joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403008]
cmp eax, 0
jne 0x401021
mov eax, dword [0x40300c]
cmp eax, 0
jne 0x401021
jmp 0x4010b6
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401021
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jl 0x401021
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401021
mov eax, dword [0x403008]
cmp eax, 0
je 0x401093
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401067
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
je 0x401021
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
je 0x401067
mov eax, dword [0x40300c]
cmp eax, 0
je 0x4010b6
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401093
cmp eax, dword [ebp - 0x14]
je 0x401093
push dword [0x403000]
mov eax, 0x40301a
mov ebx, 0x40322a
sub ebx, eax
push ebx
push 0x40301a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
push dword [0x403004]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push dword [eax]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
cmp al, 0x2d
int 0
add byte [esp + ecx - 0x43ffff30], bh
invalid

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40116f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40121c
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x4011c3
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x40120b
mov esi, dword [ebp - 4]
jns 0x4011ea
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4011fa
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x4011cc
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x4011a3
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401235
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 8]
add ebx, ecx
add ebx, dword [ebp + 8]
cmp dword [eax + 0x10], edi
cmovb edi, dword [eax + 0x10]
sub edi, dword [ebp + 8]
cmp edi, 1
jbe 0x401284
lea eax, [ebp + 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x401024]
mov edx, edi
mov ecx, ebx
call fcn.00401048
pop ecx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ebp
ret
Function at 0x401288
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
xor edx, edx
mov ecx, edi
mov ebx, dword [edi + 0x3c]
add ebx, edi
mov dword [ebp - 4], ebx
movzx esi, word [ebx + 0x14]
add esi, 0x18
add esi, ebx
sub eax, dword [0x40101c]
mov dword [ebp - 0x10], eax
sbb edx, edx
mov dword [ebp - 0x14], esi
neg eax
mov dword [ebp - 0xc], edx
adc edx, 0
neg edx
push edx
mov edx, dword [ebx + 0xa0]
push eax
mov eax, dword [esi + 0xc]
add eax, dword [0x401028]
push eax
push dword [ebx + 0xa4]
call fcn.004010ab
push esi
push dword [0x401028]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esp, 0x18
add esi, 0x28
cmp eax, 1
jbe 0x40131b
push esi
push dword [0x40102c]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 2
jbe 0x401338
push esi
push dword [0x401030]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 3
jbe 0x401355
push esi
push dword [0x401034]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 4
jbe 0x401372
push esi
push dword [0x401038]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 5
jbe 0x40138f
push esi
push dword [0x40103c]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 6
jbe 0x4013ac
push esi
push dword [0x401040]
mov ecx, edi
call fcn.00401235
mov eax, dword [0x401020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 7
jbe 0x4013c1
push esi
push dword [0x401044]
mov ecx, edi
call fcn.00401235
pop ecx
pop ecx
cmp dword [0x401014], 0
je 0x40140a
add ebx, 0x88
cmp dword [ebx], 0
je 0x401407
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 8
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x401014]
mov dword [ebx], eax
mov eax, dword [0x401018]
mov dword [ecx + 0x8c], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push ebx
call esi
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0xc]
mov edx, dword [ebx + 0xa0]
push dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [0x401028]
push eax
push dword [ebx + 0xa4]
call fcn.004010ab
mov edx, dword [0x401004]
add esp, 0x10
push dword [0x401010]
push dword [0x40100c]
push ecx
mov ecx, edi
call fcn.0040116f
mov eax, dword [section..text]
add esp, 0xc
add eax, edi
call eax
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40253b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c74dc], 1
mov ecx, 0x856a
jne 0x4025c2
or dword [0x4c74dc], 1
lea eax, [ecx - 0x1b]
mov edx, eax
add eax, 0xffffffe7
mov word [0x4c0a98], ax
mov word [0x4c0a8c], dx
add edx, 0xffffffef
lea eax, [ecx - 0x5c]
mov word [0x4c0a9a], ax
add eax, 0x11
mov word [0x4c0a9c], ax
mov word [0x4c0a8e], dx
lea edx, [ecx - 0x3b]
lea eax, [ecx - 0x63]
mov word [0x4c0a9e], ax
mov word [0x4c0a90], dx
add edx, 0xfffffff8
add eax, 0x13
mov word [0x4c0aa0], ax
lea eax, [ecx - 0x35]
mov word [0x4c0aa2], ax
mov eax, ecx
mov word [0x4c0a92], dx
mov dword [0x4c0a94], 0x854f853a
mov word [0x4c0aa4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c0a8c]
add eax, 2
mov word [eax + 0x4c1136], dx
cmp eax, 0x1a
jb 0x4025c4
mov eax, 0x4c1138
ret

