joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044a0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73fc], 1
jne 0x404514
or dword [0x4c73fc], 1
mov dword [0x4c0fd0], 0x30b2c63
mov dword [0x4c0fd4], 0x4a0e0f06
mov dword [0x4c0fd8], 0xd4a051e
mov dword [0x4c0fdc], 0x194a1e0f
mov dword [0x4c0fe0], 0x50500e1e
mov dword [0x4c0fe4], 0xf09120f
mov dword [0x4c0fe8], 0x5031e1a
mov dword [0x4c0fec], 0x1d505004
mov dword [0x4c0ff0], 0x421e0b02
mov dword [0x4c0ff4], 0x6a606743
xor eax, eax
mov cl, byte [eax + 0x4c0fd0]
xor cl, 0x6a
mov byte [eax + 0x4c167c], cl
inc eax
cmp eax, 0x28
jb 0x404516
mov eax, 0x4c167c
ret

Function at 0x404531
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73f8], 1
jne 0x404565
or dword [0x4c73f8], 1
mov dword [0x4c0ff8], 0x7050935
mov dword [0x4c0ffc], 0x18180f35
mov word [0x4c1000], 0x1805
mov byte [0x4c1002], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0ff8]
xor cl, 0x6a
mov byte [eax + 0x4c16a4], cl
inc eax
cmp eax, 0xb
jb 0x404567
mov eax, 0x4c16a4
ret

Function at 0x404582
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73f4], 1
jne 0x4045eb
or dword [0x4c73f4], 1
mov dword [0x4c1004], 0x5093563
mov dword [0x4c1008], 0x180f3507
mov dword [0x4c100c], 0x50180518
mov dword [0x4c1010], 0x18182f50
mov dword [0x4c1014], 0xf271805
mov dword [0x4c1018], 0xd0b1919
mov dword [0x4c101c], 0x5043420f
mov dword [0x4c1020], 0x67194f4a
mov word [0x4c1024], 0x6a60
xor eax, eax
mov cl, byte [eax + 0x4c1004]
xor cl, 0x6a
mov byte [eax + 0x4c16b0], cl
inc eax
cmp eax, 0x22
jb 0x4045ed
mov eax, 0x4c16b0
ret

Function at 0x404608
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73f0], 1
jne 0x404686
or dword [0x4c73f0], 1
mov dword [0x4c1028], 0x30b2c63
mov dword [0x4c102c], 0x4a0e0f06
mov dword [0x4c1030], 0xd4a051e
mov dword [0x4c1034], 0x354a1e0f
mov dword [0x4c1038], 0x35070509
mov dword [0x4c103c], 0x518180f
mov dword [0x4c1040], 0x2f505018
mov dword [0x4c1044], 0x18051818
mov dword [0x4c1048], 0x19190f27
mov dword [0x4c104c], 0x420f0d0b
mov dword [0x4c1050], 0x6a606743
xor eax, eax
mov cl, byte [eax + 0x4c1028]
xor cl, 0x6a
mov byte [eax + 0x4c16d4], cl
inc eax
cmp eax, 0x2c
jb 0x404688
mov eax, 0x4c16d4
ret

Function at 0x4046a3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73ec], 1
jne 0x40471e
or dword [0x4c73ec], 1
mov dword [0x4c1054], 0x90b1e39
mov dword [0x4c1058], 0x1f0e4a01
mov dword [0x4c105c], 0xf4a1a07
mov dword [0x4c1060], 0x18051818
mov dword [0x4c1064], 0x5294a50
mov dword [0x4c1068], 0x120f1e04
mov dword [0x4c106c], 0x90f381e
mov dword [0x4c1070], 0x4a0e1805
mov dword [0x4c1074], 0x4a190b1d
mov dword [0x4c1078], 0x6061f04
mov byte [0x4c107c], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c1054]
xor cl, 0x6a
mov byte [eax + 0x4c1700], cl
inc eax
cmp eax, 0x29
jb 0x404720
mov eax, 0x4c1700
ret
Function at 0x40473b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73e8], 1
jne 0x4047b5
or dword [0x4c73e8], 1
mov dword [0x4c1080], 0x90b1e39
mov dword [0x4c1084], 0x1f0e4a01
mov dword [0x4c1088], 0xf4a1a07
mov dword [0x4c108c], 0x18051818
mov dword [0x4c1090], 0x13394a50
mov dword [0x4c1094], 0x3042307
mov dword [0x4c1098], 0x60b031e
mov dword [0x4c109c], 0x4a0f1003
mov dword [0x4c10a0], 0x6030b0c
mov word [0x4c10a4], 0xe0f
mov byte [0x4c10a6], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c1080]
xor cl, 0x6a
mov byte [eax + 0x4c172c], cl
inc eax
cmp eax, 0x27
jb 0x4047b7
mov eax, 0x4c172c
ret

