joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10188a2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
call fcn.01011e39
pop ecx
test eax, eax
je 0x10188d7
push esi
push esi
push esi
push esi
push esi
call fcn.0101440f
add esp, 0x14
push 4
pop eax
call fcn.01019770
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10189f3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec edi
neg edi
sbb edi, edi
and edi, 0x103
inc edi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], esi
jne 0x101896c
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1002430
call esi
test eax, eax
jne 0x1018943
push 0x1002414
call esi
test eax, eax
je 0x101896c
push 0x1003018
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x101896c
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
call eax
cmp eax, 1
jne 0x101896c
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x101896c
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea esi, [ebx - 1]
push esi
push dword [ebp - 8]
call fcn.01012597
add esp, 0xc
test eax, eax
jl 0x10189f3
not esi
and dword [ebp - 8], esi
je 0x101899e
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.01012597
add esp, 0xc
test eax, eax
jl 0x10189f3
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x10189a9
mov dword [ebp - 8], eax
lea esi, [ebx - 1]
not esi
and esi, dword [ebp - 0x14]
sub esi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x10189bd
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp esi, ebx
jb 0x10189f3
push 4
push 0x1000
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10189f3
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10189f3
xor eax, eax
inc eax
jmp 0x10189f5
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01010bbf
leave
ret
Function at 0x101a037
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa8], 0
cmp dword [0x1020b18], 0xfffffffe
mov dword [ebp - 0xb0], 0xc
jne 0x101a15c
and dword [0x1020b18], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x101a15c
cmp dword [ebp - 0x94], 1
jne 0x101a15c
cmp dword [ebp - 0xa0], 4
jne 0x101a15c
cmp dword [ebp - 0x9c], 0xa
jae 0x101a15c
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x101a15c
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x1003078
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101a15c
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x10014b3
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x101a15c
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.01019f14
test eax, eax
je 0x101a15c
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x101a152
cmp dword [ebp - 0xa8], 0xd
jne 0x101a15c
mov dword [0x1020b18], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1020b18]
xor ecx, ebp
call fcn.01010bbf
leave
ret

Function at 0x101a3b1
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1022ffc], edi
jne 0x101a4cd
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call fcn.01010b40
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x101a418
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1022ffc], edi
pop esi
je 0x101a4a0
dec eax
jne 0x101a4cd
cmp dword [ebp - 0x11c], 5
jne 0x101a48d
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x101a481
dec eax
je 0x101a46e
dec eax
je 0x101a454
mov dword [0x1022ffc], 0x14
jmp 0x101a4cd
cmp word [ebp - 0xc], 1
jb 0x101a465
mov dword [0x1022ffc], 0x10
or dword [0x1022ffc], 4
jmp 0x101a4cd
cmp word [ebp - 0xc], 2
jb 0x101a465
mov dword [0x1022ffc], 8
jmp 0x101a465
mov dword [0x1022ffc], 4
jmp 0x101a4cd
cmp dword [ebp - 0x11c], 4
ja 0x101a4df
mov dword [0x1022ffc], 2
cmp dword [ebp - 0x11c], 4
jne 0x101a4cd
cmp dword [ebp - 0x118], edi
je 0x101a4c3
cmp dword [ebp - 0x118], 0xa
je 0x101a4c3
cmp dword [ebp - 0x118], 0x5a
jne 0x101a4cd
mov dword [0x1022ffc], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1022ffc]
xor ecx, ebp
pop edi
call fcn.01010bbf
leave
ret
mov dword [0x1022ffc], 0x20
jmp 0x101a4cd
Function at 0x101a4f0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101a544
push 3
lea eax, [ebp - 0x44]
push 0x1003590
push eax
call fcn.01011cdd
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01010bbf
leave
ret

