joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4090da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82e4], 1
jne 0x4090fd
or dword [0x4c82e4], 1
mov dword [0x4c3014], 0x838b88cb
mov word [0x4c3018], 0xe4cb
xor eax, eax
mov cl, byte [eax + 0x4c3014]
xor cl, 0xe4
mov byte [eax + 0x4c3744], cl
inc eax
cmp eax, 6
jb 0x4090ff
mov eax, 0x4c3744
ret

Function at 0x40911a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82e0], 1
jne 0x409195
or dword [0x4c82e0], 1
mov dword [0x4c301c], 0x9490908c
mov dword [0x4c3020], 0x85cbcbde
mov dword [0x4c3024], 0x9d88858a
mov dword [0x4c3028], 0x97878d90
mov dword [0x4c302c], 0x908183ca
mov dword [0x4c3030], 0x8a938b80
mov dword [0x4c3034], 0x90978190
mov dword [0x4c3038], 0x898b87ca
mov dword [0x4c303c], 0xcbd692cb
mov dword [0x4c3040], 0xcb838b88
mov byte [0x4c3044], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c301c]
xor cl, 0xe4
mov byte [eax + 0x4c374c], cl
inc eax
cmp eax, 0x29
jb 0x409197
mov eax, 0x4c374c
ret

Function at 0x4091b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82dc], 1
jne 0x4091dd
or dword [0x4c82dc], 1
mov dword [0x4c3048], 0x97c2d987
mov dword [0x4c304c], 0xd990c2d9
mov byte [0x4c3050], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c3048]
xor cl, 0xe4
mov byte [eax + 0x4c3778], cl
inc eax
cmp eax, 9
jb 0x4091df
mov eax, 0x4c3778
ret

Function at 0x4091fa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82cc], 1
jne 0x409282
or dword [0x4c82cc], 1
mov dword [0x4c3064], 0x908a8ba7
mov dword [0x4c3068], 0xc9908a81
mov dword [0x4c306c], 0x81949db0
mov dword [0x4c3070], 0x9485c4de
mov dword [0x4c3074], 0x878d8894
mov dword [0x4c3078], 0x8b8d9085
mov dword [0x4c307c], 0xc99ccb8a
mov dword [0x4c3080], 0xc9939393
mov dword [0x4c3084], 0x89968b82
mov dword [0x4c3088], 0x889691c9
mov dword [0x4c308c], 0x8b878a81
mov dword [0x4c3090], 0xe4808180
xor eax, eax
mov cl, byte [eax + 0x4c3064]
xor cl, 0xe4
mov byte [eax + 0x4c3794], cl
inc eax
cmp eax, 0x30
jb 0x409284
mov eax, 0x4c3794
ret

Function at 0x40929f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82c8], 1
jne 0x4092ca
or dword [0x4c82c8], 1
mov dword [0x4c3094], 0xb0b7abb4
mov dword [0x4c3098], 0xc48b90c4
mov byte [0x4c309c], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c3094]
xor cl, 0xe4
mov byte [eax + 0x4c37c4], cl
inc eax
cmp eax, 9
jb 0x4092cc
mov eax, 0x4c37c4
ret

Function at 0x4092e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82c4], 1
jne 0x409330
or dword [0x4c82c4], 1
mov dword [0x4c30a0], 0x8d8582c4
mov dword [0x4c30a4], 0xc4808188
mov dword [0x4c30a8], 0x8c908d93
mov dword [0x4c30ac], 0x859097c4
mov dword [0x4c30b0], 0xc4979190
mov byte [0x4c30b4], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c30a0]
xor cl, 0xe4
mov byte [eax + 0x4c37d0], cl
inc eax
cmp eax, 0x15
jb 0x409332
mov eax, 0x4c37d0
ret
Function at 0x409c74
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c829c], 1
jne 0x409cd0
or dword [0x4c829c], 1
mov dword [0x4c3120], 0x888d85a2
mov dword [0x4c3124], 0x90c48081
mov dword [0x4c3128], 0x8196c48b
mov dword [0x4c312c], 0x8bc48085
mov dword [0x4c3130], 0x8bc49691
mov dword [0x4c3134], 0x81c48a93
mov word [0x4c3138], 0x819c
mov byte [0x4c313a], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c3120]
xor cl, 0xe4
mov byte [eax + 0x4c3850], cl
inc eax
cmp eax, 0x1b
jb 0x409cd2
mov eax, 0x4c3850
ret