Function at 0x4047d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73e4], 1
jne 0x404838
or dword [0x4c73e4], 1
mov dword [0x4c10a8], 0x3011956
mov dword [0x4c10ac], 0xe0f1a1a
mov dword [0x4c10b0], 0xb180c4a
mov dword [0x4c10b4], 0x4a460f07
mov dword [0x4c10b8], 0x1d4a293a
mov dword [0x4c10bc], 0x44a190b
mov dword [0x4c10c0], 0x5406061f
mov word [0x4c10c4], 0x6067
mov byte [0x4c10c6], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c10a8]
xor cl, 0x6a
mov byte [eax + 0x4c1754], cl
inc eax
cmp eax, 0x1f
jb 0x40483a
mov eax, 0x4c1754
ret

Function at 0x404855
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73e0], 1
jne 0x4048e8
or dword [0x4c73e0], 1
mov dword [0x4c10c8], 0x3011956
mov dword [0x4c10cc], 0xe0f1a1a
mov dword [0x4c10d0], 0xb180c4a
mov dword [0x4c10d4], 0x4a460f07
mov dword [0x4c10d8], 0x1d4a293a
mov dword [0x4c10dc], 0x194a190b
mov dword [0x4c10e0], 0x4a0f070b
mov dword [0x4c10e4], 0x184a190b
mov dword [0x4c10e8], 0x181f1e0f
mov dword [0x4c10ec], 0xe0b4a04
mov dword [0x4c10f0], 0x190f180e
mov dword [0x4c10f4], 0x60675419
mov byte [0x4c10f8], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c10c8]
xor cl, 0x6a
mov byte [eax + 0x4c1774], cl
inc eax
cmp eax, 0x31
jb 0x4048ea
mov eax, 0x4c1774
ret
Function at 0x404905
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.004798e0
push ebx
push esi
push edi
call dword [0x495094]
test byte [0x4c73dc], 1
mov dword [ebp - 4], eax
jne 0x40494c
or dword [0x4c73dc], 1
mov dword [0x4c10fc], 0xe050756
mov dword [0x4c1100], 0x550f061f
mov dword [0x4c1104], 0x6a545555
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x4c10fc]
xor cl, 0x6a
mov byte [eax + 0x4c17a8], cl
inc eax
cmp eax, 0xc
jb 0x404950
test byte [0x4c73d8], 1
mov dword [ebp - 8], 0x4c17a8
jne 0x40499a
or dword [0x4c73d8], 1
mov dword [0x4c1108], 0x7131956
mov dword [0x4c110c], 0x55060508
mov dword [0x4c1110], 0x6a545555
xor eax, eax
mov cl, byte [eax + 0x4c1108]
xor cl, 0x6a
mov byte [eax + 0x4c17b4], cl
inc eax
cmp eax, 0xc
jb 0x40499c
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x4c17b4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0046b6f0
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x4953bc]
test eax, eax
je 0x404a01
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.0046b6f0
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x4953c4]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x404a4d
mov ecx, dword [ebp - 0x1c]
test byte [0x4c73d4], 1
jne 0x404a84
or dword [0x4c73d4], 1
mov dword [0x4c1114], 0x4f4a1a4f
mov dword [0x4c1118], 0x194f4b19
mov dword [0x4c111c], 0x4f125a41
mov word [0x4c1120], 0x6a12
xor eax, eax
mov dl, byte [eax + 0x4c1114]
xor dl, 0x6a
mov byte [eax + 0x4c17c0], dl
inc eax
cmp eax, 0xe
jb 0x404a86
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x4c17c0
push dword [ebp + 0xc]
call fcn.00466fcd
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x4953c8]
test eax, eax
je 0x404afd
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00404b4a
push eax
push dword [ebp + 0xc]
call fcn.00466fcd
add esp, 0x14
test byte [0x4c73cc], 1
jne 0x404b1d
or dword [0x4c73cc], 1
mov word [0x4c1134], 0x6067
mov byte [0x4c1136], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c1134]
xor cl, 0x6a
mov byte [eax + 0x4c17e0], cl
inc eax
cmp eax, 3
jb 0x404b1f
push dword [ebp + 0xc]
push 0x4c17e0
call fcn.00466c41
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404b4a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73d0], 1
jne 0x404b82
or dword [0x4c73d0], 1
mov dword [0x4c1124], 0x194f424a
mov dword [0x4c1128], 0x4a0e4f50
mov dword [0x4c112c], 0x125a4a41
mov dword [0x4c1130], 0x6a43124f
xor eax, eax
mov cl, byte [eax + 0x4c1124]
xor cl, 0x6a
mov byte [eax + 0x4c17d0], cl
inc eax
cmp eax, 0x10
jb 0x404b84
mov eax, 0x4c17d0
ret

