joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f9032
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c18], 1
jne 0x3f9055
or dword [0x498c18], 1
mov dword [0x493f50], 0x3b333073
mov word [0x493f54], 0x5c73
xor eax, eax
mov cl, byte [eax + 0x493f50]
xor cl, 0x5c
mov byte [eax + 0x494540], cl
inc eax
cmp eax, 6
jb 0x3f9057
mov eax, 0x494540
ret

Function at 0x3f9072
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c14], 1
jne 0x3f90ed
or dword [0x498c14], 1
mov dword [0x493f58], 0x2c282834
mov dword [0x493f5c], 0x3d737366
mov dword [0x493f60], 0x25303d32
mov dword [0x493f64], 0x2f3f3528
mov dword [0x493f68], 0x28393b72
mov dword [0x493f6c], 0x322b3338
mov dword [0x493f70], 0x282f3928
mov dword [0x493f74], 0x31333f72
mov dword [0x493f78], 0x736e2a73
mov dword [0x493f7c], 0x733b3330
mov byte [0x493f80], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493f58]
xor cl, 0x5c
mov byte [eax + 0x494548], cl
inc eax
cmp eax, 0x29
jb 0x3f90ef
mov eax, 0x494548
ret

Function at 0x3f910a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c10], 1
jne 0x3f9135
or dword [0x498c10], 1
mov dword [0x493f84], 0x2f7a613f
mov dword [0x493f88], 0x61287a61
mov byte [0x493f8c], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493f84]
xor cl, 0x5c
mov byte [eax + 0x494574], cl
inc eax
cmp eax, 9
jb 0x3f9137
mov eax, 0x494574
ret

Function at 0x3f9152
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498c00], 1
jne 0x3f91da
or dword [0x498c00], 1
mov dword [0x493fa0], 0x2832331f
mov dword [0x493fa4], 0x71283239
mov dword [0x493fa8], 0x392c2508
mov dword [0x493fac], 0x2c3d7c66
mov dword [0x493fb0], 0x3f35302c
mov dword [0x493fb4], 0x3335283d
mov dword [0x493fb8], 0x71247332
mov dword [0x493fbc], 0x712b2b2b
mov dword [0x493fc0], 0x312e333a
mov dword [0x493fc4], 0x302e2971
mov dword [0x493fc8], 0x333f3239
mov dword [0x493fcc], 0x5c383938
xor eax, eax
mov cl, byte [eax + 0x493fa0]
xor cl, 0x5c
mov byte [eax + 0x494590], cl
inc eax
cmp eax, 0x30
jb 0x3f91dc
mov eax, 0x494590
ret

Function at 0x3f91f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bfc], 1
jne 0x3f9222
or dword [0x498bfc], 1
mov dword [0x493fd0], 0x80f130c
mov dword [0x493fd4], 0x7c33287c
mov byte [0x493fd8], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493fd0]
xor cl, 0x5c
mov byte [eax + 0x4945c0], cl
inc eax
cmp eax, 9
jb 0x3f9224
mov eax, 0x4945c0
ret

Function at 0x3f923f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bf8], 1
jne 0x3f9288
or dword [0x498bf8], 1
mov dword [0x493fdc], 0x353d3a7c
mov dword [0x493fe0], 0x7c383930
mov dword [0x493fe4], 0x3428352b
mov dword [0x493fe8], 0x3d282f7c
mov dword [0x493fec], 0x7c2f2928
mov byte [0x493ff0], 0x5c
xor eax, eax
mov cl, byte [eax + 0x493fdc]
xor cl, 0x5c
mov byte [eax + 0x4945cc], cl
inc eax
cmp eax, 0x15
jb 0x3f928a
mov eax, 0x4945cc
ret
Function at 0x3f92bf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4632ca
call fcn.00461d38
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x3f9470
cmp dword [ebp + 0x10], ebx
je 0x3f9470
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.003fa60d
push eax
push 0x482c70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.003f547a
push 0x482c6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.003f54b0
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.003f4e24
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.003f4e24
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x3f93cb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.003fa60d
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.003fa62f
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x3f937f
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.003fe0c3
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.003f4e24
inc bl
jne 0x3f9437
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.003f4e24
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x3f9346
test byte [0x498bf0], 1
jne 0x3f93f8
or dword [0x498bf0], 1
mov dword [0x494000], 0x7c283312
mov dword [0x494004], 0x3229333a
mov word [0x494008], 0x5c38
xor eax, eax
mov cl, byte [eax + 0x494000]
xor cl, 0x5c
mov byte [eax + 0x4945f0], cl
inc eax
cmp eax, 0xa
jb 0x3f93fa
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x4945f0
call fcn.0043ba55
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x4844a8
lea eax, [ebp - 0x44]
push eax
call fcn.00445956
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.003fa62f
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.003f4e24
push 1
lea esi, [ebp - 0x2c]
call fcn.003f4e24
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.003f9495
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043ba55
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x4844a8
lea eax, [ebp - 0x38]
jmp 0x3f9431

