [0x4938ac], 0xb2f3e1c
mov dword [0x4938b0], 0x3e383429
mov dword [0x4938b4], 0x36122828
mov dword [0x4938b8], 0x1d3e3c3a
mov dword [0x4938bc], 0x153e3732
mov dword [0x4938c0], 0x1a3e363a
mov byte [0x4938c4], 0x5b
xor eax, eax
mov cl, byte [eax + 0x4938ac]
xor cl, 0x5b
mov byte [eax + 0x493aac], cl
inc eax
cmp eax, 0x19
jb 0x3f69c1
mov eax, 0x493aac
ret

Function at 0x3f69dc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498cac], 1
jne 0x3f6a78
or dword [0x498cac], 1
mov dword [0x4938c8], 0xb2f3e1c
mov dword [0x4938cc], 0x1a383429
mov dword [0x4938d0], 0x3e293f3f
mov dword [0x4938d4], 0x3d7b2828
mov dword [0x4938d8], 0x3e37323a
mov dword [0x4938dc], 0x1c737b3f
mov dword [0x4938e0], 0x290b2f3e
mov dword [0x4938e4], 0x283e3834
mov dword [0x4938e8], 0x3a361228
mov dword [0x4938ec], 0x321d3e3c
mov dword [0x4938f0], 0x3a153e37
mov dword [0x4938f4], 0x721a3e36
mov word [0x4938f8], 0x7b61
mov byte [0x4938fa], 0x5b
xor eax, eax
mov cl, byte [eax + 0x4938c8]
xor cl, 0x5b
mov byte [eax + 0x493ac8], cl
inc eax
cmp eax, 0x33
jb 0x3f6a7a
mov eax, 0x493ac8
ret