Function at 0x405d9a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73c0], 1
jne 0x405def
or dword [0x4c73c0], 1
mov dword [0x4c1804], 0x283e2d24
mov dword [0x4c1808], 0x293e2d3b
mov dword [0x4c180c], 0x3c2f2d30
mov dword [0x4c1810], 0x3f283025
mov dword [0x4c1814], 0x3a303828
mov dword [0x4c1818], 0x3334232e
mov word [0x4c181c], 0x6c33
xor eax, eax
mov cl, byte [eax + 0x4c1804]
xor cl, 0x6c
mov byte [eax + 0x4c1a04], cl
inc eax
cmp eax, 0x1a
jb 0x405df1
mov eax, 0x4c1a04
ret

Function at 0x405f00
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73bc], 1
jne 0x405f2a
or dword [0x4c73bc], 1
mov dword [0x4c1820], 0xd3b213a
mov word [0x4c1824], 0x91e
mov byte [0x4c1826], 0x6c
xor eax, eax
mov cl, byte [eax + 0x4c1820]
xor cl, 0x6c
mov byte [eax + 0x4c1a20], cl
inc eax
cmp eax, 7
jb 0x405f2c
mov eax, 0x4c1a20
ret

Function at 0x405f47
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c73b8], 1
jne 0x405f76
or dword [0x4c73b8], 1
mov dword [0x4c1828], 0x181e053a
mov dword [0x4c182c], 0x3c000d19
mov word [0x4c1830], 0x6c2f
mov cl, byte [eax + 0x4c1828]
xor cl, 0x6c
mov byte [eax + 0x4c1a28], cl
inc eax
cmp eax, 0xa
jb 0x405f76
mov eax, 0x4c1a28
ret

Function at 0x405f91
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c73b4], 1
jne 0x405fc7
or dword [0x4c73b4], 1
mov dword [0x4c1834], 0x181e053a
mov dword [0x4c1838], 0x2e000d19
mov word [0x4c183c], 0x1403
mov byte [0x4c183e], 0x6c
mov cl, byte [eax + 0x4c1834]
xor cl, 0x6c
mov byte [eax + 0x4c1a34], cl
inc eax
cmp eax, 0xb
jb 0x405fc7
mov eax, 0x4c1a34
ret