Function at 0x4025e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c74d4], 1
jne 0x402610
or dword [0x4c74d4], 1
mov dword [0x4c0ab4], 0xe050756
mov dword [0x4c0ab8], 0x550f061f
mov dword [0x4c0abc], 0x6a545555
xor eax, eax
mov cl, byte [eax + 0x4c0ab4]
xor cl, 0x6a
mov byte [eax + 0x4c1160], cl
inc eax
cmp eax, 0xc
jb 0x402612
mov eax, 0x4c1160
ret

Function at 0x40262d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c74d0], 1
mov edx, 0x856a
jne 0x4026ed
push esi
lea ecx, [edx - 0x22]
mov eax, ecx
mov word [0x4c0ac0], ax
add eax, 2
or dword [0x4c74d0], 1
mov word [0x4c0ac2], ax
lea eax, [edx - 0x23]
mov esi, eax
mov word [0x4c0ac4], si
mov word [0x4c0ac6], ax
add eax, 0xffffffc2
mov word [0x4c0ac8], ax
lea eax, [edx - 0x52]
mov esi, eax
mov word [0x4c0aca], si
add esi, 0xfffffff3
mov word [0x4c0acc], si
lea esi, [edx - 0x51]
mov word [0x4c0ace], si
add esi, 0xffffffe9
mov word [0x4c0ad0], si
lea esi, [edx - 0x35]
mov word [0x4c0ad2], si
mov esi, eax
mov word [0x4c0ad4], si
add esi, 0xfffffff7
add eax, 6
mov word [0x4c0ad6], si
lea esi, [edx - 0x50]
mov word [0x4c0ade], ax
mov eax, edx
mov word [0x4c0ad8], si
mov dword [0x4c0ada], 0x85188505
mov dword [0x4c0ae0], 0x85488557
mov word [0x4c0ae4], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c0ac0]
add eax, 2
mov word [eax + 0x4c116a], cx
cmp eax, 0x26
jb 0x4026ef
mov eax, 0x4c116c
ret
Function at 0x4027d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0x4c74cc], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x856a
jne 0x40280e
or dword [0x4c74cc], 1
lea eax, [ecx - 0x4d]
mov word [0x4c0ae8], ax
add eax, 0xffffffeb
mov word [0x4c0aea], ax
mov eax, ecx
mov word [0x4c0aec], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c0ae8]
add eax, 2
mov word [eax + 0x4c1192], dx
cmp eax, 6
jb 0x402812
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x402835
mov eax, dword [eax]
push 0x4c1194
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004666e7
add esp, 0xc
test eax, eax
jne 0x402900
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403563
push dword [esp + 0x10]
call fcn.00402909
push eax
call fcn.00466c41
push dword [esp + 0x18]
call fcn.004671cc
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.0046b6f0
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x49508c]
test eax, eax
jne 0x4028ee
call dword [0x4950a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0042dbd8
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x4028d2
mov eax, dword [eax]
push eax
call fcn.00402949
push eax
call fcn.00466f10
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.00404c20
jmp 0x402900
push dword [esp + 0x18]
mov esi, dword [0x4950bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402909
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c74c8], 1
jne 0x40292c
or dword [0x4c74c8], 1
mov dword [0x4c0af0], 0x242f6067
mov word [0x4c0af4], 0x6a2e
xor eax, eax
mov cl, byte [eax + 0x4c0af0]
xor cl, 0x6a
mov byte [eax + 0x4c119c], cl
inc eax
cmp eax, 6
jb 0x40292e
mov eax, 0x4c119c
ret

