joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40449e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8410], 1
jne 0x404512
or dword [0x4c8410], 1
mov dword [0x4c1fd0], 0xcbc3e4ab
mov dword [0x4c1fd4], 0x82c6c7ce
mov dword [0x4c1fd8], 0xc582cdd6
mov dword [0x4c1fdc], 0xd182d6c7
mov dword [0x4c1fe0], 0x9898c6d6
mov dword [0x4c1fe4], 0xc7c1dac7
mov dword [0x4c1fe8], 0xcdcbd6d2
mov dword [0x4c1fec], 0xd59898cc
mov dword [0x4c1ff0], 0x8ad6c3ca
mov dword [0x4c1ff4], 0xa2a8af8b
xor eax, eax
mov cl, byte [eax + 0x4c1fd0]
xor cl, 0xa2
mov byte [eax + 0x4c267c], cl
inc eax
cmp eax, 0x28
jb 0x404514
mov eax, 0x4c267c
ret

Function at 0x40452f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c840c], 1
jne 0x404563
or dword [0x4c840c], 1
mov dword [0x4c1ff8], 0xcfcdc1fd
mov dword [0x4c1ffc], 0xd0d0c7fd
mov word [0x4c2000], 0xd0cd
mov byte [0x4c2002], 0xa2
xor eax, eax
mov cl, byte [eax + 0x4c1ff8]
xor cl, 0xa2
mov byte [eax + 0x4c26a4], cl
inc eax
cmp eax, 0xb
jb 0x404565
mov eax, 0x4c26a4
ret

Function at 0x404580
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8408], 1
jne 0x4045e9
or dword [0x4c8408], 1
mov dword [0x4c2004], 0xcdc1fdab
mov dword [0x4c2008], 0xd0c7fdcf
mov dword [0x4c200c], 0x98d0cdd0
mov dword [0x4c2010], 0xd0d0e798
mov dword [0x4c2014], 0xc7efd0cd
mov dword [0x4c2018], 0xc5c3d1d1
mov dword [0x4c201c], 0x988b8ac7
mov dword [0x4c2020], 0xafd18782
mov word [0x4c2024], 0xa2a8
xor eax, eax
mov cl, byte [eax + 0x4c2004]
xor cl, 0xa2
mov byte [eax + 0x4c26b0], cl
inc eax
cmp eax, 0x22
jb 0x4045eb
mov eax, 0x4c26b0
ret

Function at 0x404606
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8404], 1
jne 0x404684
or dword [0x4c8404], 1
mov dword [0x4c2028], 0xcbc3e4ab
mov dword [0x4c202c], 0x82c6c7ce
mov dword [0x4c2030], 0xc582cdd6
mov dword [0x4c2034], 0xfd82d6c7
mov dword [0x4c2038], 0xfdcfcdc1
mov dword [0x4c203c], 0xcdd0d0c7
mov dword [0x4c2040], 0xe79898d0
mov dword [0x4c2044], 0xd0cdd0d0
mov dword [0x4c2048], 0xd1d1c7ef
mov dword [0x4c204c], 0x8ac7c5c3
mov dword [0x4c2050], 0xa2a8af8b
xor eax, eax
mov cl, byte [eax + 0x4c2028]
xor cl, 0xa2
mov byte [eax + 0x4c26d4], cl
inc eax
cmp eax, 0x2c
jb 0x404686
mov eax, 0x4c26d4
ret