Function at 0x101a559
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x1023000]
jne 0x101a5f4
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x10034c0
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101a5f3
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1003578
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x101a5f3
push 3
push dword [esi*8 + 0x1003310]
lea eax, [ebp - 0xc]
push eax
call fcn.0101be06
add esp, 0xc
test eax, eax
je 0x101a5e5
inc esi
cmp esi, 0x1c
jb 0x101a5c4
jmp 0x101a5f3
mov ax, word [esi*8 + 0x1003314]
mov word [0x1023000], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x1023000]
xor ecx, ebp
call fcn.01010bbf
leave
ret
Function at 0x101b36e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101b3cf
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x101b3c6
cmp dword [ebp - 0xc], 4
je 0x101b3c6
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x101b412
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x101b409
cmp dword [ebp - 0xc], esi
je 0x101b409
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x101b421
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101b499
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01010bbf
leave
ret 0xc

Function at 0x101b607
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x100620c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101b659
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x10061fc
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x101b6a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1020b28]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x101b724
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1006274
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101b713
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1006268
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101b70a
cmp dword [ebp - 0xc], 4
jne 0x101b70a
cmp dword [ebp - 0x10], eax
je 0x101b70a
mov dword [0x1020b28], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1020b28]
cmp eax, 0xffffffff
jne 0x101b724
xor eax, eax
mov dword [0x1020b28], eax
leave
ret
Function at 0x402545
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3d58], 1
mov ecx, 0x89e8
jne 0x4025cc
or dword [0x4c3d58], 1
lea eax, [ecx - 0x1b]
mov edx, eax
add eax, 0xffffffe7
mov word [0x4bda54], ax
mov word [0x4bda48], dx
add edx, 0xffffffef
lea eax, [ecx - 0x5c]
mov word [0x4bda56], ax
add eax, 0x11
mov word [0x4bda58], ax
mov word [0x4bda4a], dx
lea edx, [ecx - 0x3b]
lea eax, [ecx - 0x63]
mov word [0x4bda5a], ax
mov word [0x4bda4c], dx
add edx, 0xfffffff8
add eax, 0x13
mov word [0x4bda5c], ax
lea eax, [ecx - 0x31]
mov word [0x4bda5e], ax
mov eax, ecx
mov word [0x4bda4e], dx
mov dword [0x4bda50], 0x89cd89b8
mov word [0x4bda60], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4bda48]
add eax, 2
mov word [eax + 0x4be0f2], dx
cmp eax, 0x1a
jb 0x4025ce
mov eax, 0x4be0f4
ret

Function at 0x4025ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3d50], 1
jne 0x40261a
or dword [0x4c3d50], 1
mov dword [0x4bda70], 0x8c8785d4
mov dword [0x4bda74], 0xd78d849d
mov dword [0x4bda78], 0xe8d6d7d7
xor eax, eax
mov cl, byte [eax + 0x4bda70]
xor cl, 0xe8
mov byte [eax + 0x4be11c], cl
inc eax
cmp eax, 0xc
jb 0x40261c
mov eax, 0x4be11c
ret