Function at 0x3f6a95
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ca8], 1
jne 0x3f6afc
or dword [0x498ca8], 1
mov dword [0x4938fc], 0xb2f3e1c
mov dword [0x493900], 0x3e383429
mov dword [0x493904], 0x36122828
mov dword [0x493908], 0x1d3e3c3a
mov dword [0x49390c], 0x353e3732
mov dword [0x493910], 0x7b3e363a
mov dword [0x493914], 0x37323a3d
mov dword [0x493918], 0x7b613f3e
mov byte [0x49391c], 0x5b
xor eax, eax
mov cl, byte [eax + 0x4938fc]
xor cl, 0x5b
mov byte [eax + 0x493afc], cl
inc eax
cmp eax, 0x21
jb 0x3f6afe
mov eax, 0x493afc
ret
Function at 0x3f76ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ca4], 1
jne 0x3f78b0
or dword [0x498ca4], 1
mov dword [0x493b28], 0x2f723335
mov dword [0x493b2c], 0x29333828
mov dword [0x493b30], 0x392f6628
mov dword [0x493b34], 0x293e2a28
mov dword [0x493b38], 0x327b743a
mov dword [0x493b3c], 0x56757b33
mov dword [0x493b40], 0x373f3d2c
mov dword [0x493b44], 0x72393b3d
mov dword [0x493b48], 0x34283d2c
mov dword [0x493b4c], 0x7b7c617c
mov dword [0x493b50], 0x392e567b
mov dword [0x493b54], 0x2e35292d
mov dword [0x493b58], 0x2f7b7439
mov dword [0x493b5c], 0x3f352e28
mov dword [0x493b60], 0x56757b28
mov dword [0x493b64], 0x3d3f3330
mov dword [0x493b68], 0x702f7c30
mov dword [0x493b6c], 0x617c2e7c
mov dword [0x493b70], 0x3f2c247c
mov dword [0x493b74], 0x7430303d
mov dword [0x493b78], 0x3f32293a
mov dword [0x493b7c], 0x32333528
mov dword [0x493b80], 0x2e7c7574
mov dword [0x493b84], 0x2e292839
mov dword [0x493b88], 0x392e7c32
mov dword [0x493b8c], 0x2e35292d
mov dword [0x493b90], 0x797b7439
mov dword [0x493b94], 0x72757b11
mov dword [0x493b98], 0x32353d31
mov dword [0x493b9c], 0x3d030374
mov dword [0x493ba0], 0x752f3b2e
mov dword [0x493ba4], 0x3832397c
mov dword [0x493ba8], 0x39387c70
mov dword [0x493bac], 0x723b293e
mov dword [0x493bb0], 0x3f3d2e28
mov dword [0x493bb4], 0x3f3d3e39
mov dword [0x493bb8], 0x35567537
mov dword [0x493bbc], 0x33327c3a
mov dword [0x493bc0], 0x7c2f7c28
mov dword [0x493bc4], 0x32393428
mov dword [0x493bc8], 0x2e2e397c
mov dword [0x493bcc], 0x2e742e33
mov dword [0x493bd0], 0x32397c75
mov dword [0x493bd4], 0x392e5638
mov dword [0x493bd8], 0x322e2928
mov word [0x493bdc], 0x2e7c
mov byte [0x493bde], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493b28]
xor cl, 0x5c
mov byte [eax + 0x494118], cl
inc eax
cmp eax, 0xb7
jb 0x3f78b2
mov eax, 0x494118
ret
Function at 0x3f78cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ca0], 1
jne 0x3f7b55
or dword [0x498ca0], 1
mov dword [0x493be0], 0x2f723335
mov dword [0x493be4], 0x29333828
mov dword [0x493be8], 0x392f6628
mov dword [0x493bec], 0x293e2a28
mov dword [0x493bf0], 0x327b743a
mov dword [0x493bf4], 0x56757b33
mov dword [0x493bf8], 0x373f3d2c
mov dword [0x493bfc], 0x72393b3d
mov dword [0x493c00], 0x34283d2c
mov dword [0x493c04], 0x567b7b61
mov dword [0x493c08], 0x292d392e
mov dword [0x493c0c], 0x74392e35
mov dword [0x493c10], 0x2e282f7b
mov dword [0x493c14], 0x7b283f35
mov dword [0x493c18], 0x33305675
mov dword [0x493c1c], 0x7c303d3f
mov dword [0x493c20], 0x617c3031
mov dword [0x493c24], 0x2d392e7c
mov dword [0x493c28], 0x392e3529
mov dword [0x493c2c], 0x30317b74
mov dword [0x493c30], 0x3056757b
mov dword [0x493c34], 0x303d3f33
mov dword [0x493c38], 0x2e702f7c
mov dword [0x493c3c], 0x617c3970
mov dword [0x493c40], 0x3f2c247c
mov dword [0x493c44], 0x7430303d
mov dword [0x493c48], 0x3f32293a
mov dword [0x493c4c], 0x32333528
mov dword [0x493c50], 0x2e7c7574
mov dword [0x493c54], 0x2e292839
mov dword [0x493c58], 0x392e7c32
mov dword [0x493c5c], 0x2e35292d
mov dword [0x493c60], 0x797b7439
mov dword [0x493c64], 0x72757b11
mov dword [0x493c68], 0x79741a79
mov dword [0x493c6c], 0x397c751d
mov dword [0x493c70], 0x7c703832
mov dword [0x493c74], 0x293e3938
mov dword [0x493c78], 0x2e28723b
mov dword [0x493c7c], 0x3e393f3d
mov dword [0x493c80], 0x75373f3d
mov dword [0x493c84], 0x7c3a3556
mov dword [0x493c88], 0x7c283332
mov dword [0x493c8c], 0x34287c2f
mov dword [0x493c90], 0x2e7c3239
mov dword [0x493c94], 0x2e292839
mov dword [0x493c98], 0x35327c32
mov dword [0x493c9c], 0x2e7c7030
mov dword [0x493ca0], 0x3832397c
mov dword [0x493ca4], 0x7c3a3556
mov dword [0x493ca8], 0x61227c2e
mov dword [0x493cac], 0x3035327c
mov dword [0x493cb0], 0x3934287c
mov dword [0x493cb4], 0x7c2e7c32
mov dword [0x493cb8], 0x30317c61
mov dword [0x493cbc], 0x282f2872
mov dword [0x493cc0], 0x3b32352e
mov dword [0x493cc4], 0x7c752e74