Function at 0x4046a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8400], 1
jne 0x40471c
or dword [0x4c8400], 1
mov dword [0x4c2054], 0xc1c3d6f1
mov dword [0x4c2058], 0xd7c682c9
mov dword [0x4c205c], 0xc782d2cf
mov dword [0x4c2060], 0xd0cdd0d0
mov dword [0x4c2064], 0xcde18298
mov dword [0x4c2068], 0xdac7d6cc
mov dword [0x4c206c], 0xc1c7f0d6
mov dword [0x4c2070], 0x82c6d0cd
mov dword [0x4c2074], 0x82d1c3d5
mov dword [0x4c2078], 0xceced7cc
mov byte [0x4c207c], 0xa2
xor eax, eax
mov cl, byte [eax + 0x4c2054]
xor cl, 0xa2
mov byte [eax + 0x4c2700], cl
inc eax
cmp eax, 0x29
jb 0x40471e
mov eax, 0x4c2700
ret
Function at 0x404739
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83fc], 1
jne 0x4047b3
or dword [0x4c83fc], 1
mov dword [0x4c2080], 0xc1c3d6f1
mov dword [0x4c2084], 0xd7c682c9
mov dword [0x4c2088], 0xc782d2cf
mov dword [0x4c208c], 0xd0cdd0d0
mov dword [0x4c2090], 0xdbf18298
mov dword [0x4c2094], 0xcbccebcf
mov dword [0x4c2098], 0xcec3cbd6
mov dword [0x4c209c], 0x82c7d8cb
mov dword [0x4c20a0], 0xcecbc3c4
mov word [0x4c20a4], 0xc6c7
mov byte [0x4c20a6], 0xa2
xor eax, eax
mov cl, byte [eax + 0x4c2080]
xor cl, 0xa2
mov byte [eax + 0x4c272c], cl
inc eax
cmp eax, 0x27
jb 0x4047b5
mov eax, 0x4c272c
ret

Function at 0x4047d0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83f8], 1
jne 0x404836
or dword [0x4c83f8], 1
mov dword [0x4c20a8], 0xcbc9d19e
mov dword [0x4c20ac], 0xc6c7d2d2
mov dword [0x4c20b0], 0xc3d0c482
mov dword [0x4c20b4], 0x828ec7cf
mov dword [0x4c20b8], 0xd582e1f2
mov dword [0x4c20bc], 0xcc82d1c3
mov dword [0x4c20c0], 0x9cceced7
mov word [0x4c20c4], 0xa8af
mov byte [0x4c20c6], 0xa2
xor eax, eax
mov cl, byte [eax + 0x4c20a8]
xor cl, 0xa2
mov byte [eax + 0x4c2754], cl
inc eax
cmp eax, 0x1f
jb 0x404838
mov eax, 0x4c2754
ret