Function at 0x409d4e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8298], 1
jne 0x409d9a
or dword [0x4c8298], 1
mov dword [0x4c313c], 0xa89081a3
mov dword [0x4c3140], 0xad909785
mov dword [0x4c3144], 0x9091948a
mov dword [0x4c3148], 0x8b828aad
mov dword [0x4c314c], 0x8d8582c4
mov dword [0x4c3150], 0xe4808188
xor eax, eax
mov cl, byte [eax + 0x4c313c]
xor cl, 0xe4
mov byte [eax + 0x4c386c], cl
inc eax
cmp eax, 0x18
jb 0x409d9c
mov eax, 0x4c386c
ret

Function at 0x40a0ae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8294], 1
mov ecx, 0xd1e4
jne 0x40a113
or dword [0x4c8294], 1
lea eax, [ecx - 0x58]
mov word [0x4c3154], ax
add eax, 4
mov edx, eax
mov word [0x4c3158], ax
lea eax, [ecx - 0x50]
mov word [0x4c315a], ax
add eax, 3
mov word [0x4c315c], ax
lea eax, [ecx - 6]
mov word [0x4c315e], ax
add eax, 0xffffffed
mov word [0x4c3156], dx
mov edx, eax
mov word [0x4c3162], ax
mov eax, ecx
mov word [0x4c3160], dx
mov word [0x4c3164], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c3154]
add eax, 2
mov word [eax + 0x4c3882], dx
cmp eax, 0x12
jb 0x40a115
mov eax, 0x4c3884
ret

Function at 0x40a133
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8290], 1
mov ecx, 0xd1e4
jne 0x40a18f
or dword [0x4c8290], 1
lea eax, [ecx - 0x58]
mov word [0x4c3168], ax
add eax, 4
mov edx, eax
mov word [0x4c316c], ax
lea eax, [ecx - 0x50]
mov word [0x4c316e], ax
add eax, 0x4a
mov word [0x4c3170], ax
lea eax, [ecx - 0x19]
mov word [0x4c316a], dx
mov edx, eax
mov word [0x4c3174], ax
mov eax, ecx
mov word [0x4c3172], dx
mov word [0x4c3176], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c3168]
add eax, 2
mov word [eax + 0x4c3896], dx
cmp eax, 0x10
jb 0x40a191
mov eax, 0x4c3898
ret

Function at 0x40a1af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8288], 1
jne 0x40a1f8
or dword [0x4c8288], 1
mov dword [0x4c3184], 0xa3978aa0
mov dword [0x4c3188], 0x85a79081
mov dword [0x4c318c], 0xa0818c87
mov dword [0x4c3190], 0xb0859085
mov dword [0x4c3194], 0x81888685
mov byte [0x4c3198], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c3184]
xor cl, 0xe4
mov byte [eax + 0x4c38b4], cl
inc eax
cmp eax, 0x15
jb 0x40a1fa
mov eax, 0x4c38b4
ret
Function at 0x40aae0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8284], 1
mov ecx, 0xd1e4
jne 0x40ab6a
or dword [0x4c8284], 1
lea eax, [ecx - 0x5d]
mov word [0x4c319c], ax
add eax, 0xf
mov edx, eax
mov word [0x4c319e], dx
lea edx, [ecx - 0x5f]
mov word [0x4c31a0], dx
add edx, 0x12
mov word [0x4c31a2], dx
lea edx, [ecx - 0x58]
mov word [0x4c31a4], dx
add edx, 0x2f
mov word [0x4c31a6], dx
mov edx, eax
mov word [0x4c31a8], dx
lea edx, [ecx - 0x63]
lea eax, [ecx - 0x54]
mov word [0x4c31aa], dx
mov word [0x4c31b2], ax
add edx, 0x13
mov eax, ecx
mov word [0x4c31ac], dx
mov dword [0x4c31ae], 0xd196d18b
mov word [0x4c31b4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c319c]
add eax, 2
mov word [eax + 0x4c38ca], dx
cmp eax, 0x1a
jb 0x40ab6c
mov eax, 0x4c38cc
ret