mov dword [0x493cc8], 0x56383239
mov dword [0x493ccc], 0x2928392e
mov dword [0x493cd0], 0x2e7c322e
mov word [0x493cd4], 0x3970
mov byte [0x493cd6], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493be0]
xor cl, 0x5c
mov byte [eax + 0x4941d0], cl
inc eax
cmp eax, 0xf7
jb 0x3f7b57
mov eax, 0x4941d0
ret
Function at 0x3f7b74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x498c64], 1
jne 0x3f7b9b
or dword [0x498c64], 1
mov dword [0x493dc8], 0x373f3d2c
mov dword [0x493dcc], 0x5c393b3d
xor eax, eax
mov cl, byte [eax + 0x493dc8]
xor cl, 0x5c
mov byte [eax + 0x4943b8], cl
inc eax
cmp eax, 8
jb 0x3f7b9d
push 0x4943b8
push dword [ebp + 8]
call fcn.00428c96
test byte [0x498c60], 1
pop ecx
pop ecx
jne 0x3f7be5
or dword [0x498c60], 1
mov dword [0x493dd0], 0x30392e2c
mov dword [0x493dd4], 0x5c383d33
xor eax, eax
mov cl, byte [eax + 0x493dd0]
xor cl, 0x5c
mov byte [eax + 0x4943c0], cl
inc eax
cmp eax, 8
jb 0x3f7be7
push esi
push 0x4943c0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00428d0a
add esp, 0xc
cmp dword [0x48ebe0], 0
mov esi, 0x48ebe0
je 0x3f7c47
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00428bb6
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00428f37
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x3f7c20
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0042840b
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x3f7ec1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x462d66
call fcn.00461d38
sub esp, 0x64
test byte [0x498c4c], 1
jne 0x3f7eee
or dword [0x498c4c], 1
mov word [0x493e00], 0x1179
mov byte [0x493e02], 0x5c
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x493e00]
xor cl, 0x5c
mov byte [eax + 0x4943f0], cl
inc eax
cmp eax, 3
jb 0x3f7ef5
mov esi, 0x4943f0
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x3f7f21
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.003f4c50
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.003fd0cb
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.003f4ce6
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x3f7f68
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.00427809
pop ecx
pop ecx
cmp eax, ebx
je 0x3f7fb9
cmp eax, 3
jne 0x3f7fa6
call fcn.003f80c0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043ba55
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x4844a8
lea eax, [ebp - 0x1c]
push eax
call fcn.00445956
cmp eax, 4
jne 0x3f7fb2
call fcn.003f8173
jmp 0x3f7f82
call fcn.003f8226
jmp 0x3f7f82
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0042923f
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x3f8070
push ebx
call fcn.003f82aa
push eax
push 0xffffffffffffffff
push esi
call fcn.00427fa0
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.003f4cc5
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x3f8028
call fcn.003f82f1
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.003fd13c
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.003f5c3f
jmp 0x3f7f98
cmp edi, 4
jne 0x3f8047
call fcn.003f8350
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.003fd13c
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x3f801b
cmp edi, 6
jne 0x3f8066
call fcn.003f83b5
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.003fd13c
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x3f801b
call fcn.003f8439
jmp 0x3f7f82
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.004285fb
pop ecx
pop ecx
test eax, eax
je 0x3f8091
push ebx
push edi
push esi
call fcn.004287bf
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.004283f5
sub edi, eax
push edi
push esi
call fcn.0042840b
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.003f4ce6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x3f80c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c48], 1
jne 0x3f8156
or dword [0x498c48], 1
mov dword [0x493e04], 0x30353d1a
mov dword [0x493e08], 0x287c3839
mov dword [0x493e0c], 0x2a397c33
mov dword [0x493e10], 0x3d29303d
mov dword [0x493e14], 0x3e7c3928
mov dword [0x493e18], 0x2f283333
mov dword [0x493e1c], 0x2c3d2e28
mov dword [0x493e20], 0x3d2e3a7c
mov dword [0x493e24], 0x3239313b
mov dword [0x493e28], 0x2f7c7028
mov dword [0x493e2c], 0x3d283225
mov dword [0x493e30], 0x2e397c24
mov dword [0x493e34], 0x5c2e332e
xor eax, eax
mov cl, byte [eax + 0x493e04]
xor cl, 0x5c
mov byte [eax + 0x4943f4], cl
inc eax
cmp eax, 0x34
jb 0x3f8158
mov eax, 0x4943f4
ret