Function at 0x404853
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83f4], 1
jne 0x4048e6
or dword [0x4c83f4], 1
mov dword [0x4c20c8], 0xcbc9d19e
mov dword [0x4c20cc], 0xc6c7d2d2
mov dword [0x4c20d0], 0xc3d0c482
mov dword [0x4c20d4], 0x828ec7cf
mov dword [0x4c20d8], 0xd582e1f2
mov dword [0x4c20dc], 0xd182d1c3
mov dword [0x4c20e0], 0x82c7cfc3
mov dword [0x4c20e4], 0xd082d1c3
mov dword [0x4c20e8], 0xd0d7d6c7
mov dword [0x4c20ec], 0xc6c382cc
mov dword [0x4c20f0], 0xd1c7d0c6
mov dword [0x4c20f4], 0xa8af9cd1
mov byte [0x4c20f8], 0xa2
xor eax, eax
mov cl, byte [eax + 0x4c20c8]
xor cl, 0xa2
mov byte [eax + 0x4c2774], cl
inc eax
cmp eax, 0x31
jb 0x4048e8
mov eax, 0x4c2774
ret
Function at 0x404903
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.00479a80
push ebx
push esi
push edi
call dword [0x496094]
test byte [0x4c83f0], 1
mov dword [ebp - 4], eax
jne 0x40494a
or dword [0x4c83f0], 1
mov dword [0x4c20fc], 0xc6cdcf9e
mov dword [0x4c2100], 0x9dc7ced7
mov dword [0x4c2104], 0xa29c9d9d
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x4c20fc]
xor cl, 0xa2
mov byte [eax + 0x4c27a8], cl
inc eax
cmp eax, 0xc
jb 0x40494e
test byte [0x4c83ec], 1
mov dword [ebp - 8], 0x4c27a8
jne 0x404998
or dword [0x4c83ec], 1
mov dword [0x4c2108], 0xcfdbd19e
mov dword [0x4c210c], 0x9dcecdc0
mov dword [0x4c2110], 0xa29c9d9d
xor eax, eax
mov cl, byte [eax + 0x4c2108]
xor cl, 0xa2
mov byte [eax + 0x4c27b4], cl
inc eax
cmp eax, 0xc
jb 0x40499a
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x4c27b4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0046b890
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x4963bc]
test eax, eax
je 0x4049ff
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.0046b890
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x4963c4]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x404a4b
mov ecx, dword [ebp - 0x1c]
test byte [0x4c83e8], 1
jne 0x404a82
or dword [0x4c83e8], 1
mov dword [0x4c2114], 0x8782d287
mov dword [0x4c2118], 0xd18783d1
mov dword [0x4c211c], 0x87da9289
mov word [0x4c2120], 0xa2da
xor eax, eax
mov dl, byte [eax + 0x4c2114]
xor dl, 0xa2
mov byte [eax + 0x4c27c0], dl
inc eax
cmp eax, 0xe
jb 0x404a84
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x4c27c0
push dword [ebp + 0xc]
call fcn.0046716e
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x4963c8]
test eax, eax
je 0x404afb
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00404b48
push eax
push dword [ebp + 0xc]
call fcn.0046716e
add esp, 0x14
test byte [0x4c83e0], 1
jne 0x404b1b
or dword [0x4c83e0], 1
mov word [0x4c2134], 0xa8af
mov byte [0x4c2136], 0xa2
xor eax, eax
mov cl, byte [eax + 0x4c2134]
xor cl, 0xa2
mov byte [eax + 0x4c27e0], cl
inc eax
cmp eax, 3
jb 0x404b1d
push dword [ebp + 0xc]
push 0x4c27e0
call fcn.00466de1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404b48
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83e4], 1
jne 0x404b80
or dword [0x4c83e4], 1
mov dword [0x4c2124], 0xd1878a82
mov dword [0x4c2128], 0x82c68798
mov dword [0x4c212c], 0xda928289
mov dword [0x4c2130], 0xa28bda87
xor eax, eax
mov cl, byte [eax + 0x4c2124]
xor cl, 0xa2
mov byte [eax + 0x4c27d0], cl
inc eax
cmp eax, 0x10
jb 0x404b82
mov eax, 0x4c27d0
ret

Function at 0x405df6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83d4], 1
jne 0x405e4b
or dword [0x4c83d4], 1
mov dword [0x4c2804], 0xe0f6e5ec
mov dword [0x4c2808], 0xe1f6e5f3
mov dword [0x4c280c], 0xf4e7e5f8
mov dword [0x4c2810], 0xf7e0f8ed
mov dword [0x4c2814], 0xf2f8f0e0
mov dword [0x4c2818], 0xfbfcebe6
mov word [0x4c281c], 0xa4fb
xor eax, eax
mov cl, byte [eax + 0x4c2804]
xor cl, 0xa4
mov byte [eax + 0x4c2a04], cl
inc eax
cmp eax, 0x1a
jb 0x405e4d
mov eax, 0x4c2a04
ret

Function at 0x405f5c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83d0], 1
jne 0x405f86
or dword [0x4c83d0], 1
mov dword [0x4c2820], 0xc5f3e9f2
mov word [0x4c2824], 0xc1d6
mov byte [0x4c2826], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c2820]
xor cl, 0xa4
mov byte [eax + 0x4c2a20], cl
inc eax
cmp eax, 7
jb 0x405f88
mov eax, 0x4c2a20
ret

Function at 0x405fa3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83cc], 1
jne 0x405fd0
or dword [0x4c83cc], 1
mov dword [0x4c2828], 0xd0d6cdf2
mov dword [0x4c282c], 0xf4c8c5d1
mov word [0x4c2830], 0xa4e7
xor eax, eax
mov cl, byte [eax + 0x4c2828]
xor cl, 0xa4
mov byte [eax + 0x4c2a28], cl
inc eax
cmp eax, 0xa
jb 0x405fd2
mov eax, 0x4c2a28
ret