Function at 0x405fe4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73b0], 1
jne 0x406008
or dword [0x4c73b0], 1
mov dword [0x4c1840], 0x902092b
mov dword [0x4c1844], 0x6c0f051e
xor eax, eax
mov cl, byte [eax + 0x4c1840]
xor cl, 0x6c
mov byte [eax + 0x4c1a40], cl
inc eax
cmp eax, 8
jb 0x40600a
mov eax, 0x4c1a40
ret
Function at 0x406025
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48df57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
xor ebx, ebx
test byte [0x4c73ac], 1
push esi
mov dword [esp + 0xc], ebx
jne 0x40607b
or dword [0x4c73ac], 1
mov dword [0x4c1848], 0x81802
mov dword [0x4c184c], 0x84200
mov word [0x4c1850], 0x6c00
xor eax, eax
mov cl, byte [eax + 0x4c1848]
xor cl, 0x6c
mov byte [eax + 0x4c1a48], cl
inc eax
cmp eax, 0xa
jb 0x40607d
push 0x4c1a48
call dword [0x4950cc]
mov esi, eax
cmp esi, ebx
jne 0x4060ef
call dword [0x4950a8]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], ebx
call fcn.00406236
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0xbc], 1
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
push eax
call fcn.004706f5
call fcn.0040629c
push eax
push esi
call dword [0x4950c8]
cmp eax, ebx
jne 0x40614c
call dword [0x4950a8]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], 2
call fcn.0040630e
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0xbc], 3
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
jmp 0x4060e9
lea ecx, [esp + 0xc]
push ecx
push 0x18
lea ecx, [esp + 0x68]
push ecx
push ebx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x4061d3
cmp dword [esp + 0xc], 0x18
jne 0x4061d3
push dword [esp + 0x74]
push ebx
push 0x410
call dword [0x4950c4]
cmp eax, ebx
jne 0x406222
call dword [0x4950a8]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], 6
call fcn.0040644e
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x1c]
mov byte [esp + 0xbc], 7
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
jmp 0x4060e9
call dword [0x4950a8]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0xc0], 4
call fcn.004063c1
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0xbc], 5
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
jmp 0x4060e9
mov ecx, dword [esp + 0xb4]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406236
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c73a8], 1
jne 0x406281
or dword [0x4c73a8], 1
mov dword [0x4c1854], 0x80d0320
mov dword [0x4c1858], 0x1e0e0520
mov dword [0x4c185c], 0x4c151e0d
mov dword [0x4c1860], 0x50d0a
mov dword [0x4c1864], 0x4c560809
mov byte [0x4c1868], 0x6c
mov cl, byte [eax + 0x4c1854]
xor cl, 0x6c
mov byte [eax + 0x4c1a54], cl
inc eax
cmp eax, 0x15
jb 0x406281
mov eax, 0x4c1a54
ret
Function at 0x40629c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c73a4], 1
jne 0x4062f1
or dword [0x4c73a4], 1
mov dword [0x4c186c], 0x193d1822
mov dword [0x4c1870], 0x25151e09
mov dword [0x4c1874], 0x1e030a02
mov dword [0x4c1878], 0x5180d01
mov dword [0x4c187c], 0x1e3c0203
mov dword [0x4c1880], 0x1f090f03
mov word [0x4c1884], 0x6c1f
xor eax, eax
mov cl, byte [eax + 0x4c186c]
xor cl, 0x6c
mov byte [eax + 0x4c1a6c], cl
inc eax
cmp eax, 0x1a
jb 0x4062f3
mov eax, 0x4c1a6c
ret

Function at 0x40630e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c73a0], 1
jne 0x4063a6
or dword [0x4c73a0], 1
mov dword [0x4c1888], 0x3c18092b
mov dword [0x4c188c], 0x2d0f031e
mov dword [0x4c1890], 0x91e0808
mov dword [0x4c1894], 0xa4c1f1f
mov dword [0x4c1898], 0x900050d
mov dword [0x4c189c], 0x22444c08
mov dword [0x4c18a0], 0x9193d18
mov dword [0x4c18a4], 0x225151e
mov dword [0x4c18a8], 0x11e030a
mov dword [0x4c18ac], 0x305180d
mov dword [0x4c18b0], 0x31e3c02
mov dword [0x4c18b4], 0x1f1f090f
mov dword [0x4c18b8], 0x6c4c5645
mov cl, byte [eax + 0x4c1888]
xor cl, 0x6c
mov byte [eax + 0x4c1a88], cl
inc eax
cmp eax, 0x34
jb 0x4063a6
mov eax, 0x4c1a88
ret