Function at 0x40ab8a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8280], 1
jne 0x40ac04
or dword [0x4c8280], 1
mov dword [0x4c31b8], 0x96968bb7
mov dword [0x4c31bc], 0x90c4c89d
mov dword [0x4c31c0], 0xc4978d8c
mov dword [0x4c31c4], 0x90828b97
mov dword [0x4c31c8], 0x81968593
mov dword [0x4c31cc], 0xc4978dc4
mov dword [0x4c31d0], 0xc4908b8a
mov dword [0x4c31d4], 0x8d859285
mov dword [0x4c31d8], 0x88868588
mov word [0x4c31dc], 0xca81
mov byte [0x4c31de], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c31b8]
xor cl, 0xe4
mov byte [eax + 0x4c38e8], cl
inc eax
cmp eax, 0x27
jb 0x40ac06
mov eax, 0x4c38e8
ret

Function at 0x40ac21
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c827c], 1
jne 0x40ac44
or dword [0x4c827c], 1
mov dword [0x4c31e0], 0x8b9696a1
mov word [0x4c31e4], 0xe496
xor eax, eax
mov cl, byte [eax + 0x4c31e0]
xor cl, 0xe4
mov byte [eax + 0x4c3910], cl
inc eax
cmp eax, 6
jb 0x40ac46
mov eax, 0x4c3910
ret

Function at 0x40ac61
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8278], 1
jne 0x40acdb
or dword [0x4c8278], 1
mov dword [0x4c31e8], 0x96968bb7
mov dword [0x4c31ec], 0x90c4c89d
mov dword [0x4c31f0], 0xc4978d8c
mov dword [0x4c31f4], 0x90828b97
mov dword [0x4c31f8], 0x81968593
mov dword [0x4c31fc], 0xc4978dc4
mov dword [0x4c3200], 0xc4908b8a
mov dword [0x4c3204], 0x8d859285
mov dword [0x4c3208], 0x88868588
mov word [0x4c320c], 0xca81
mov byte [0x4c320e], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c31e8]
xor cl, 0xe4
mov byte [eax + 0x4c3918], cl
inc eax
cmp eax, 0x27
jb 0x40acdd
mov eax, 0x4c3918
ret

Function at 0x40acf8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8274], 1
jne 0x40ad1b
or dword [0x4c8274], 1
mov dword [0x4c3210], 0x8b9696a1
mov word [0x4c3214], 0xe496
xor eax, eax
mov cl, byte [eax + 0x4c3210]
xor cl, 0xe4
mov byte [eax + 0x4c3940], cl
inc eax
cmp eax, 6
jb 0x40ad1d
mov eax, 0x4c3940
ret
Function at 0x40ad38
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8270], 1
jne 0x40ad8e
or dword [0x4c8270], 1
mov dword [0x4c3218], 0xc48188ab
mov dword [0x4c321c], 0x908d8a8d
mov dword [0x4c3220], 0x8d88858d
mov dword [0x4c3224], 0x8d90859e
mov dword [0x4c3228], 0x82c48a8b
mov dword [0x4c322c], 0x81888d85
mov dword [0x4c3230], 0xe4c4de80
xor eax, eax
mov cl, byte [eax + 0x4c3218]
xor cl, 0xe4
mov byte [eax + 0x4c3948], cl
inc eax
cmp eax, 0x1c
jb 0x40ad90
mov eax, 0x4c3948
ret