Function at 0x405fee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83c8], 1
jne 0x406022
or dword [0x4c83c8], 1
mov dword [0x4c2834], 0xd0d6cdf2
mov dword [0x4c2838], 0xe6c8c5d1
mov word [0x4c283c], 0xdccb
mov byte [0x4c283e], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c2834]
xor cl, 0xa4
mov byte [eax + 0x4c2a34], cl
inc eax
cmp eax, 0xb
jb 0x406024
mov eax, 0x4c2a34
ret

Function at 0x40603f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83c4], 1
jne 0x406063
or dword [0x4c83c4], 1
mov dword [0x4c2840], 0xc1cac1e3
mov dword [0x4c2844], 0xa4c7cdd6
xor eax, eax
mov cl, byte [eax + 0x4c2840]
xor cl, 0xa4
mov byte [eax + 0x4c2a40], cl
inc eax
cmp eax, 8
jb 0x406065
mov eax, 0x4c2a40
ret
Function at 0x406080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48e0f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x4c83c0], 1
push esi
jne 0x4060d3
or dword [0x4c83c0], 1
mov dword [0x4c2848], 0xc8c0d0ca
mov dword [0x4c284c], 0xc8c08ac8
mov word [0x4c2850], 0xa4c8
xor eax, eax
mov cl, byte [eax + 0x4c2848]
xor cl, 0xa4
mov byte [eax + 0x4c2a48], cl
inc eax
cmp eax, 0xa
jb 0x4060d5
push 0x4c2a48
call dword [0x4960cc]
mov esi, eax
test esi, esi
jne 0x406147
call dword [0x4960a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0042dc19
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0040628e
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
push eax
call fcn.00470895
call fcn.004062f4
push eax
push esi
call dword [0x4960c8]
test eax, eax
jne 0x4061a4
call dword [0x4960a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00406366
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
jmp 0x406141
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x40622c
cmp dword [esp + 4], 0x18
jne 0x40622c
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x4960c4]
test eax, eax
jne 0x40627b
call dword [0x4960a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0042dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.004064a6
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
jmp 0x406141
call dword [0x4960a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.00406419
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
jmp 0x406141
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40628e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83bc], 1
jne 0x4062d7
or dword [0x4c83bc], 1
mov dword [0x4c2854], 0xc0c5cbe8
mov dword [0x4c2858], 0xd6c6cde8
mov dword [0x4c285c], 0x84ddd6c5
mov dword [0x4c2860], 0xc8cdc5c2
mov dword [0x4c2864], 0x849ec0c1
mov byte [0x4c2868], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c2854]
xor cl, 0xa4
mov byte [eax + 0x4c2a54], cl
inc eax
cmp eax, 0x15
jb 0x4062d9
mov eax, 0x4c2a54
ret
Function at 0x4062f4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83b8], 1
jne 0x406349
or dword [0x4c83b8], 1
mov dword [0x4c286c], 0xd1f5d0ea
mov dword [0x4c2870], 0xedddd6c1
mov dword [0x4c2874], 0xd6cbc2ca
mov dword [0x4c2878], 0xcdd0c5c9
mov dword [0x4c287c], 0xd6f4cacb
mov dword [0x4c2880], 0xd7c1c7cb
mov word [0x4c2884], 0xa4d7
xor eax, eax
mov cl, byte [eax + 0x4c286c]
xor cl, 0xa4
mov byte [eax + 0x4c2a6c], cl
inc eax
cmp eax, 0x1a
jb 0x40634b
mov eax, 0x4c2a6c
ret