Function at 0x4063c1
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c739c], 1
jne 0x406433
or dword [0x4c739c], 1
mov dword [0x4c18bc], 0x193d1822
mov dword [0x4c18c0], 0x25151e09
mov dword [0x4c18c4], 0x1e030a02
mov dword [0x4c18c8], 0x5180d01
mov dword [0x4c18cc], 0x1e3c0203
mov dword [0x4c18d0], 0x1f090f03
mov dword [0x4c18d4], 0xd0a4c1f
mov dword [0x4c18d8], 0x8090005
mov word [0x4c18dc], 0x4c56
mov byte [0x4c18de], 0x6c
mov cl, byte [eax + 0x4c18bc]
xor cl, 0x6c
mov byte [eax + 0x4c1abc], cl
inc eax
cmp eax, 0x23
jb 0x406433
mov eax, 0x4c1abc
ret

Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7398], 1
jne 0x406499
or dword [0x4c7398], 1
mov dword [0x4c18e0], 0x2091c23
mov dword [0x4c18e4], 0xf031e3c
mov dword [0x4c18e8], 0x4c1f1f09
mov dword [0x4c18ec], 0x50d0a
mov dword [0x4c18f0], 0x4c560809
mov byte [0x4c18f4], 0x6c
mov cl, byte [eax + 0x4c18e0]
xor cl, 0x6c
mov byte [eax + 0x4c1ae0], cl
inc eax
cmp eax, 0x15
jb 0x406499
mov eax, 0x4c1ae0
ret
Function at 0x4064b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48df04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebx
xor ebx, ebx
test byte [0x4c7394], 1
push esi
push edi
mov dword [esp + 0x1c], ebx
jne 0x406513
or dword [0x4c7394], 1
mov dword [0x4c18f8], 0x21e0907
mov dword [0x4c18fc], 0x5e5f0009
mov dword [0x4c1900], 0x842
mov byte [0x4c1904], 0x6c
xor eax, eax
mov cl, byte [eax + 0x4c18f8]
xor cl, 0x6c
mov byte [eax + 0x4c1af8], cl
inc eax
cmp eax, 0xd
jb 0x406515
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x4c1af8
call edi
mov esi, eax
cmp esi, ebx
jne 0x406589
call dword [0x4950a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], ebx
call fcn.004066ea
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 1
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
push eax
call fcn.004706f5
call fcn.00406767
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
cmp eax, ebx
jne 0x406656
call fcn.004067da
push eax
call edi
mov edi, eax
cmp edi, ebx
jne 0x4065fa
call dword [0x4950a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], 2
call fcn.00406824
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 3
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
jmp 0x406583
call fcn.0040689e
push eax
push edi
call esi
cmp eax, ebx
jne 0x406656
call dword [0x4950a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], 4
call fcn.0040690e
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 5
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
jmp 0x406583
push 0x208
lea ecx, [esp + 0x5c]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x4066b8
call dword [0x4950a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0042dbd8
pop ecx
pop ecx
push eax
mov dword [esp + 0x270], 6
call fcn.004069c7
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00406a88
add esp, 0xc
lea esi, [esp + 0x10]
mov byte [esp + 0x26c], 7
call fcn.00405b6b
push 0x4b1d18
mov eax, esi
jmp 0x406583
mov esi, dword [ebp + 8]
lea eax, [esp + 0x58]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00404bff
mov ecx, dword [esp + 0x264]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4066ea
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7390], 1
jne 0x40674c
or dword [0x4c7390], 1
mov dword [0x4c1908], 0x80d0320
mov dword [0x4c190c], 0x1e0e0520
mov dword [0x4c1910], 0x4c151e0d
mov dword [0x4c1914], 0x50d0a
mov dword [0x4c1918], 0x444c0809
mov dword [0x4c191c], 0x21e0907
mov dword [0x4c1920], 0x5e5f0009
mov dword [0x4c1924], 0x6c4c5645
mov cl, byte [eax + 0x4c1908]
xor cl, 0x6c
mov byte [eax + 0x4c1b08], cl
inc eax
cmp eax, 0x20
jb 0x40674c
mov eax, 0x4c1b08
ret
Function at 0x406767
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c738c], 1
jne 0x4067bf
or dword [0x4c738c], 1
mov dword [0x4c1928], 0x2b5e5f27
mov dword [0x4c192c], 0x1e3c1809
mov dword [0x4c1930], 0x1f090f03
mov dword [0x4c1934], 0xd01251f
mov dword [0x4c1938], 0x52a090b
mov dword [0x4c193c], 0xd220900
mov dword [0x4c1940], 0x6c2d0901
mov cl, byte [eax + 0x4c1928]
xor cl, 0x6c
mov byte [eax + 0x4c1b28], cl
inc eax
cmp eax, 0x1c
jb 0x4067bf
mov eax, 0x4c1b28
ret