Function at 0x3f9495
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bf4], 1
jne 0x3f94c2
or dword [0x498bf4], 1
mov dword [0x493ff4], 0x7c283312
mov dword [0x493ff8], 0x3229333a
mov word [0x493ffc], 0x5c38
xor eax, eax
mov cl, byte [eax + 0x493ff4]
xor cl, 0x5c
mov byte [eax + 0x4945e4], cl
inc eax
cmp eax, 0xa
jb 0x3f94c4
mov eax, 0x4945e4
ret
Function at 0x3f9c79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bec], 1
mov ecx, 0xd45c
jne 0x3f9d03
or dword [0x498bec], 1
lea eax, [ecx - 0x1d]
mov word [0x49400c], ax
add eax, 0xffffffef
mov edx, eax
mov word [0x49400e], dx
lea edx, [ecx - 0x1f]
mov word [0x494010], dx
add edx, 0xfffffff2
mov word [0x494012], dx
lea edx, [ecx - 0x28]
mov word [0x494014], dx
add edx, 0xffffffcf
mov word [0x494016], dx
mov edx, eax
mov word [0x494018], dx
lea edx, [ecx - 0x23]
lea eax, [ecx - 0x34]
mov word [0x49401a], dx
mov word [0x494022], ax
add edx, 0xfffffff3
mov eax, ecx
mov word [0x49401c], dx
mov dword [0x49401e], 0xd42ed433
mov word [0x494024], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x49400c]
add eax, 2
mov word [eax + 0x4945fa], dx
cmp eax, 0x1a
jb 0x3f9d05
mov eax, 0x4945fc
ret

Function at 0x3f9d23
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498be8], 1
jne 0x3f9d4e
or dword [0x498be8], 1
mov dword [0x494028], 0x322e3937
mov dword [0x49402c], 0x6e6f3039
mov byte [0x494030], 0x5c
xor eax, eax
mov cl, byte [eax + 0x494028]
xor cl, 0x5c
mov byte [eax + 0x494618], cl
inc eax
cmp eax, 9
jb 0x3f9d50
mov eax, 0x494618
ret

Function at 0x3f9d6b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498be4], 1
jne 0x3f9dd4
or dword [0x498be4], 1
mov dword [0x494034], 0xc28390f
mov dword [0x494038], 0x393f332e
mov dword [0x49403c], 0x2f092f2f
mov dword [0x494040], 0x33112e39
mov dword [0x494044], 0x24193938
mov dword [0x494048], 0x282c393f
mov dword [0x49404c], 0xc323335
mov dword [0x494050], 0x3f353033
mov word [0x494054], 0x5c25
xor eax, eax
mov cl, byte [eax + 0x494034]
xor cl, 0x5c
mov byte [eax + 0x494624], cl
inc eax
cmp eax, 0x22
jb 0x3f9dd6
mov eax, 0x494624
ret

Function at 0x3f9df1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498be0], 1
jne 0x3f9e5a
or dword [0x498be0], 1
mov dword [0x494058], 0xc28391b
mov dword [0x49405c], 0x393f332e
mov dword [0x494060], 0x2f092f2f
mov dword [0x494064], 0x33112e39
mov dword [0x494068], 0x24193938
mov dword [0x49406c], 0x282c393f
mov dword [0x494070], 0xc323335
mov dword [0x494074], 0x3f353033
mov word [0x494078], 0x5c25
xor eax, eax
mov cl, byte [eax + 0x494058]
xor cl, 0x5c
mov byte [eax + 0x494648], cl
inc eax
cmp eax, 0x22
jb 0x3f9e5c
mov eax, 0x494648
ret