Function at 0x406366
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83b4], 1
jne 0x4063fc
or dword [0x4c83b4], 1
mov dword [0x4c2888], 0xf4d0c1e3
mov dword [0x4c288c], 0xe5c7cbd6
mov dword [0x4c2890], 0xc1d6c0c0
mov dword [0x4c2894], 0xc284d7d7
mov dword [0x4c2898], 0xc1c8cdc5
mov dword [0x4c289c], 0xea8c84c0
mov dword [0x4c28a0], 0xc1d1f5d0
mov dword [0x4c28a4], 0xcaedddd6
mov dword [0x4c28a8], 0xc9d6cbc2
mov dword [0x4c28ac], 0xcbcdd0c5
mov dword [0x4c28b0], 0xcbd6f4ca
mov dword [0x4c28b4], 0xd7d7c1c7
mov dword [0x4c28b8], 0xa4849e8d
xor eax, eax
mov cl, byte [eax + 0x4c2888]
xor cl, 0xa4
mov byte [eax + 0x4c2a88], cl
inc eax
cmp eax, 0x34
jb 0x4063fe
mov eax, 0x4c2a88
ret

Function at 0x406419
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83b0], 1
jne 0x406489
or dword [0x4c83b0], 1
mov dword [0x4c28bc], 0xd1f5d0ea
mov dword [0x4c28c0], 0xedddd6c1
mov dword [0x4c28c4], 0xd6cbc2ca
mov dword [0x4c28c8], 0xcdd0c5c9
mov dword [0x4c28cc], 0xd6f4cacb
mov dword [0x4c28d0], 0xd7c1c7cb
mov dword [0x4c28d4], 0xc5c284d7
mov dword [0x4c28d8], 0xc0c1c8cd
mov word [0x4c28dc], 0x849e
mov byte [0x4c28de], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c28bc]
xor cl, 0xa4
mov byte [eax + 0x4c2abc], cl
inc eax
cmp eax, 0x23
jb 0x40648b
mov eax, 0x4c2abc
ret

Function at 0x4064a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83ac], 1
jne 0x4064ef
or dword [0x4c83ac], 1
mov dword [0x4c28e0], 0xcac1d4eb
mov dword [0x4c28e4], 0xc7cbd6f4
mov dword [0x4c28e8], 0x84d7d7c1
mov dword [0x4c28ec], 0xc8cdc5c2
mov dword [0x4c28f0], 0x849ec0c1
mov byte [0x4c28f4], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c28e0]
xor cl, 0xa4
mov byte [eax + 0x4c2ae0], cl
inc eax
cmp eax, 0x15
jb 0x4064f1
mov eax, 0x4c2ae0
ret
Function at 0x40650c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48e09e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x4c83a8], 1
push esi
push edi
jne 0x406569
or dword [0x4c83a8], 1
mov dword [0x4c28f8], 0xcad6c1cf
mov dword [0x4c28fc], 0x9697c8c1
mov dword [0x4c2900], 0xc8c8c08a
mov byte [0x4c2904], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c28f8]
xor cl, 0xa4
mov byte [eax + 0x4c2af8], cl
inc eax
cmp eax, 0xd
jb 0x40656b
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x4c2af8
call edi
mov esi, eax
test esi, esi
jne 0x4065df
call dword [0x4960a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0042dc19
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.00406741
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
push eax
call fcn.00470895
call fcn.004067be
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x4066ac
call fcn.00406831
push eax
call edi
mov edi, eax
test edi, edi
jne 0x406650
call dword [0x4960a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0040687b
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
jmp 0x4065d9
call fcn.004068f5
push eax
push edi
call esi
test eax, eax
jne 0x4066ac
call dword [0x4960a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00406965
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
jmp 0x4065d9
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x40670e
call dword [0x4960a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042dc19
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00406a1e
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406adf
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00405bc7
push 0x4b2d30
mov eax, esi
jmp 0x4065d9
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404c4f
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406741
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83a4], 1
jne 0x4067a1
or dword [0x4c83a4], 1
mov dword [0x4c2908], 0xc0c5cbe8
mov dword [0x4c290c], 0xd6c6cde8
mov dword [0x4c2910], 0x84ddd6c5
mov dword [0x4c2914], 0xc8cdc5c2
mov dword [0x4c2918], 0x8c84c0c1
mov dword [0x4c291c], 0xcad6c1cf
mov dword [0x4c2920], 0x9697c8c1
mov dword [0x4c2924], 0xa4849e8d
xor eax, eax
mov cl, byte [eax + 0x4c2908]
xor cl, 0xa4
mov byte [eax + 0x4c2b08], cl
inc eax
cmp eax, 0x20
jb 0x4067a3
mov eax, 0x4c2b08
ret
Function at 0x4067be
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83a0], 1
jne 0x406814
or dword [0x4c83a0], 1
mov dword [0x4c2928], 0xe39697ef
mov dword [0x4c292c], 0xd6f4d0c1
mov dword [0x4c2930], 0xd7c1c7cb
mov dword [0x4c2934], 0xc5c9edd7
mov dword [0x4c2938], 0xcde2c1c3
mov dword [0x4c293c], 0xc5eac1c8
mov dword [0x4c2940], 0xa4e5c1c9
xor eax, eax
mov cl, byte [eax + 0x4c2928]
xor cl, 0xa4
mov byte [eax + 0x4c2b28], cl
inc eax
cmp eax, 0x1c
jb 0x406816
mov eax, 0x4c2b28
ret