Function at 0x402637
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3d4c], 1
mov edx, 0x89e8
jne 0x4026f7
push esi
lea ecx, [edx - 0x1e]
mov eax, ecx
mov word [0x4bda7c], ax
add eax, 0xfffffffe
or dword [0x4c3d4c], 1
mov word [0x4bda7e], ax
lea eax, [edx - 0x23]
mov esi, eax
mov word [0x4bda80], si
mov word [0x4bda82], ax
add eax, 0xffffffc6
mov word [0x4bda84], ax
lea eax, [edx - 0x4e]
mov esi, eax
mov word [0x4bda86], si
add esi, 0xffffffef
mov word [0x4bda88], si
lea esi, [edx - 0x4d]
mov word [0x4bda8a], si
add esi, 0xffffffe5
mov word [0x4bda8c], si
lea esi, [edx - 0x31]
mov word [0x4bda8e], si
mov esi, eax
mov word [0x4bda90], si
add esi, 0xfffffff3
add eax, 2
mov word [0x4bda92], si
lea esi, [edx - 0x50]
mov word [0x4bda9a], ax
mov eax, edx
mov word [0x4bda94], si
mov dword [0x4bda96], 0x899a8987
mov dword [0x4bda9c], 0x89ca89d5
mov word [0x4bdaa0], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4bda7c]
add eax, 2
mov word [eax + 0x4be126], cx
cmp eax, 0x26
jb 0x4026f9
mov eax, 0x4be128
ret
Function at 0x4027d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78
test byte [0x4c3d48], 1
push esi
push edi
mov ecx, 0x89e8
jne 0x402813
or dword [0x4c3d48], 1
lea eax, [ecx - 0x49]
mov word [0x4bdaa4], ax
add eax, 0xffffffeb
mov word [0x4bdaa6], ax
mov eax, ecx
mov word [0x4bdaa8], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4bdaa4]
add eax, 2
mov word [eax + 0x4be14e], dx
cmp eax, 6
jb 0x402817
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x40283a
mov eax, dword [eax]
push 0x4be150
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00464317
add esp, 0xc
test eax, eax
jne 0x402905
push dword [esp + 8]
push dword [ebp + 8]
push ebx
call fcn.00403569
push dword [esp + 8]
call fcn.0040290d
push eax
call fcn.00464871
push dword [esp + 0x10]
call fcn.00464dfc
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.004679d0
add esp, 0xc
mov dword [esp + 0x38], edi
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x49308c]
test eax, eax
jne 0x4028f3
call dword [0x4930a8]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0042b796
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x4028d7
mov eax, dword [eax]
push eax
call fcn.0040294d
push eax
call fcn.00464b40
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x24]
call fcn.00404c1e
jmp 0x402905
push dword [esp + 0x10]
mov esi, dword [0x4930bc]
call esi
push dword [esp + 0xc]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40290d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3d44], 1
jne 0x402930
or dword [0x4c3d44], 1
mov dword [0x4bdaac], 0xa6ade2e5
mov word [0x4bdab0], 0xe8ac
xor eax, eax
mov cl, byte [eax + 0x4bdaac]
xor cl, 0xe8
mov byte [eax + 0x4be158], cl
inc eax
cmp eax, 6
jb 0x402932
mov eax, 0x4be158
ret

Function at 0x40294d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3d40], 1
jne 0x4029d2
or dword [0x4c3d40], 1
mov dword [0x4bdab4], 0x848189ae
mov dword [0x4bdab8], 0x9cc88c8d
mov dword [0x4bdabc], 0x9a8bc887
mov dword [0x4bdac0], 0x8d9c898d
mov dword [0x4bdac4], 0x899a8bc8
mov dword [0x4bdac8], 0x9ac8809b
mov dword [0x4bdacc], 0x9a87988d
mov dword [0x4bdad0], 0xc89a8d9c
mov dword [0x4bdad4], 0x8b879a98
mov dword [0x4bdad8], 0xd29b9b8d
mov dword [0x4bdadc], 0xe29bcdc8
mov byte [0x4bdae0], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bdab4]
xor cl, 0xe8
mov byte [eax + 0x4be160], cl
inc eax
cmp eax, 0x2d
jb 0x4029d4
mov eax, 0x4be160
ret
Function at 0x403a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3ce0], 1
jne 0x403acd
or dword [0x4c3ce0], 1
mov dword [0x4bdd60], 0x9d8c87a5
mov dword [0x4bdd64], 0xc8d28d84
mov dword [0x4bdd68], 0xe2e59bcd
mov byte [0x4bdd6c], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bdd60]
xor cl, 0xe8
mov byte [eax + 0x4be40c], cl
inc eax
cmp eax, 0xd
jb 0x403acf
mov eax, 0x4be40c
ret