Function at 0x3f9e77
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bdc], 1
jne 0x3f9ecd
or dword [0x498bdc], 1
mov dword [0x49407c], 0x7c393013
mov dword [0x494080], 0x28353235
mov dword [0x494084], 0x35303d35
mov dword [0x494088], 0x35283d26
mov dword [0x49408c], 0x3a7c3233
mov dword [0x494090], 0x3930353d
mov dword [0x494094], 0x5c7c6638
xor eax, eax
mov cl, byte [eax + 0x49407c]
xor cl, 0x5c
mov byte [eax + 0x49466c], cl
inc eax
cmp eax, 0x1c
jb 0x3f9ecf
mov eax, 0x49466c
ret
Function at 0x3f9eea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bd8], 1
mov ecx, 0xd45c
jne 0x3f9f19
or dword [0x498bd8], 1
lea eax, [ecx - 0x1f]
mov word [0x494098], ax
add eax, 0x31
mov word [0x49409a], ax
mov eax, ecx
mov word [0x49409c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x494098]
add eax, 2
mov word [eax + 0x494686], dx
cmp eax, 6
jb 0x3f9f1b
mov eax, 0x494688
ret

Function at 0x3f9f39
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bd0], 1
jne 0x3f9fa9
or dword [0x498bd0], 1
mov dword [0x4940a8], 0x30353d1a
mov dword [0x4940ac], 0x287c3839
mov dword [0x4940b0], 0x32357c33
mov dword [0x4940b4], 0x3d352835
mov dword [0x4940b8], 0x39263530
mov dword [0x4940bc], 0x2a32397c
mov dword [0x4940c0], 0x32332e35
mov dword [0x4940c4], 0x28323931
mov word [0x4940c8], 0x7c66
mov byte [0x4940ca], 0x5c
xor eax, eax
mov cl, byte [eax + 0x4940a8]
xor cl, 0x5c
mov byte [eax + 0x494698], cl
inc eax
cmp eax, 0x23
jb 0x3f9fab
mov eax, 0x494698
ret

Function at 0x3f9fc6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bc8], 1
jne 0x3fa011
or dword [0x498bc8], 1
mov dword [0x4940d4], 0x3d343209
mov dword [0x4940d8], 0x39303832
mov dword [0x4940dc], 0x24397c38
mov dword [0x4940e0], 0x282c393f
mov dword [0x4940e4], 0x66323335
mov word [0x4940e8], 0x5c7c
xor eax, eax
mov cl, byte [eax + 0x4940d4]
xor cl, 0x5c
mov byte [eax + 0x4946c4], cl
inc eax
cmp eax, 0x16
jb 0x3fa013
mov eax, 0x4946c4
ret

Function at 0x3fa02e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bc4], 1
jne 0x3fa081
or dword [0x498bc4], 1
mov dword [0x4940ec], 0x3d343209
mov dword [0x4940f0], 0x39303832
mov dword [0x4940f4], 0x24397c38
mov dword [0x4940f8], 0x282c393f
mov dword [0x4940fc], 0x66323335
mov dword [0x494100], 0x562f797c
mov byte [0x494104], 0x5c
xor eax, eax
mov cl, byte [eax + 0x4940ec]
xor cl, 0x5c
mov byte [eax + 0x4946dc], cl
inc eax
cmp eax, 0x19
jb 0x3fa083
mov eax, 0x4946dc
ret