Function at 0x3f8173
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c44], 1
jne 0x3f8209
or dword [0x498c44], 1
mov dword [0x493e38], 0x30353d1a
mov dword [0x493e3c], 0x287c3839
mov dword [0x493e40], 0x2a397c33
mov dword [0x493e44], 0x3d29303d
mov dword [0x493e48], 0x3e7c3928
mov dword [0x493e4c], 0x2f283333
mov dword [0x493e50], 0x2c3d2e28
mov dword [0x493e54], 0x3d2e3a7c
mov dword [0x493e58], 0x3239313b
mov dword [0x493e5c], 0x317c7028
mov dword [0x493e60], 0x2e333139
mov dword [0x493e64], 0x2e397c25
mov dword [0x493e68], 0x5c2e332e
xor eax, eax
mov cl, byte [eax + 0x493e38]
xor cl, 0x5c
mov byte [eax + 0x494428], cl
inc eax
cmp eax, 0x34
jb 0x3f820b
mov eax, 0x494428
ret

Function at 0x3f8226
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c40], 1
jne 0x3f828d
or dword [0x498c40], 1
mov dword [0x493e6c], 0x32373209
mov dword [0x493e70], 0x7c322b33
mov dword [0x493e74], 0x332e2e39
mov dword [0x493e78], 0x32357c2e
mov dword [0x493e7c], 0x3d29307c
mov dword [0x493e80], 0x33300310
mov dword [0x493e84], 0x282f383d
mov dword [0x493e88], 0x3b32352e
mov byte [0x493e8c], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493e6c]
xor cl, 0x5c
mov byte [eax + 0x49445c], cl
inc eax
cmp eax, 0x21
jb 0x3f828f
mov eax, 0x49445c
ret

Function at 0x3f82aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c3c], 1
jne 0x3f82d4
or dword [0x498c3c], 1
mov dword [0x493e90], 0x32333260
mov word [0x493e94], 0x6239
mov byte [0x493e96], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493e90]
xor cl, 0x5c
mov byte [eax + 0x494480], cl
inc eax
cmp eax, 7
jb 0x3f82d6
mov eax, 0x494480
ret

Function at 0x3f82f1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c38], 1
jne 0x3f8333
or dword [0x498c38], 1
mov dword [0x493e98], 0x7c3d2910
mov dword [0x493e9c], 0x2832292e
mov dword [0x493ea0], 0x7c393135
mov dword [0x493ea4], 0x332e2e39
mov dword [0x493ea8], 0x5c7c662e
xor eax, eax
mov cl, byte [eax + 0x493e98]
xor cl, 0x5c
mov byte [eax + 0x494488], cl
inc eax
cmp eax, 0x14
jb 0x3f8335
mov eax, 0x494488
ret
Function at 0x3f8350
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c34], 1
jne 0x3f8398
or dword [0x498c34], 1
mov dword [0x493eac], 0x7c3d2910
mov dword [0x493eb0], 0x33313931
mov dword [0x493eb4], 0x397c252e
mov dword [0x493eb8], 0x2e332e2e
mov word [0x493ebc], 0x7c66
mov byte [0x493ebe], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493eac]
xor cl, 0x5c
mov byte [eax + 0x49449c], cl
inc eax
cmp eax, 0x13
jb 0x3f839a
mov eax, 0x49449c
ret