Function at 0x402949
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c74c4], 1
jne 0x4029ce
or dword [0x4c74c4], 1
mov dword [0x4c0af8], 0x6030b2c
mov dword [0x4c0afc], 0x1e4a0e0f
mov dword [0x4c0b00], 0x18094a05
mov dword [0x4c0b04], 0xf1e0b0f
mov dword [0x4c0b08], 0xb18094a
mov dword [0x4c0b0c], 0x184a0219
mov dword [0x4c0b10], 0x18051a0f
mov dword [0x4c0b14], 0x4a180f1e
mov dword [0x4c0b18], 0x905181a
mov dword [0x4c0b1c], 0x5019190f
mov dword [0x4c0b20], 0x60194f4a
mov byte [0x4c0b24], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0af8]
xor cl, 0x6a
mov byte [eax + 0x4c11a4], cl
inc eax
cmp eax, 0x2d
jb 0x4029d0
mov eax, 0x4c11a4
ret
Function at 0x403a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7464], 1
jne 0x403acd
or dword [0x4c7464], 1
mov dword [0x4c0da4], 0x1f0e0527
mov dword [0x4c0da8], 0x4a500f06
mov dword [0x4c0dac], 0x6067194f
mov byte [0x4c0db0], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0da4]
xor cl, 0x6a
mov byte [eax + 0x4c1450], cl
inc eax
cmp eax, 0xd
jb 0x403acf
mov eax, 0x4c1450
ret

Function at 0x403aea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7460], 1
jne 0x403b29
or dword [0x4c7460], 1
mov dword [0x4c0db4], 0xf18023e
mov dword [0x4c0db8], 0x4a500e0b
mov dword [0x4c0dbc], 0x124f125a
mov dword [0x4c0dc0], 0x60676067
mov byte [0x4c0dc4], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0db4]
xor cl, 0x6a
mov byte [eax + 0x4c1460], cl
inc eax
cmp eax, 0x11
jb 0x403b2b
mov eax, 0x4c1460
ret

Function at 0x403b46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c745c], 1
jne 0x403b84
or dword [0x4c745c], 1
mov dword [0x4c0dc8], 0xf09122f
mov dword [0x4c0dcc], 0x5031e1a
mov dword [0x4c0dd0], 0xe4f4a04
mov word [0x4c0dd4], 0x6067
mov byte [0x4c0dd6], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0dc8]
xor cl, 0x6a
mov byte [eax + 0x4c1474], cl
inc eax
cmp eax, 0xf
jb 0x403b86
mov eax, 0x4c1474
ret

Function at 0x403ba1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7458], 1
jne 0x403bdf
or dword [0x4c7458], 1
mov dword [0x4c0dd8], 0xb090526
mov dword [0x4c0ddc], 0x405031e
mov dword [0x4c0de0], 0x1a4f4a50
mov word [0x4c0de4], 0x6067
mov byte [0x4c0de6], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0dd8]
xor cl, 0x6a
mov byte [eax + 0x4c1484], cl
inc eax
cmp eax, 0xf
jb 0x403be1
mov eax, 0x4c1484
ret

Function at 0x403bfc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7454], 1
jne 0x403c3d
or dword [0x4c7454], 1
mov dword [0x4c0de8], 0xf1a133e
mov dword [0x4c0dec], 0x194f4a50
mov dword [0x4c0df0], 0x125a424a
mov dword [0x4c0df4], 0x6743124f
mov word [0x4c0df8], 0x6a60
xor eax, eax
mov cl, byte [eax + 0x4c0de8]
xor cl, 0x6a
mov byte [eax + 0x4c1494], cl
inc eax
cmp eax, 0x12
jb 0x403c3f
mov eax, 0x4c1494
ret