Function at 0x403aea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cdc], 1
jne 0x403b29
or dword [0x4c3cdc], 1
mov dword [0x4bdd70], 0x8d9a80bc
mov dword [0x4bdd74], 0xc8d28c89
mov dword [0x4bdd78], 0x90cd90d8
mov dword [0x4bdd7c], 0xe2e5e2e5
mov byte [0x4bdd80], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bdd70]
xor cl, 0xe8
mov byte [eax + 0x4be41c], cl
inc eax
cmp eax, 0x11
jb 0x403b2b
mov eax, 0x4be41c
ret

Function at 0x403b46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cd8], 1
jne 0x403b84
or dword [0x4c3cd8], 1
mov dword [0x4bdd84], 0x8d8b90ad
mov dword [0x4bdd88], 0x87819c98
mov dword [0x4bdd8c], 0x8ccdc886
mov word [0x4bdd90], 0xe2e5
mov byte [0x4bdd92], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bdd84]
xor cl, 0xe8
mov byte [eax + 0x4be430], cl
inc eax
cmp eax, 0xf
jb 0x403b86
mov eax, 0x4be430
ret

Function at 0x403ba1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cd4], 1
jne 0x403bdf
or dword [0x4c3cd4], 1
mov dword [0x4bdd94], 0x898b87a4
mov dword [0x4bdd98], 0x8687819c
mov dword [0x4bdd9c], 0x98cdc8d2
mov word [0x4bdda0], 0xe2e5
mov byte [0x4bdda2], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bdd94]
xor cl, 0xe8
mov byte [eax + 0x4be440], cl
inc eax
cmp eax, 0xf
jb 0x403be1
mov eax, 0x4be440
ret

Function at 0x403bfc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cd0], 1
jne 0x403c3d
or dword [0x4c3cd0], 1
mov dword [0x4bdda4], 0x8d9891bc
mov dword [0x4bdda8], 0x9bcdc8d2
mov dword [0x4bddac], 0x90d8c0c8
mov dword [0x4bddb0], 0xe5c190cd
mov word [0x4bddb4], 0xe8e2
xor eax, eax
mov cl, byte [eax + 0x4bdda4]
xor cl, 0xe8
mov byte [eax + 0x4be450], cl
inc eax
cmp eax, 0x12
jb 0x403c3f
mov eax, 0x4be450
ret

Function at 0x403c5a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3ccc], 1
jne 0x403ce2
or dword [0x4c3ccc], 1
mov dword [0x4bddb8], 0x899c8dac
mov dword [0x4bddbc], 0xd29b8481
mov dword [0x4bddc0], 0x819abcc8
mov dword [0x4bddc4], 0x9cc88c8d
mov dword [0x4bddc8], 0x8d9ac887
mov dword [0x4bddcc], 0x8ec88c89
mov dword [0x4bddd0], 0xc885879a
mov dword [0x4bddd4], 0x87858d85
mov dword [0x4bddd8], 0x89c8919a
mov dword [0x4bdddc], 0x8d9a8c8c
mov dword [0x4bdde0], 0xcdc89b9b
mov dword [0x4bdde4], 0xe8e2e598
xor eax, eax
mov cl, byte [eax + 0x4bddb8]
xor cl, 0xe8
mov byte [eax + 0x4be464], cl
inc eax
cmp eax, 0x30
jb 0x403ce4
mov eax, 0x4be464
ret
Function at 0x403cff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cc8], 1
jne 0x403d91
or dword [0x4c3cc8], 1
mov dword [0x4bdde8], 0x899c8dac
mov dword [0x4bddec], 0xd29b8481
mov dword [0x4bddf0], 0x819abcc8
mov dword [0x4bddf4], 0x9cc88c8d
mov dword [0x4bddf8], 0x9a9fc887
mov dword [0x4bddfc], 0xc88d9c81
mov dword [0x4bde00], 0x85c8879c
mov dword [0x4bde04], 0x9a87858d
mov dword [0x4bde08], 0x8c89c891
mov dword [0x4bde0c], 0x9b8d9a8c
mov dword [0x4bde10], 0x98cdc89b
mov word [0x4bde14], 0xe2e5
mov byte [0x4bde16], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bdde8]
xor cl, 0xe8
mov byte [eax + 0x4be494], cl
inc eax
cmp eax, 0x2f
jb 0x403d93
mov eax, 0x4be494
ret

