joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424cb0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7df8], 1
jne 0x424cfc
or dword [0x4c7df8], 1
mov dword [0x4c61b4], 0x89afa896
mov dword [0x4c61b8], 0x82b1b5b5
mov dword [0x4c61bc], 0xa4afafae
mov dword [0x4c61c0], 0xe8e9b5a2
mov dword [0x4c61c4], 0xa8a0a7e1
mov dword [0x4c61c8], 0xc1a5a4ad
xor eax, eax
mov cl, byte [eax + 0x4c61b4]
xor cl, 0xc1
mov byte [eax + 0x4c646c], cl
inc eax
cmp eax, 0x18
jb 0x424cfe
mov eax, 0x4c646c
ret

Function at 0x425655
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7df4], 1
jne 0x42572e
or dword [0x4c7df4], 1
mov dword [0x4c61d0], 0xb4b0a493
mov dword [0x4c61d4], 0xe1b5b2a4
mov dword [0x4c61d8], 0xe1adb3b4
mov dword [0x4c61dc], 0xa5a4b2b4
mov dword [0x4c61e0], 0xa5e1a0e1
mov dword [0x4c61e4], 0xa4a7a7a8
mov dword [0x4c61e8], 0xb5afa4b3
mov dword [0x4c61ec], 0xa9a2b2e1
mov dword [0x4c61f0], 0xe1a4aca4
mov dword [0x4c61f4], 0xafa0a9b5
mov dword [0x4c61f8], 0xa4a9b5e1
mov dword [0x4c61fc], 0xafaea2e1
mov dword [0x4c6200], 0xb5a2a4af
mov dword [0x4c6204], 0xe1afaea8
mov dword [0x4c6208], 0xe1b2a0b6
mov dword [0x4c620c], 0xb5a8afa8
mov dword [0x4c6210], 0xa8ada0a8
mov dword [0x4c6214], 0xe1a5a4bb
mov dword [0x4c6218], 0xa9b5a8b6
mov byte [0x4c621c], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c61d0]
xor cl, 0xc1
mov byte [eax + 0x4c6488], cl
inc eax
cmp eax, 0x4d
jb 0x425730
mov eax, 0x4c6488
ret

Function at 0x42574b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7df0], 1
jne 0x425827
or dword [0x4c7df0], 1
mov dword [0x4c6220], 0xb4b0a493
mov dword [0x4c6224], 0xe1b5b2a4
mov dword [0x4c6228], 0xe1adb3b4
mov dword [0x4c622c], 0xa5a4b2b4
mov dword [0x4c6230], 0xa5e1a0e1
mov dword [0x4c6234], 0xa4a7a7a8
mov dword [0x4c6238], 0xb5afa4b3
mov dword [0x4c623c], 0xb2aea9e1
mov dword [0x4c6240], 0xa0afe1b5
mov dword [0x4c6244], 0xb5e1a4ac
mov dword [0x4c6248], 0xe1afa0a9
mov dword [0x4c624c], 0xe1a4a9b5
mov dword [0x4c6250], 0xafafaea2
mov dword [0x4c6254], 0xa8b5a2a4
mov dword [0x4c6258], 0xb6e1afae
mov dword [0x4c625c], 0xa8e1b2a0
mov dword [0x4c6260], 0xa8b5a8af
mov dword [0x4c6264], 0xbba8ada0
mov dword [0x4c6268], 0xb6e1a5a4
mov dword [0x4c626c], 0xc1a9b5a8
xor eax, eax
mov cl, byte [eax + 0x4c6220]
xor cl, 0xc1
mov byte [eax + 0x4c64d8], cl
inc eax
cmp eax, 0x50
jb 0x425829
mov eax, 0x4c64d8
ret
Function at 0x425844
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dec], 1
jne 0x42591c
or dword [0x4c7dec], 1
mov dword [0x4c6270], 0xb4b0a493
mov dword [0x4c6274], 0xe1b5b2a4
mov dword [0x4c6278], 0xe1adb3b4
mov dword [0x4c627c], 0xa5a4b2b4
mov dword [0x4c6280], 0xa5e1a0e1
mov dword [0x4c6284], 0xa4a7a7a8
mov dword [0x4c6288], 0xb5afa4b3
mov dword [0x4c628c], 0xb3aeb1e1
mov dword [0x4c6290], 0xa9b5e1b5
mov dword [0x4c6294], 0xb5e1afa0
mov dword [0x4c6298], 0xa2e1a4a9
mov dword [0x4c629c], 0xa4afafae
mov dword [0x4c62a0], 0xaea8b5a2
mov dword [0x4c62a4], 0xa0b6e1af
mov dword [0x4c62a8], 0xafa8e1b2
mov dword [0x4c62ac], 0xa0a8b5a8
mov dword [0x4c62b0], 0xa4bba8ad
mov dword [0x4c62b4], 0xa8b6e1a5
mov word [0x4c62b8], 0xa9b5
mov byte [0x4c62ba], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c6270]
xor cl, 0xc1
mov byte [eax + 0x4c6528], cl
inc eax
cmp eax, 0x4b
jb 0x42591e
mov eax, 0x4c6528
ret