Function at 0x40adab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c826c], 1
jne 0x40add6
or dword [0x4c826c], 1
mov dword [0x4c3234], 0x8a96818f
mov dword [0x4c3238], 0xd6d78881
mov byte [0x4c323c], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c3234]
xor cl, 0xe4
mov byte [eax + 0x4c3964], cl
inc eax
cmp eax, 9
jb 0x40add8
mov eax, 0x4c3964
ret

Function at 0x40adf3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8268], 1
jne 0x40ae5c
or dword [0x4c8268], 1
mov dword [0x4c3240], 0xb49081b7
mov dword [0x4c3244], 0x81878b96
mov dword [0x4c3248], 0x97b19797
mov dword [0x4c324c], 0x8ba99681
mov dword [0x4c3250], 0x9ca18180
mov dword [0x4c3254], 0x90948187
mov dword [0x4c3258], 0xb48a8b8d
mov dword [0x4c325c], 0x878d888b
mov word [0x4c3260], 0xe49d
xor eax, eax
mov cl, byte [eax + 0x4c3240]
xor cl, 0xe4
mov byte [eax + 0x4c3970], cl
inc eax
cmp eax, 0x22
jb 0x40ae5e
mov eax, 0x4c3970
ret

Function at 0x40ae79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8264], 1
jne 0x40aee2
or dword [0x4c8264], 1
mov dword [0x4c3264], 0xb49081a3
mov dword [0x4c3268], 0x81878b96
mov dword [0x4c326c], 0x97b19797
mov dword [0x4c3270], 0x8ba99681
mov dword [0x4c3274], 0x9ca18180
mov dword [0x4c3278], 0x90948187
mov dword [0x4c327c], 0xb48a8b8d
mov dword [0x4c3280], 0x878d888b
mov word [0x4c3284], 0xe49d
xor eax, eax
mov cl, byte [eax + 0x4c3264]
xor cl, 0xe4
mov byte [eax + 0x4c3994], cl
inc eax
cmp eax, 0x22
jb 0x40aee4
mov eax, 0x4c3994
ret

Function at 0x40aeff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8260], 1
mov ecx, 0xd1e4
jne 0x40af2e
or dword [0x4c8260], 1
lea eax, [ecx - 0x5f]
mov word [0x4c3288], ax
add eax, 0x51
mov word [0x4c328a], ax
mov eax, ecx
mov word [0x4c328c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c3288]
add eax, 2
mov word [eax + 0x4c39b6], dx
cmp eax, 6
jb 0x40af30
mov eax, 0x4c39b8
ret

Function at 0x40af4e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8258], 1
jne 0x40afbe
or dword [0x4c8258], 1
mov dword [0x4c3298], 0x888d85a2
mov dword [0x4c329c], 0x90c48081
mov dword [0x4c32a0], 0x8a8dc48b
mov dword [0x4c32a4], 0x858d908d
mov dword [0x4c32a8], 0x819e8d88
mov dword [0x4c32ac], 0x928a81c4
mov dword [0x4c32b0], 0x8a8b968d
mov dword [0x4c32b4], 0x908a8189
mov word [0x4c32b8], 0xc4de
mov byte [0x4c32ba], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c3298]
xor cl, 0xe4
mov byte [eax + 0x4c39c8], cl
inc eax
cmp eax, 0x23
jb 0x40afc0
mov eax, 0x4c39c8
ret
Function at 0x40afdd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8250], 1
mov ecx, 0xd1e4
jne 0x40b027
or dword [0x4c8250], 1
lea eax, [ecx - 0x63]
mov word [0x4c32c4], ax
add eax, 9
mov word [0x4c32c6], ax
lea eax, [ecx - 0x54]
mov word [0x4c32c8], ax
add eax, 6
mov word [0x4c32ca], ax
lea eax, [ecx - 0x47]
mov word [0x4c32cc], ax
mov eax, ecx
mov word [0x4c32ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c32c4]
add eax, 2
mov word [eax + 0x4c39f2], dx
cmp eax, 0xc
jb 0x40b029
mov eax, 0x4c39f4
ret