Function at 0x403c5a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7450], 1
jne 0x403ce2
or dword [0x4c7450], 1
mov dword [0x4c0dfc], 0xb1e0f2e
mov dword [0x4c0e00], 0x50190603
mov dword [0x4c0e04], 0x3183e4a
mov dword [0x4c0e08], 0x1e4a0e0f
mov dword [0x4c0e0c], 0xf184a05
mov dword [0x4c0e10], 0xc4a0e0b
mov dword [0x4c0e14], 0x4a070518
mov dword [0x4c0e18], 0x5070f07
mov dword [0x4c0e1c], 0xb4a1318
mov dword [0x4c0e20], 0xf180e0e
mov dword [0x4c0e24], 0x4f4a1919
mov dword [0x4c0e28], 0x6a60671a
xor eax, eax
mov cl, byte [eax + 0x4c0dfc]
xor cl, 0x6a
mov byte [eax + 0x4c14a8], cl
inc eax
cmp eax, 0x30
jb 0x403ce4
mov eax, 0x4c14a8
ret
Function at 0x403cff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c744c], 1
jne 0x403d91
or dword [0x4c744c], 1
mov dword [0x4c0e2c], 0xb1e0f2e
mov dword [0x4c0e30], 0x50190603
mov dword [0x4c0e34], 0x3183e4a
mov dword [0x4c0e38], 0x1e4a0e0f
mov dword [0x4c0e3c], 0x181d4a05
mov dword [0x4c0e40], 0x4a0f1e03
mov dword [0x4c0e44], 0x74a051e
mov dword [0x4c0e48], 0x1805070f
mov dword [0x4c0e4c], 0xe0b4a13
mov dword [0x4c0e50], 0x190f180e
mov dword [0x4c0e54], 0x1a4f4a19
mov word [0x4c0e58], 0x6067
mov byte [0x4c0e5a], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0e2c]
xor cl, 0x6a
mov byte [eax + 0x4c14d8], cl
inc eax
cmp eax, 0x2f
jb 0x403d93
mov eax, 0x4c14d8
ret

Function at 0x403dae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7448], 1
jne 0x403e41
or dword [0x4c7448], 1
mov dword [0x4c0e5c], 0xb1e0f2e
mov dword [0x4c0e60], 0x50190603
mov dword [0x4c0e64], 0x3183e4a
mov dword [0x4c0e68], 0x1e4a0e0f
mov dword [0x4c0e6c], 0x120f4a05
mov dword [0x4c0e70], 0x1e1f090f
mov dword [0x4c0e74], 0xf074a0f
mov dword [0x4c0e78], 0x13180507
mov dword [0x4c0e7c], 0x4a1e0b4a
mov dword [0x4c0e80], 0x180e0e0b
mov dword [0x4c0e84], 0x4a19190f
mov dword [0x4c0e88], 0x60671a4f
mov byte [0x4c0e8c], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0e5c]
xor cl, 0x6a
mov byte [eax + 0x4c1508], cl
inc eax
cmp eax, 0x31
jb 0x403e43
mov eax, 0x4c1508
ret

Function at 0x403e5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7444], 1
jne 0x403e95
or dword [0x4c7444], 1
mov dword [0x4c0e90], 0xd0b062c
mov dword [0x4c0e94], 0x5a4a5019
mov dword [0x4c0e98], 0x67124f12
mov word [0x4c0e9c], 0x6a60
xor eax, eax
mov cl, byte [eax + 0x4c0e90]
xor cl, 0x6a
mov byte [eax + 0x4c153c], cl
inc eax
cmp eax, 0xe
jb 0x403e97
mov eax, 0x4c153c
ret

Function at 0x403eb2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7440], 1
jne 0x403ee9
or dword [0x4c7440], 1
mov dword [0x4c0ea0], 0xb180b3a
mov dword [0x4c0ea4], 0xf1e0f07
mov dword [0x4c0ea8], 0x67501918
mov word [0x4c0eac], 0x6a60
xor eax, eax
mov cl, byte [eax + 0x4c0ea0]
xor cl, 0x6a
mov byte [eax + 0x4c154c], cl
inc eax
cmp eax, 0xe
jb 0x403eeb
mov eax, 0x4c154c
ret

Function at 0x403f06
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c743c], 1
jne 0x403f4f
or dword [0x4c743c], 1
mov dword [0x4c0eb0], 0x180b3a63
mov dword [0x4c0eb4], 0x1e0f070b
mov dword [0x4c0eb8], 0x4f31180f
mov dword [0x4c0ebc], 0x4a50370e
mov dword [0x4c0ec0], 0x60671a4f
mov byte [0x4c0ec4], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0eb0]
xor cl, 0x6a
mov byte [eax + 0x4c155c], cl
inc eax
cmp eax, 0x15
jb 0x403f51
mov eax, 0x4c155c
ret