Function at 0x406831
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c839c], 1
jne 0x40685e
or dword [0x4c839c], 1
mov dword [0x4c2944], 0xd4c5d7d4
mov dword [0x4c2948], 0xc8c08acd
mov word [0x4c294c], 0xa4c8
xor eax, eax
mov cl, byte [eax + 0x4c2944]
xor cl, 0xa4
mov byte [eax + 0x4c2b44], cl
inc eax
cmp eax, 0xa
jb 0x406860
mov eax, 0x4c2b44
ret

Function at 0x40687b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8398], 1
jne 0x4068d8
or dword [0x4c8398], 1
mov dword [0x4c2950], 0xc0c5cbe8
mov dword [0x4c2954], 0xd6c6cde8
mov dword [0x4c2958], 0x84ddd6c5
mov dword [0x4c295c], 0xc8cdc5c2
mov dword [0x4c2960], 0x8c84c0c1
mov dword [0x4c2964], 0xd4c5d7d4
mov dword [0x4c2968], 0x849e8dcd
mov byte [0x4c296c], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c2950]
xor cl, 0xa4
mov byte [eax + 0x4c2b50], cl
inc eax
cmp eax, 0x1d
jb 0x4068da
mov eax, 0x4c2b50
ret

Function at 0x4068f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8394], 1
jne 0x406948
or dword [0x4c8394], 1
mov dword [0x4c2970], 0xf4d0c1e3
mov dword [0x4c2974], 0xc1c7cbd6
mov dword [0x4c2978], 0xc9edd7d7
mov dword [0x4c297c], 0xe2c1c3c5
mov dword [0x4c2980], 0xeac1c8cd
mov dword [0x4c2984], 0xe5c1c9c5
mov byte [0x4c2988], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c2970]
xor cl, 0xa4
mov byte [eax + 0x4c2b70], cl
inc eax
cmp eax, 0x19
jb 0x40694a
mov eax, 0x4c2b70
ret

Function at 0x406965
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8390], 1
jne 0x406a01
or dword [0x4c8390], 1
mov dword [0x4c298c], 0xf4d0c1e3
mov dword [0x4c2990], 0xe5c7cbd6
mov dword [0x4c2994], 0xc1d6c0c0
mov dword [0x4c2998], 0xc284d7d7
mov dword [0x4c299c], 0xc1c8cdc5
mov dword [0x4c29a0], 0xe38c84c0
mov dword [0x4c29a4], 0xd6f4d0c1
mov dword [0x4c29a8], 0xd7c1c7cb
mov dword [0x4c29ac], 0xc5c9edd7
mov dword [0x4c29b0], 0xcde2c1c3
mov dword [0x4c29b4], 0xc5eac1c8
mov dword [0x4c29b8], 0x8de5c1c9
mov word [0x4c29bc], 0x849e
mov byte [0x4c29be], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c298c]
xor cl, 0xa4
mov byte [eax + 0x4c2b8c], cl
inc eax
cmp eax, 0x33
jb 0x406a03
mov eax, 0x4c2b8c
ret