Function at 0x40b047
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c824c], 1
jne 0x40b092
or dword [0x4c824c], 1
mov dword [0x4c32d0], 0x858c8ab1
mov dword [0x4c32d4], 0x8188808a
mov dword [0x4c32d8], 0x9c81c480
mov dword [0x4c32dc], 0x90948187
mov dword [0x4c32e0], 0xde8a8b8d
mov word [0x4c32e4], 0xe4c4
xor eax, eax
mov cl, byte [eax + 0x4c32d0]
xor cl, 0xe4
mov byte [eax + 0x4c3a00], cl
inc eax
cmp eax, 0x16
jb 0x40b094
mov eax, 0x4c3a00
ret

Function at 0x40b0af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8248], 1
jne 0x40b102
or dword [0x4c8248], 1
mov dword [0x4c32e8], 0x858c8ab1
mov dword [0x4c32ec], 0x8188808a
mov dword [0x4c32f0], 0x9c81c480
mov dword [0x4c32f4], 0x90948187
mov dword [0x4c32f8], 0xde8a8b8d
mov dword [0x4c32fc], 0xee97c1c4
mov byte [0x4c3300], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c32e8]
xor cl, 0xe4
mov byte [eax + 0x4c3a18], cl
inc eax
cmp eax, 0x19
jb 0x40b104
mov eax, 0x4c3a18
ret

Function at 0x40b11f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8244], 1
jne 0x40b157
or dword [0x4c8244], 1
mov dword [0x4c3304], 0x869190b7
mov dword [0x4c3308], 0x8d9c81c4
mov dword [0x4c330c], 0xc1ccc490
mov dword [0x4c3310], 0xe4eecd80
xor eax, eax
mov cl, byte [eax + 0x4c3304]
xor cl, 0xe4
mov byte [eax + 0x4c3a34], cl
inc eax
cmp eax, 0x10
jb 0x40b159
mov eax, 0x4c3a34
ret
Function at 0x40d0cd
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x48db0b
call fcn.0048cc68
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40d1b1
cmp byte [edi + 0x49], bl
je 0x40d1b1
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40d104
xor al, al
jmp 0x40d1b3
push esi
lea esi, [ebp - 0x2c]
call fcn.0040ca72
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40d154
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x40d159
dec eax
je 0x40d15d
dec eax
dec eax
je 0x40d1ad
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404dee
mov al, bl
pop esi
jmp 0x40d1b3
mov edx, dword [ebp - 0x2c]
jmp 0x40d11e
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40d169
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x40d18f
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40d17c
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0046887f
add esp, 0x10
cmp esi, eax
jne 0x40d141
cmp byte [edi + 0x49], 0
je 0x40d1ad
test esi, esi
jne 0x40d110
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0040cb4b
jmp 0x40d110
mov bl, 1
jmp 0x40d143
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41293d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8240], 1
jne 0x4129b1
or dword [0x4c8240], 1
mov dword [0x4c3a54], 0x8b9288a4
mov dword [0x4c3a58], 0x8889c783
mov dword [0x4c3a5c], 0x8280c793
mov dword [0x4c3a60], 0x8e83c793
mov dword [0x4c3a64], 0x838e9794
mov dword [0x4c3a68], 0xc78188c7
mov dword [0x4c3a6c], 0x8f93828a
mov dword [0x4c3a70], 0xc0c78388
mov dword [0x4c3a74], 0x8b8b8684
mov dword [0x4c3a78], 0xe7c7ddc0
xor eax, eax
mov cl, byte [eax + 0x4c3a54]
xor cl, 0xe7
mov byte [eax + 0x4c3b98], cl
inc eax
cmp eax, 0x28
jb 0x4129b3
mov eax, 0x4c3b98
ret