Function at 0x3f83b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c30], 1
jne 0x3f841c
or dword [0x498c30], 1
mov dword [0x493ec0], 0x7c3d2910
mov dword [0x493ec4], 0x332e2e39
mov dword [0x493ec8], 0x32357c2e
mov dword [0x493ecc], 0x3938352f
mov dword [0x493ed0], 0x2e2e397c
mov dword [0x493ed4], 0x347c2e33
mov dword [0x493ed8], 0x3038323d
mov dword [0x493edc], 0x7c662e39
mov byte [0x493ee0], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493ec0]
xor cl, 0x5c
mov byte [eax + 0x4944b0], cl
inc eax
cmp eax, 0x21
jb 0x3f841e
mov eax, 0x4944b0
ret

Function at 0x3f8439
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c2c], 1
jne 0x3f8495
or dword [0x498c2c], 1
mov dword [0x493ee4], 0x32373209
mov dword [0x493ee8], 0x7c322b33
mov dword [0x493eec], 0x332e2e39
mov dword [0x493ef0], 0x32357c2e
mov dword [0x493ef4], 0x3d29307c
mov dword [0x493ef8], 0x3d3f2c03
mov word [0x493efc], 0x3030
mov byte [0x493efe], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493ee4]
xor cl, 0x5c
mov byte [eax + 0x4944d4], cl
inc eax
cmp eax, 0x1b
jb 0x3f8497
mov eax, 0x4944d4
ret

Function at 0x3f86d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c28], 1
jne 0x3f871c
or dword [0x498c28], 1
mov dword [0x493f00], 0x392f3d1e
mov dword [0x493f04], 0x387c686a
mov dword [0x493f08], 0x38333f39
mov dword [0x493f0c], 0x3d3a7c39
mov dword [0x493f10], 0x38393035
mov byte [0x493f14], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493f00]
xor cl, 0x5c
mov byte [eax + 0x4944f0], cl
inc eax
cmp eax, 0x15
jb 0x3f871e
mov eax, 0x4944f0
ret
Function at 0x3f8739
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x464a60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0041c73d
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0041ab25
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.003f4e24
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.003facc5
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x3f87c6
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0041f744
add esp, 0x10
test al, al
jne 0x3f880b
call fcn.003f8882
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.0043ba55
push 0x4844a8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00445956
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.003facc5
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x3f884b
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x3f882a
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.003fa117
lea esi, [esp + 0x20]
call fcn.003facac
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.003f4ce6
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3f8882
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c24], 1
jne 0x3f88cb
or dword [0x498c24], 1
mov dword [0x493f18], 0x392f3d1e
mov dword [0x493f1c], 0x387c686a
mov dword [0x493f20], 0x38333f39
mov dword [0x493f24], 0x3d3a7c39
mov dword [0x493f28], 0x38393035
mov byte [0x493f2c], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493f18]
xor cl, 0x5c
mov byte [eax + 0x494508], cl
inc eax
cmp eax, 0x15
jb 0x3f88cd
mov eax, 0x494508
ret

Function at 0x3f8fc0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c20], 1
jne 0x3f9015
or dword [0x498c20], 1
mov dword [0x493f30], 0x3029331f
mov dword [0x493f34], 0x33327c38
mov dword [0x493f38], 0x2c337c28
mov dword [0x493f3c], 0x3f7c3239
mov dword [0x493f40], 0x342f3d2e
mov dword [0x493f44], 0x3129387c
mov word [0x493f48], 0x5c2c
xor eax, eax
mov cl, byte [eax + 0x493f30]
xor cl, 0x5c
mov byte [eax + 0x494520], cl
inc eax
cmp eax, 0x1a
jb 0x3f9017
mov eax, 0x494520
ret