Function at 0x4067da
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7388], 1
jne 0x406809
or dword [0x4c7388], 1
mov dword [0x4c1944], 0x1c0d1f1c
mov dword [0x4c1948], 0x84205
mov word [0x4c194c], 0x6c00
mov cl, byte [eax + 0x4c1944]
xor cl, 0x6c
mov byte [eax + 0x4c1b44], cl
inc eax
cmp eax, 0xa
jb 0x406809
mov eax, 0x4c1b44
ret

Function at 0x406824
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7384], 1
jne 0x406883
or dword [0x4c7384], 1
mov dword [0x4c1950], 0x80d0320
mov dword [0x4c1954], 0x1e0e0520
mov dword [0x4c1958], 0x4c151e0d
mov dword [0x4c195c], 0x50d0a
mov dword [0x4c1960], 0x444c0809
mov dword [0x4c1964], 0x1c0d1f1c
mov dword [0x4c1968], 0x4c564505
mov byte [0x4c196c], 0x6c
mov cl, byte [eax + 0x4c1950]
xor cl, 0x6c
mov byte [eax + 0x4c1b50], cl
inc eax
cmp eax, 0x1d
jb 0x406883
mov eax, 0x4c1b50
ret

Function at 0x40689e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7380], 1
jne 0x4068f3
or dword [0x4c7380], 1
mov dword [0x4c1970], 0x3c18092b
mov dword [0x4c1974], 0x90f031e
mov dword [0x4c1978], 0x1251f1f
mov dword [0x4c197c], 0x2a090b0d
mov dword [0x4c1980], 0x22090005
mov dword [0x4c1984], 0x2d09010d
mov byte [0x4c1988], 0x6c
mov cl, byte [eax + 0x4c1970]
xor cl, 0x6c
mov byte [eax + 0x4c1b70], cl
inc eax
cmp eax, 0x19
jb 0x4068f3
mov eax, 0x4c1b70
ret

Function at 0x40690e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c737c], 1
jne 0x4069ac
or dword [0x4c737c], 1
mov dword [0x4c198c], 0x3c18092b
mov dword [0x4c1990], 0x2d0f031e
mov dword [0x4c1994], 0x91e0808
mov dword [0x4c1998], 0xa4c1f1f
mov dword [0x4c199c], 0x900050d
mov dword [0x4c19a0], 0x2b444c08
mov dword [0x4c19a4], 0x1e3c1809
mov dword [0x4c19a8], 0x1f090f03
mov dword [0x4c19ac], 0xd01251f
mov dword [0x4c19b0], 0x52a090b
mov dword [0x4c19b4], 0xd220900
mov dword [0x4c19b8], 0x452d0901
mov word [0x4c19bc], 0x4c56
mov byte [0x4c19be], 0x6c
mov cl, byte [eax + 0x4c198c]
xor cl, 0x6c
mov byte [eax + 0x4c1b8c], cl
inc eax
cmp eax, 0x33
jb 0x4069ac
mov eax, 0x4c1b8c
ret