Function at 0x4129ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c823c], 1
jne 0x412a35
or dword [0x4c823c], 1
mov dword [0x4c3a7c], 0x8b8e86a1
mov dword [0x4c3a80], 0x93c78382
mov dword [0x4c3a84], 0x898ec788
mov dword [0x4c3a88], 0x828c8891
mov dword [0x4c3a8c], 0x93828ac7
mov dword [0x4c3a90], 0xc783888f
mov dword [0x4c3a94], 0x8b8684c0
mov dword [0x4c3a98], 0xc7ddc08b
mov byte [0x4c3a9c], 0xe7
xor eax, eax
mov cl, byte [eax + 0x4c3a7c]
xor cl, 0xe7
mov byte [eax + 0x4c3bc0], cl
inc eax
cmp eax, 0x21
jb 0x412a37
mov eax, 0x4c3bc0
ret
Function at 0x412a52
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8238], 1
jne 0x412ab2
or dword [0x4c8238], 1
mov dword [0x4c3aa0], 0x8895b7ed
mov dword [0x4c3aa4], 0x8b858685
mov dword [0x4c3aa8], 0x9283c79e
mov dword [0x4c3aac], 0x8893c782
mov dword [0x4c3ab0], 0x958494c7
mov dword [0x4c3ab4], 0xc793978e
mov dword [0x4c3ab8], 0x88959582
mov dword [0x4c3abc], 0xe7c7dd95
xor eax, eax
mov cl, byte [eax + 0x4c3aa0]
xor cl, 0xe7
mov byte [eax + 0x4c3be4], cl
inc eax
cmp eax, 0x20
jb 0x412ab4
mov eax, 0x4c3be4
ret

Function at 0x41307a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x4131bf
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x4c8234], 1
jne 0x4130dc
or dword [0x4c8234], 1
mov eax, 0xd194
mov word [0x4c3ac0], ax
add eax, 0xffffffee
mov word [0x4c3ac2], ax
mov eax, 0xd189
mov word [0x4c3ac4], ax
add eax, 0xfffffffa
mov word [0x4c3ac6], ax
mov eax, 0xd1e7
mov word [0x4c3ac8], ax
xor eax, eax
mov ecx, 0xd1e7
xor cx, word [eax + 0x4c3ac0]
add eax, 2
mov word [eax + 0x4c3c02], cx
cmp eax, 0xa
jb 0x4130de
mov eax, dword [ebx + edi]
mov ecx, 0x4c3c04
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413125
test dx, dx
je 0x413121
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413125
add eax, esi
add ecx, esi
test dx, dx
jne 0x413101
xor eax, eax
jmp 0x41312a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x413136
mov dword [edi], 0x385
jmp 0x4131ae
call fcn.004131cf
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x413162
test dx, dx
je 0x41315e
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x413162
add ecx, esi
add eax, esi
test dx, dx
jne 0x41313e
xor eax, eax
jmp 0x413167
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x413173
mov dword [edi], 0x386
jmp 0x4131ae
call fcn.004132a2
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41319f
test dx, dx
je 0x41319b
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41319f
add ecx, esi
add eax, esi
test dx, dx
jne 0x41317b
xor eax, eax
jmp 0x4131a4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4131c8
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x413099
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x4131c1
Function at 0x4131cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8230], 1
jne 0x41327f
or dword [0x4c8230], 1
mov eax, 0xd186
mov word [0x4c3acc], ax
add eax, 0xfffffffd
mov ecx, eax
mov word [0x4c3ad0], ax
mov eax, 0xd1a2
mov word [0x4c3ad2], ax
add eax, 0xffffffef
mov word [0x4c3ad4], ax
mov eax, 0xd182
mov word [0x4c3ace], cx
mov ecx, eax
lea edx, [eax + 7]
mov word [0x4c3ad6], cx
mov ecx, edx
push edi
mov word [0x4c3ad8], cx
add ecx, 0xa
mov edi, ecx
mov word [0x4c3ada], di
lea edi, [eax + 0x29]
mov word [0x4c3adc], di
add edi, 0xffffffe3
mov ecx, eax
add eax, 0x13
mov word [0x4c3aea], ax
lea eax, [ecx + 0x65]
mov word [0x4c3ade], di
mov dword [0x4c3ae0], 0xd193d194
mov word [0x4c3ae4], cx
mov dword [0x4c3ae6], 0xd182d189
mov word [0x4c3aec], ax
pop edi
xor eax, eax
mov ecx, 0xd1e7
xor cx, word [eax + 0x4c3acc]
add eax, 2
mov word [eax + 0x4c3c0e], cx
cmp eax, 0x22
jb 0x413281
mov eax, 0x4c3c10
ret