Function at 0x3fa09e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bc0], 1
jne 0x3fa0d6
or dword [0x498bc0], 1
mov dword [0x494108], 0x3e29280f
mov dword [0x49410c], 0x3524397c
mov dword [0x494110], 0x79747c28
mov dword [0x494114], 0x5c567538
xor eax, eax
mov cl, byte [eax + 0x494108]
xor cl, 0x5c
mov byte [eax + 0x4946f8], cl
inc eax
cmp eax, 0x10
jb 0x3fa0d8
mov eax, 0x4946f8
ret
Function at 0x3fbae7
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x462ac7
call fcn.00461d38
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x3fbbcb
cmp byte [edi + 0x49], bl
je 0x3fbbcb
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x3fbb1e
xor al, al
jmp 0x3fbbcd
push esi
lea esi, [ebp - 0x2c]
call fcn.003fb5e0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x3fbb6e
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x3fbb73
dec eax
je 0x3fbb77
dec eax
dec eax
je 0x3fbbc7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.003f4ce6
mov al, bl
pop esi
jmp 0x3fbbcd
mov edx, dword [ebp - 0x2c]
jmp 0x3fbb38
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x3fbb83
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x3fbba9
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x3fbb96
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0043d82e
add esp, 0x10
cmp esi, eax
jne 0x3fbb5b
cmp byte [edi + 0x49], 0
je 0x3fbbc7
test esi, esi
jne 0x3fbb2a
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.003fb6b9
jmp 0x3fbb2a
mov bl, 1
jmp 0x3fbb5d
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4003d1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bbc], 1
jne 0x400445
or dword [0x498bbc], 1
mov dword [0x494718], 0x3128321e
mov dword [0x49471c], 0x32337d39
mov dword [0x494720], 0x383a7d29
mov dword [0x494724], 0x34397d29
mov dword [0x494728], 0x39342d2e
mov dword [0x49472c], 0x7d3b327d
mov dword [0x494730], 0x35293830
mov dword [0x494734], 0x7a7d3932
mov dword [0x494738], 0x31313c3e
mov dword [0x49473c], 0x5d7d677a
xor eax, eax
mov cl, byte [eax + 0x494718]
xor cl, 0x5d
mov byte [eax + 0x49485c], cl
inc eax
cmp eax, 0x28
jb 0x400447
mov eax, 0x49485c
ret

Function at 0x400462
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bb8], 1
jne 0x4004c9
or dword [0x498bb8], 1
mov dword [0x494740], 0x31343c1b
mov dword [0x494744], 0x297d3938
mov dword [0x494748], 0x33347d32
mov dword [0x49474c], 0x3836322b
mov dword [0x494750], 0x2938307d
mov dword [0x494754], 0x7d393235
mov dword [0x494758], 0x313c3e7a
mov dword [0x49475c], 0x7d677a31
mov byte [0x494760], 0x5d
xor eax, eax
mov cl, byte [eax + 0x494740]
xor cl, 0x5d
mov byte [eax + 0x494884], cl
inc eax
cmp eax, 0x21
jb 0x4004cb
mov eax, 0x494884
ret
Function at 0x4004e6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bb4], 1
jne 0x400546
or dword [0x498bb4], 1
mov dword [0x494764], 0x322f0d57
mov dword [0x494768], 0x313f3c3f
mov dword [0x49476c], 0x28397d24
mov dword [0x494770], 0x32297d38
mov dword [0x494774], 0x2f3e2e7d
mov dword [0x494778], 0x7d292d34
mov dword [0x49477c], 0x322f2f38
mov dword [0x494780], 0x5d7d672f
xor eax, eax
mov cl, byte [eax + 0x494764]
xor cl, 0x5d
mov byte [eax + 0x4948a8], cl
inc eax
cmp eax, 0x20
jb 0x400548
mov eax, 0x4948a8
ret