Function at 0x406a1e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c838c], 1
jne 0x406a85
or dword [0x4c838c], 1
mov dword [0x4c29c0], 0xf4d0c1e3
mov dword [0x4c29c4], 0xc1c7cbd6
mov dword [0x4c29c8], 0xc9edd7d7
mov dword [0x4c29cc], 0xe2c1c3c5
mov dword [0x4c29d0], 0xcac1c8cd
mov dword [0x4c29d4], 0x84c1c9c5
mov dword [0x4c29d8], 0xc8cdc5c2
mov dword [0x4c29dc], 0x849ec0c1
mov byte [0x4c29e0], 0xa4
xor eax, eax
mov cl, byte [eax + 0x4c29c0]
xor cl, 0xa4
mov byte [eax + 0x4c2bc0], cl
inc eax
cmp eax, 0x21
jb 0x406a87
mov eax, 0x4c2bc0
ret
Function at 0x407641
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8388], 1
jne 0x407827
or dword [0x4c8388], 1
mov dword [0x4c2be8], 0xd588c9cf
mov dword [0x4c2bec], 0xd3c9c2d2
mov dword [0x4c2bf0], 0xc3d59cd2
mov dword [0x4c2bf4], 0xd3c4d0d2
mov dword [0x4c2bf8], 0xc8818ec0
mov dword [0x4c2bfc], 0xac8f81c9
mov dword [0x4c2c00], 0xcdc5c7d6
mov dword [0x4c2c04], 0x88c3c1c7
mov dword [0x4c2c08], 0xced2c7d6
mov dword [0x4c2c0c], 0x81869b86
mov dword [0x4c2c10], 0xc3d4ac81
mov dword [0x4c2c14], 0xd4cfd3d7
mov dword [0x4c2c18], 0xd5818ec3
mov dword [0x4c2c1c], 0xc5cfd4d2
mov dword [0x4c2c20], 0xac8f81d2
mov dword [0x4c2c24], 0xc7c5c9ca
mov dword [0x4c2c28], 0x8ad586ca
mov dword [0x4c2c2c], 0x9b86d486
mov dword [0x4c2c30], 0xc5d6de86
mov dword [0x4c2c34], 0x8ecacac7
mov dword [0x4c2c38], 0xc5c8d3c0
mov dword [0x4c2c3c], 0xc8c9cfd2
mov dword [0x4c2c40], 0xd4868f8e
mov dword [0x4c2c44], 0xd4d3d2c3
mov dword [0x4c2c48], 0xc3d486c8
mov dword [0x4c2c4c], 0xd4cfd3d7
mov dword [0x4c2c50], 0x83818ec3
mov dword [0x4c2c54], 0x888f81eb
mov dword [0x4c2c58], 0xc8cfc7cb
mov dword [0x4c2c5c], 0xc7f9f98e
mov dword [0x4c2c60], 0x8fd5c1d4
mov dword [0x4c2c64], 0xc2c8c386
mov dword [0x4c2c68], 0xc3c2868a
mov dword [0x4c2c6c], 0x88c1d3c4
mov dword [0x4c2c70], 0xc5c7d4d2
mov dword [0x4c2c74], 0xc5c7c4c3
mov dword [0x4c2c78], 0xcfac8fcd
mov dword [0x4c2c7c], 0xc9c886c0
mov dword [0x4c2c80], 0x86d586d2
mov dword [0x4c2c84], 0xc8c3ced2
mov dword [0x4c2c88], 0xd4d4c386
mov dword [0x4c2c8c], 0xd48ed4c9
mov dword [0x4c2c90], 0xc8c3868f
mov dword [0x4c2c94], 0xc3d4acc2
mov dword [0x4c2c98], 0xc8d4d3d2
mov word [0x4c2c9c], 0xd486
mov byte [0x4c2c9e], 0xa6
xor eax, eax
mov cl, byte [eax + 0x4c2be8]
xor cl, 0xa6
mov byte [eax + 0x4c3318], cl
inc eax
cmp eax, 0xb7
jb 0x407829
mov eax, 0x4c3318
ret