Function at 0x4132a2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c822c], 1
mov ecx, 0xd1e7
jne 0x4132fc
or dword [0x4c822c], 1
lea eax, [ecx - 0x56]
mov word [0x4c3af0], ax
add eax, 0xfffffff1
mov word [0x4c3af2], ax
lea eax, [ecx - 0x52]
mov word [0x4c3af4], ax
dec eax
mov word [0x4c3af6], ax
lea eax, [ecx - 0x59]
mov word [0x4c3af8], ax
add eax, 0xfffffffa
mov word [0x4c3afa], ax
lea eax, [ecx - 0x5e]
mov word [0x4c3afc], ax
mov eax, ecx
mov word [0x4c3afe], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c3af0]
add eax, 2
mov word [eax + 0x4c3c32], dx
cmp eax, 0x10
jb 0x4132fe
mov eax, 0x4c3c34
ret

Function at 0x413c6f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8228], 1
mov edx, 0xd1e7
jne 0x413cd2
or dword [0x4c8228], 1
lea ecx, [edx - 0x65]
mov eax, ecx
mov word [0x4c3b00], ax
add eax, 0x13
push esi
mov esi, eax
lea eax, [edx - 0x3c]
mov word [0x4c3b0a], ax
add eax, 0xffffffe3
mov word [0x4c3b0c], ax
mov eax, edx
mov word [0x4c3b02], si
mov word [0x4c3b04], si
mov dword [0x4c3b06], 0xd195d188
mov dword [0x4c3b0e], 0xd182d189
mov word [0x4c3b12], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c3b00]
add eax, 2
mov word [eax + 0x4c3c42], cx
cmp eax, 0x14
jb 0x413cd4
mov eax, 0x4c3c44
ret

Function at 0x413cf2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8224], 1
jne 0x413d8e
or dword [0x4c8224], 1
mov edx, 0xd182
mov eax, edx
mov word [0x4c3b14], ax
add eax, 0x13
mov ecx, eax
mov word [0x4c3b16], cx
mov word [0x4c3b18], cx
lea ecx, [edx + 6]
mov word [0x4c3b1a], cx
mov ecx, eax
mov word [0x4c3b1c], cx
lea ecx, [edx + 0x22]
mov word [0x4c3b1e], cx
add ecx, 0xffffffeb
mov word [0x4c3b20], cx
lea ecx, [edx + 4]
push edi
mov edi, ecx
mov word [0x4c3b22], di
mov edi, eax
mov word [0x4c3b26], cx
mov word [0x4c3b2e], ax
add ecx, 0xfffffffe
lea eax, [edx + 0x65]
mov word [0x4c3b24], di
mov word [0x4c3b28], cx
mov dword [0x4c3b2a], 0xd182d193
mov word [0x4c3b30], ax
pop edi
xor eax, eax
mov ecx, 0xd1e7
xor cx, word [eax + 0x4c3b14]
add eax, 2
mov word [eax + 0x4c3c56], cx
cmp eax, 0x1e
jb 0x413d90
mov eax, 0x4c3c58
ret
Function at 0x413db1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8220], 1
jne 0x413e12
or dword [0x4c8220], 1
mov edx, 0xd182
mov eax, edx
mov word [0x4c3b34], ax
add eax, 0x13
mov ecx, eax
mov word [0x4c3b36], cx
mov word [0x4c3b38], cx
push edi
lea ecx, [edx + 6]
mov edi, ecx
mov word [0x4c3b3c], ax
lea eax, [edx + 0x65]
mov word [0x4c3b3a], di
mov dword [0x4c3b3e], 0xd188d1a4
mov dword [0x4c3b42], 0xd182d183
mov word [0x4c3b46], ax
pop edi
xor eax, eax
mov ecx, 0xd1e7
xor cx, word [eax + 0x4c3b34]
add eax, 2
mov word [eax + 0x4c3c76], cx
cmp eax, 0x14
jb 0x413e14
mov eax, 0x4c3c78
ret