Function at 0x400b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x400c68
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x498bb0], 1
jne 0x400b85
or dword [0x498bb0], 1
mov eax, 0xd42e
mov word [0x494784], ax
add eax, 0xa
mov word [0x494786], ax
mov eax, 0xd433
mov word [0x494788], ax
add eax, 6
mov word [0x49478a], ax
mov eax, 0xd45d
mov word [0x49478c], ax
xor eax, eax
mov ecx, 0xd45d
xor cx, word [eax + 0x494784]
add eax, 2
mov word [eax + 0x4948c6], cx
cmp eax, 0xa
jb 0x400b87
mov eax, dword [ebx + edi]
mov ecx, 0x4948c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x400bce
test dx, dx
je 0x400bca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x400bce
add eax, esi
add ecx, esi
test dx, dx
jne 0x400baa
xor eax, eax
jmp 0x400bd3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x400bdf
mov dword [edi], 0x385
jmp 0x400c57
call fcn.00400c78
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x400c0b
test dx, dx
je 0x400c07
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x400c0b
add ecx, esi
add eax, esi
test dx, dx
jne 0x400be7
xor eax, eax
jmp 0x400c10
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x400c1c
mov dword [edi], 0x386
jmp 0x400c57
call fcn.00400d4b
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x400c48
test dx, dx
je 0x400c44
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x400c48
add ecx, esi
add eax, esi
test dx, dx
jne 0x400c24
xor eax, eax
jmp 0x400c4d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x400c71
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x400b42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x400c6a
Function at 0x400c78
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498bac], 1
jne 0x400d28
or dword [0x498bac], 1
mov eax, 0xd43c
mov word [0x494790], ax
add eax, 0xfffffffd
mov ecx, eax
mov word [0x494794], ax
mov eax, 0xd418
mov word [0x494796], ax
add eax, 0x13
mov word [0x494798], ax
mov eax, 0xd438
mov word [0x494792], cx
mov ecx, eax
lea edx, [eax - 5]
mov word [0x49479a], cx
mov ecx, edx
push edi
mov word [0x49479c], cx
add ecx, 0xfffffff6
mov edi, ecx
mov word [0x49479e], di
lea edi, [eax - 0x27]
mov word [0x4947a0], di
add edi, 0x23
mov ecx, eax
add eax, 0xfffffff7
mov word [0x4947ae], ax
lea eax, [ecx + 0x25]
mov word [0x4947a2], di
mov dword [0x4947a4], 0xd429d42e
mov word [0x4947a8], cx
mov dword [0x4947aa], 0xd438d433
mov word [0x4947b0], ax
pop edi
xor eax, eax
mov ecx, 0xd45d
xor cx, word [eax + 0x494790]
add eax, 2
mov word [eax + 0x4948d2], cx
cmp eax, 0x22
jb 0x400d2a
mov eax, 0x4948d4
ret

Function at 0x400d4b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ba8], 1
mov ecx, 0xd45d
jne 0x400da5
or dword [0x498ba8], 1
lea eax, [ecx - 0x32]
mov word [0x4947b4], ax
add eax, 0xd
mov word [0x4947b6], ax
lea eax, [ecx - 0x2e]
mov word [0x4947b8], ax
dec eax
mov word [0x4947ba], ax
lea eax, [ecx - 0x29]
mov word [0x4947bc], ax
add eax, 0xfffffffe
mov word [0x4947be], ax
lea eax, [ecx - 0x2a]
mov word [0x4947c0], ax
mov eax, ecx
mov word [0x4947c2], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4947b4]
add eax, 2
mov word [eax + 0x4948f6], dx
cmp eax, 0x10
jb 0x400da7
mov eax, 0x4948f8
ret

Function at 0x401764
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ba4], 1
mov edx, 0xd45d
jne 0x4017c7
or dword [0x498ba4], 1
lea ecx, [edx - 0x25]
mov eax, ecx
mov word [0x4947c4], ax
add eax, 0xfffffff7
push esi
mov esi, eax
lea eax, [edx - 0x4c]
mov word [0x4947ce], ax
add eax, 0x23
mov word [0x4947d0], ax
mov eax, edx
mov word [0x4947c6], si
mov word [0x4947c8], si
mov dword [0x4947ca], 0xd42fd432
mov dword [0x4947d2], 0xd438d433
mov word [0x4947d6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4947c4]
add eax, 2
mov word [eax + 0x494906], cx
cmp eax, 0x14
jb 0x4017c9
mov eax, 0x494908
ret