Function at 0x4069c7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7378], 1
jne 0x406a30
or dword [0x4c7378], 1
mov dword [0x4c19c0], 0x3c18092b
mov dword [0x4c19c4], 0x90f031e
mov dword [0x4c19c8], 0x1251f1f
mov dword [0x4c19cc], 0x2a090b0d
mov dword [0x4c19d0], 0x2090005
mov dword [0x4c19d4], 0x4c09010d
mov dword [0x4c19d8], 0x50d0a
mov dword [0x4c19dc], 0x4c560809
mov byte [0x4c19e0], 0x6c
mov cl, byte [eax + 0x4c19c0]
xor cl, 0x6c
mov byte [eax + 0x4c1bc0], cl
inc eax
cmp eax, 0x21
jb 0x406a30
mov eax, 0x4c1bc0
ret
Function at 0x4075e1
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7374], 1
jne 0x4077c9
or dword [0x4c7374], 1
mov dword [0x4c1be8], 0x1e430204
mov dword [0x4c1bec], 0x18020919
mov dword [0x4c1bf0], 0x81e5719
mov dword [0x4c1bf4], 0x180f1b19
mov dword [0x4c1bf8], 0x34a450b
mov dword [0x4c1bfc], 0x67444a02
mov dword [0x4c1c00], 0x60e0c1d
mov dword [0x4c1c04], 0x43080a0c
mov dword [0x4c1c08], 0x5190c1d
mov dword [0x4c1c0c], 0x4a4d504d
mov dword [0x4c1c10], 0x81f674a
mov dword [0x4c1c14], 0x1f04181c
mov dword [0x4c1c18], 0x1e4a4508
mov dword [0x4c1c1c], 0xe041f19
mov dword [0x4c1c20], 0x67444a19
mov dword [0x4c1c24], 0xc0e0201
mov dword [0x4c1c28], 0x411e4d01
mov dword [0x4c1c2c], 0x504d1f4d
mov dword [0x4c1c30], 0xe1d154d
mov dword [0x4c1c34], 0x4501010c
mov dword [0x4c1c38], 0xe03180b
mov dword [0x4c1c3c], 0x3020419
mov dword [0x4c1c40], 0x1f4d4445
mov dword [0x4c1c44], 0x1f181908
mov dword [0x4c1c48], 0x81f4d03
mov dword [0x4c1c4c], 0x1f04181c
mov dword [0x4c1c50], 0x484a4508
mov dword [0x4c1c54], 0x43444a20
mov dword [0x4c1c58], 0x3040c00
mov dword [0x4c1c5c], 0xc323245
mov dword [0x4c1c60], 0x441e0a1f
mov dword [0x4c1c64], 0x903084d
mov dword [0x4c1c68], 0x8094d41
mov dword [0x4c1c6c], 0x430a180f
mov dword [0x4c1c70], 0xe0c1f19
mov dword [0x4c1c74], 0xe0c0f08
mov dword [0x4c1c78], 0x4674406
mov dword [0x4c1c7c], 0x2034d0b
mov dword [0x4c1c80], 0x4d1e4d19
mov dword [0x4c1c84], 0x3080519
mov dword [0x4c1c88], 0x1f1f084d
mov dword [0x4c1c8c], 0x1f451f02
mov dword [0x4c1c90], 0x3084d44
mov dword [0x4c1c94], 0x81f6709
mov dword [0x4c1c98], 0x31f1819
mov word [0x4c1c9c], 0x1f4d
mov byte [0x4c1c9e], 0x6d
mov cl, byte [eax + 0x4c1be8]
xor cl, 0x6d
mov byte [eax + 0x4c2318], cl
inc eax
cmp eax, 0xb7
jb 0x4077c9
mov eax, 0x4c2318
ret