Function at 0x413e35
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c821c], 1
mov edx, 0xd1e7
jne 0x413eb2
or dword [0x4c821c], 1
lea ecx, [edx - 0x65]
mov eax, ecx
mov word [0x4c3b48], ax
add eax, 0x13
push esi
mov esi, eax
lea eax, [edx - 0x3d]
mov word [0x4c3b52], ax
mov eax, ecx
mov word [0x4c3b54], ax
add eax, 0x12
mov word [0x4c3b4a], si
mov word [0x4c3b4c], si
mov esi, eax
mov word [0x4c3b58], ax
lea eax, [edx - 0x61]
mov word [0x4c3b5a], ax
mov eax, edx
mov word [0x4c3b56], si
mov dword [0x4c3b4e], 0xd195d188
mov dword [0x4c3b5c], 0xd182d180
mov word [0x4c3b60], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c3b48]
add eax, 2
mov word [eax + 0x4c3c8a], cx
cmp eax, 0x1a
jb 0x413eb4
mov eax, 0x4c3c8c
ret

Function at 0x413ed2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8218], 1
mov ecx, 0xd1e7
jne 0x413f31
or dword [0x4c8218], 1
lea eax, [ecx - 0x65]
mov word [0x4c3b64], ax
add eax, 0x13
mov edx, eax
mov word [0x4c3b66], dx
mov word [0x4c3b68], dx
lea edx, [ecx - 0x5f]
mov word [0x4c3b6a], dx
mov edx, eax
lea eax, [ecx - 0x5c]
mov word [0x4c3b72], ax
mov eax, ecx
mov word [0x4c3b6c], dx
mov dword [0x4c3b6e], 0xd195d1b2
mov word [0x4c3b74], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c3b64]
add eax, 2
mov word [eax + 0x4c3ca6], dx
cmp eax, 0x12
jb 0x413f33
mov eax, 0x4c3ca8
ret

Function at 0x4145d6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8214], 1
jne 0x414600
or dword [0x4c8214], 1
mov dword [0x4c3b78], 0x8b9289db
mov word [0x4c3b7c], 0xd98b
mov byte [0x4c3b7e], 0xe7
xor eax, eax
mov cl, byte [eax + 0x4c3b78]
xor cl, 0xe7
mov byte [eax + 0x4c3cbc], cl
inc eax
cmp eax, 7
jb 0x414602
mov eax, 0x4c3cbc
ret

Function at 0x41461d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8210], 1
jne 0x414647
or dword [0x4c8210], 1
mov dword [0x4c3b80], 0x8b9289db
mov word [0x4c3b84], 0xd98b
mov byte [0x4c3b86], 0xe7
xor eax, eax
mov cl, byte [eax + 0x4c3b80]
xor cl, 0xe7
mov byte [eax + 0x4c3cc4], cl
inc eax
cmp eax, 7
jb 0x414649
mov eax, 0x4c3cc4
ret

Function at 0x414664
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8208], 1
jne 0x414688
or dword [0x4c8208], 1
mov dword [0x4c3b8c], 0x8884bcc7
mov dword [0x4c3b90], 0xe7da8283
xor eax, eax
mov cl, byte [eax + 0x4c3b8c]
xor cl, 0xe7
mov byte [eax + 0x4c3cd0], cl
inc eax
cmp eax, 8
jb 0x41468a
mov eax, 0x4c3cd0
ret