Function at 0x403f6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7438], 1
jne 0x403fa4
or dword [0x4c7438], 1
mov dword [0x4c0ec8], 0x4a222f39
mov dword [0x4c0ecc], 0x60b042b
mov dword [0x4c0ed0], 0x19031913
mov dword [0x4c0ed4], 0x6a606750
xor eax, eax
mov cl, byte [eax + 0x4c0ec8]
xor cl, 0x6a
mov byte [eax + 0x4c1574], cl
inc eax
cmp eax, 0x10
jb 0x403fa6
mov eax, 0x4c1574
ret
Function at 0x403fc3
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4c7434], 1
jne 0x40400d
or dword [0x4c7434], 1
mov dword [0x4c0ed8], 0x82563
mov dword [0x4c0edc], 0x4a1e090f
mov dword [0x4c0ee0], 0xf1a131e
mov dword [0x4c0ee4], 0x194f4a50
mov word [0x4c0ee8], 0x6067
mov byte [0x4c0eea], 0x6a
mov cl, byte [eax + 0x4c0ed8]
xor cl, 0x6a
mov byte [eax + 0x4c1584], cl
inc eax
cmp eax, 0x13
jb 0x40400d
mov eax, 0x4c1584
ret

Function at 0x404028
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7430], 1
jne 0x404091
or dword [0x4c7430], 1
mov dword [0x4c0eec], 0x30b2c63
mov dword [0x4c0ef0], 0x4a0e0f06
mov dword [0x4c0ef4], 0xc4a051e
mov dword [0x4c0ef8], 0x5060605
mov dword [0x4c0efc], 0x51a4a1d
mov dword [0x4c0f00], 0xf1e0403
mov dword [0x4c0f04], 0x2094a18
mov dword [0x4c0f08], 0x6704030b
mov word [0x4c0f0c], 0x6a60
xor eax, eax
mov cl, byte [eax + 0x4c0eec]
xor cl, 0x6a
mov byte [eax + 0x4c1598], cl
inc eax
cmp eax, 0x22
jb 0x404093
mov eax, 0x4c1598
ret

Function at 0x4040ae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c742c], 1
jne 0x4040d1
or dword [0x4c742c], 1
mov dword [0x4c0f10], 0xe1e192a
mov word [0x4c0f14], 0x6a2a
xor eax, eax
mov cl, byte [eax + 0x4c0f10]
xor cl, 0x6a
mov byte [eax + 0x4c15bc], cl
inc eax
cmp eax, 6
jb 0x4040d3
mov eax, 0x4c15bc
ret

Function at 0x4040ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7428], 1
jne 0x404125
or dword [0x4c7428], 1
mov dword [0x4c0f18], 0x1e041f18
mov dword [0x4c0f1c], 0x350f0703
mov dword [0x4c0f20], 0x518180f
mov word [0x4c0f24], 0x6a18
xor eax, eax
mov cl, byte [eax + 0x4c0f18]
xor cl, 0x6a
mov byte [eax + 0x4c15c4], cl
inc eax
cmp eax, 0xe
jb 0x404127
mov eax, 0x4c15c4
ret

Function at 0x404142
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7424], 1
jne 0x404170
or dword [0x4c7424], 1
mov dword [0x4c0f28], 0xd040b18
mov dword [0x4c0f2c], 0x180f350f
mov dword [0x4c0f30], 0x6a180518
xor eax, eax
mov cl, byte [eax + 0x4c0f28]
xor cl, 0x6a
mov byte [eax + 0x4c15d4], cl
inc eax
cmp eax, 0xc
jb 0x404172
mov eax, 0x4c15d4
ret

Function at 0x40418d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7420], 1
jne 0x4041cb
or dword [0x4c7420], 1
mov dword [0x4c0f34], 0x180f1c05
mov dword [0x4c0f38], 0x1d05060c
mov dword [0x4c0f3c], 0x18180f35
mov word [0x4c0f40], 0x1805
mov byte [0x4c0f42], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0f34]
xor cl, 0x6a
mov byte [eax + 0x4c15e0], cl
inc eax
cmp eax, 0xf
jb 0x4041cd
mov eax, 0x4c15e0
ret