Function at 0x403dae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cc4], 1
jne 0x403e41
or dword [0x4c3cc4], 1
mov dword [0x4bde18], 0x899c8dac
mov dword [0x4bde1c], 0xd29b8481
mov dword [0x4bde20], 0x819abcc8
mov dword [0x4bde24], 0x9cc88c8d
mov dword [0x4bde28], 0x908dc887
mov dword [0x4bde2c], 0x9c9d8b8d
mov dword [0x4bde30], 0x8d85c88d
mov dword [0x4bde34], 0x919a8785
mov dword [0x4bde38], 0xc89c89c8
mov dword [0x4bde3c], 0x9a8c8c89
mov dword [0x4bde40], 0xc89b9b8d
mov dword [0x4bde44], 0xe2e598cd
mov byte [0x4bde48], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bde18]
xor cl, 0xe8
mov byte [eax + 0x4be4c4], cl
inc eax
cmp eax, 0x31
jb 0x403e43
mov eax, 0x4be4c4
ret

Function at 0x403e5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cc0], 1
jne 0x403e95
or dword [0x4c3cc0], 1
mov dword [0x4bde4c], 0x8f8984ae
mov dword [0x4bde50], 0xd8c8d29b
mov dword [0x4bde54], 0xe590cd90
mov word [0x4bde58], 0xe8e2
xor eax, eax
mov cl, byte [eax + 0x4bde4c]
xor cl, 0xe8
mov byte [eax + 0x4be4f8], cl
inc eax
cmp eax, 0xe
jb 0x403e97
mov eax, 0x4be4f8
ret

Function at 0x403eb2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cbc], 1
jne 0x403ee9
or dword [0x4c3cbc], 1
mov dword [0x4bde5c], 0x899a89b8
mov dword [0x4bde60], 0x8d9c8d85
mov dword [0x4bde64], 0xe5d29b9a
mov word [0x4bde68], 0xe8e2
xor eax, eax
mov cl, byte [eax + 0x4bde5c]
xor cl, 0xe8
mov byte [eax + 0x4be508], cl
inc eax
cmp eax, 0xe
jb 0x403eeb
mov eax, 0x4be508
ret

Function at 0x403f06
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cb8], 1
jne 0x403f4f
or dword [0x4c3cb8], 1
mov dword [0x4bde6c], 0x9a89b8e1
mov dword [0x4bde70], 0x9c8d8589
mov dword [0x4bde74], 0xcdb39a8d
mov dword [0x4bde78], 0xc8d2b58c
mov dword [0x4bde7c], 0xe2e598cd
mov byte [0x4bde80], 0xe8
xor eax, eax
mov cl, byte [eax + 0x4bde6c]
xor cl, 0xe8
mov byte [eax + 0x4be518], cl
inc eax
cmp eax, 0x15
jb 0x403f51
mov eax, 0x4be518
ret

Function at 0x403f6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3cb4], 1
jne 0x403fa4
or dword [0x4c3cb4], 1
mov dword [0x4bde84], 0xc8a0adbb
mov dword [0x4bde88], 0x848986a9
mov dword [0x4bde8c], 0x9b819b91
mov dword [0x4bde90], 0xe8e2e5d2
xor eax, eax
mov cl, byte [eax + 0x4bde84]
xor cl, 0xe8
mov byte [eax + 0x4be530], cl
inc eax
cmp eax, 0x10
jb 0x403fa6
mov eax, 0x4be530
ret