Function at 0x4017e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498ba0], 1
jne 0x401883
or dword [0x498ba0], 1
mov edx, 0xd438
mov eax, edx
mov word [0x4947d8], ax
add eax, 0xfffffff7
mov ecx, eax
mov word [0x4947da], cx
mov word [0x4947dc], cx
lea ecx, [edx - 6]
mov word [0x4947de], cx
mov ecx, eax
mov word [0x4947e0], cx
lea ecx, [edx - 0x1a]
mov word [0x4947e2], cx
add ecx, 0x17
mov word [0x4947e4], cx
lea ecx, [edx + 4]
push edi
mov edi, ecx
mov word [0x4947e6], di
mov edi, eax
mov word [0x4947ea], cx
mov word [0x4947f2], ax
add ecx, 2
lea eax, [edx + 0x25]
mov word [0x4947e8], di
mov word [0x4947ec], cx
mov dword [0x4947ee], 0xd438d429
mov word [0x4947f4], ax
pop edi
xor eax, eax
mov ecx, 0xd45d
xor cx, word [eax + 0x4947d8]
add eax, 2
mov word [eax + 0x49491a], cx
cmp eax, 0x1e
jb 0x401885
mov eax, 0x49491c
ret
Function at 0x4018a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498b9c], 1
jne 0x401907
or dword [0x498b9c], 1
mov edx, 0xd438
mov eax, edx
mov word [0x4947f8], ax
add eax, 0xfffffff7
mov ecx, eax
mov word [0x4947fa], cx
mov word [0x4947fc], cx
push edi
lea ecx, [edx - 6]
mov edi, ecx
mov word [0x494800], ax
lea eax, [edx + 0x25]
mov word [0x4947fe], di
mov dword [0x494802], 0xd432d41e
mov dword [0x494806], 0xd438d439
mov word [0x49480a], ax
pop edi
xor eax, eax
mov ecx, 0xd45d
xor cx, word [eax + 0x4947f8]
add eax, 2
mov word [eax + 0x49493a], cx
cmp eax, 0x14
jb 0x401909
mov eax, 0x49493c
ret

Function at 0x40192a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498b98], 1
mov edx, 0xd45d
jne 0x4019a7
or dword [0x498b98], 1
lea ecx, [edx - 0x25]
mov eax, ecx
mov word [0x49480c], ax
add eax, 0xfffffff7
push esi
mov esi, eax
lea eax, [edx - 0x4d]
mov word [0x494816], ax
mov eax, ecx
mov word [0x494818], ax
add eax, 0xfffffff6
mov word [0x49480e], si
mov word [0x494810], si
mov esi, eax
mov word [0x49481c], ax
lea eax, [edx - 0x21]
mov word [0x49481e], ax
mov eax, edx
mov word [0x49481a], si
mov dword [0x494812], 0xd42fd432
mov dword [0x494820], 0xd438d43a
mov word [0x494824], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x49480c]
add eax, 2
mov word [eax + 0x49494e], cx
cmp eax, 0x1a
jb 0x4019a9
mov eax, 0x494950
ret

Function at 0x4019c7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498b94], 1
mov ecx, 0xd45d
jne 0x401a26
or dword [0x498b94], 1
lea eax, [ecx - 0x25]
mov word [0x494828], ax
add eax, 0xfffffff7
mov edx, eax
mov word [0x49482a], dx
mov word [0x49482c], dx
lea edx, [ecx - 0x2b]
mov word [0x49482e], dx
mov edx, eax
lea eax, [ecx - 0x2c]
mov word [0x494836], ax
mov eax, ecx
mov word [0x494830], dx
mov dword [0x494832], 0xd42fd408
mov word [0x494838], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x494828]
add eax, 2
mov word [eax + 0x49496a], dx
cmp eax, 0x12
jb 0x401a28
mov eax, 0x49496c
ret

Function at 0x4020cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498b90], 1
jne 0x4020f5
or dword [0x498b90], 1
mov dword [0x49483c], 0x31283361
mov word [0x494840], 0x6331
mov byte [0x494842], 0x5d
xor eax, eax
mov cl, byte [eax + 0x49483c]
xor cl, 0x5d
mov byte [eax + 0x494980], cl
inc eax
cmp eax, 7
jb 0x4020f7
mov eax, 0x494980
ret

Function at 0x402112
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498b8c], 1
jne 0x40213c
or dword [0x498b8c], 1
mov dword [0x494844], 0x31283361
mov word [0x494848], 0x6331
mov byte [0x49484a], 0x5d
xor eax, eax
mov cl, byte [eax + 0x494844]
xor cl, 0x5d
mov byte [eax + 0x494988], cl
inc eax
cmp eax, 7
jb 0x40213e
mov eax, 0x494988
ret

Function at 0x402159
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498b84], 1
jne 0x40217d
or dword [0x498b84], 1
mov dword [0x494850], 0x323e067d
mov dword [0x494854], 0x5d603839
xor eax, eax
mov cl, byte [eax + 0x494850]
xor cl, 0x5d
mov byte [eax + 0x494994], cl
inc eax
cmp eax, 8
jb 0x40217f
mov eax, 0x494994
ret