Function at 0x4041e8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c741c], 1
jne 0x404220
or dword [0x4c741c], 1
mov dword [0x4c0f44], 0xf0e041f
mov dword [0x4c0f48], 0x5060c18
mov dword [0x4c0f4c], 0x180f351d
mov dword [0x4c0f50], 0x6a180518
xor eax, eax
mov cl, byte [eax + 0x4c0f44]
xor cl, 0x6a
mov byte [eax + 0x4c15f0], cl
inc eax
cmp eax, 0x10
jb 0x404222
mov eax, 0x4c15f0
ret
Function at 0x40423d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7418], 1
jne 0x40426b
or dword [0x4c7418], 1
mov dword [0x4c0f54], 0x30d0506
mov dword [0x4c0f58], 0x180f3509
mov dword [0x4c0f5c], 0x6a180518
xor eax, eax
mov cl, byte [eax + 0x4c0f54]
xor cl, 0x6a
mov byte [eax + 0x4c1600], cl
inc eax
cmp eax, 0xc
jb 0x40426d
mov eax, 0x4c1600
ret

Function at 0x404288
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7414], 1
jne 0x4042bd
or dword [0x4c7414], 1
mov dword [0x4c0f60], 0xb07050e
mov dword [0x4c0f64], 0xf350403
mov dword [0x4c0f68], 0x18051818
mov byte [0x4c0f6c], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0f60]
xor cl, 0x6a
mov byte [eax + 0x4c160c], cl
inc eax
cmp eax, 0xd
jb 0x4042bf
mov eax, 0x4c160c
ret

Function at 0x4042da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7410], 1
jne 0x404319
or dword [0x4c7410], 1
mov dword [0x4c0f70], 0xb1c0403
mov dword [0x4c0f74], 0x350e0306
mov dword [0x4c0f78], 0x1f0d180b
mov dword [0x4c0f7c], 0x1e040f07
mov byte [0x4c0f80], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0f70]
xor cl, 0x6a
mov byte [eax + 0x4c161c], cl
inc eax
cmp eax, 0x11
jb 0x40431b
mov eax, 0x4c161c
ret

Function at 0x404336
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c740c], 1
jne 0x40436b
or dword [0x4c740c], 1
mov dword [0x4c0f84], 0xd040f06
mov dword [0x4c0f88], 0xf35021e
mov dword [0x4c0f8c], 0x18051818
mov byte [0x4c0f90], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0f84]
xor cl, 0x6a
mov byte [eax + 0x4c1630], cl
inc eax
cmp eax, 0xd
jb 0x40436d
mov eax, 0x4c1630
ret

Function at 0x404388
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7408], 1
jne 0x4043bd
or dword [0x4c7408], 1
mov dword [0x4c0f94], 0x351e1f05
mov dword [0x4c0f98], 0x18350c05
mov dword [0x4c0f9c], 0xf0d040b
mov byte [0x4c0fa0], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4c0f94]
xor cl, 0x6a
mov byte [eax + 0x4c1640], cl
inc eax
cmp eax, 0xd
jb 0x4043bf
mov eax, 0x4c1640
ret

Function at 0x4043da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7404], 1
jne 0x404407
or dword [0x4c7404], 1
mov dword [0x4c0fa4], 0xf09120f
mov dword [0x4c0fa8], 0x5031e1a
mov word [0x4c0fac], 0x6a04
xor eax, eax
mov cl, byte [eax + 0x4c0fa4]
xor cl, 0x6a
mov byte [eax + 0x4c1650], cl
inc eax
cmp eax, 0xa
jb 0x404409
mov eax, 0x4c1650
ret

Function at 0x404424
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7400], 1
jne 0x404483
or dword [0x4c7400], 1
mov dword [0x4c0fb0], 0xe1e1963
mov dword [0x4c0fb4], 0x120f5050
mov dword [0x4c0fb8], 0x1e1a0f09
mov dword [0x4c0fbc], 0x50040503
mov dword [0x4c0fc0], 0xb021d50
mov dword [0x4c0fc4], 0x5043421e
mov dword [0x4c0fc8], 0x67194f4a
mov word [0x4c0fcc], 0x6a60
xor eax, eax
mov cl, byte [eax + 0x4c0fb0]
xor cl, 0x6a
mov byte [eax + 0x4c165c], cl
inc eax
cmp eax, 0x1e
jb 0x404485
mov eax, 0x4c165c
ret