Function at 0x425939
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7de8], 1
jne 0x42598f
or dword [0x4c7de8], 1
mov dword [0x4c62bc], 0x89afa896
mov dword [0x4c62c0], 0x8eb1b5b5
mov dword [0x4c62c4], 0x93afa4b1
mov dword [0x4c62c8], 0xa4b4b0a4
mov dword [0x4c62cc], 0xe8e9b5b2
mov dword [0x4c62d0], 0xa8a0a7e1
mov dword [0x4c62d4], 0xc1a5a4ad
xor eax, eax
mov cl, byte [eax + 0x4c62bc]
xor cl, 0xc1
mov byte [eax + 0x4c6574], cl
inc eax
cmp eax, 0x1c
jb 0x425991
mov eax, 0x4c6574
ret

Function at 0x4259ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7de4], 1
jne 0x425a7b
or dword [0x4c7de4], 1
mov dword [0x4c62d8], 0x89afa896
mov dword [0x4c62dc], 0x92b1b5b5
mov dword [0x4c62e0], 0xb18eb5a4
mov dword [0x4c62e4], 0xafaea8b5
mov dword [0x4c62e8], 0x8f8896e9
mov dword [0x4c62ec], 0x91959589
mov dword [0x4c62f0], 0x95918e9e
mov dword [0x4c62f4], 0x9e8f8e88
mov dword [0x4c62f8], 0x94828492
mov dword [0x4c62fc], 0x98958893
mov dword [0x4c6300], 0x808d879e
mov dword [0x4c6304], 0xe1e89286
mov dword [0x4c6308], 0xb3e1afae
mov dword [0x4c630c], 0xa4b4b0a4
mov dword [0x4c6310], 0xa9e1b5b2
mov dword [0x4c6314], 0xada5afa0
mov dword [0x4c6318], 0xa0a7e1a4
mov dword [0x4c631c], 0xa5a4ada8
mov byte [0x4c6320], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c62d8]
xor cl, 0xc1
mov byte [eax + 0x4c6590], cl
inc eax
cmp eax, 0x49
jb 0x425a7d
mov eax, 0x4c6590
ret
Function at 0x425a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7de0], 1
jne 0x425b66
or dword [0x4c7de0], 1
mov dword [0x4c6328], 0x89afa896
mov dword [0x4c632c], 0x92b1b5b5
mov dword [0x4c6330], 0xb18eb5a4
mov dword [0x4c6334], 0xafaea8b5
mov dword [0x4c6338], 0x8f8896e9
mov dword [0x4c633c], 0x91959589
mov dword [0x4c6340], 0x95918e9e
mov dword [0x4c6344], 0x9e8f8e88
mov dword [0x4c6348], 0x858f8492
mov dword [0x4c634c], 0x8c88959e
mov dword [0x4c6350], 0x95948e84
mov dword [0x4c6354], 0xafaee1e8
mov dword [0x4c6358], 0xb0a4b3e1
mov dword [0x4c635c], 0xb5b2a4b4
mov dword [0x4c6360], 0xafa0a9e1
mov dword [0x4c6364], 0xe1a4ada5
mov dword [0x4c6368], 0xada8a0a7
mov word [0x4c636c], 0xa5a4
mov byte [0x4c636e], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c6328]
xor cl, 0xc1
mov byte [eax + 0x4c65e0], cl
inc eax
cmp eax, 0x47
jb 0x425b68
mov eax, 0x4c65e0
ret

Function at 0x425b83
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7ddc], 1
jne 0x425bec
or dword [0x4c7ddc], 1
mov dword [0x4c6370], 0x89afa896
mov dword [0x4c6374], 0x80b1b5b5
mov dword [0x4c6378], 0xa493a5a5
mov dword [0x4c637c], 0xb2a4b4b0
mov dword [0x4c6380], 0xa0a489b5
mov dword [0x4c6384], 0xb2b3a4a5
mov dword [0x4c6388], 0xa7e1e8e9
mov dword [0x4c638c], 0xa4ada8a0
mov word [0x4c6390], 0xc1a5
xor eax, eax
mov cl, byte [eax + 0x4c6370]
xor cl, 0xc1
mov byte [eax + 0x4c6628], cl
inc eax
cmp eax, 0x22
jb 0x425bee
mov eax, 0x4c6628
ret

Function at 0x425c09
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dd8], 1
jne 0x425c5c
or dword [0x4c7dd8], 1
mov dword [0x4c6394], 0xb1b5b589
mov dword [0x4c6398], 0xa5afa492
mov dword [0x4c639c], 0xb4b0a493
mov dword [0x4c63a0], 0xe9b5b2a4
mov dword [0x4c63a4], 0xa0a7e1e8
mov dword [0x4c63a8], 0xa5a4ada8
mov byte [0x4c63ac], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c6394]
xor cl, 0xc1
mov byte [eax + 0x4c664c], cl
inc eax
cmp eax, 0x19
jb 0x425c5e
mov eax, 0x4c664c
ret

Function at 0x425c79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dd4], 1
jne 0x425ccb
or dword [0x4c7dd4], 1
mov dword [0x4c63b0], 0xb1b5b589
mov dword [0x4c63b4], 0xb3a4b490
mov dword [0x4c63b8], 0xa7af88b8
mov dword [0x4c63bc], 0xe1e8e9ae
mov dword [0x4c63c0], 0xada8a0a7
mov word [0x4c63c4], 0xa5a4
mov byte [0x4c63c6], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c63b0]
xor cl, 0xc1
mov byte [eax + 0x4c6668], cl
inc eax
cmp eax, 0x17
jb 0x425ccd
mov eax, 0x4c6668
ret
Function at 0x4264b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dcc], 1
jne 0x426522
or dword [0x4c7dcc], 1
mov dword [0x4c63cc], 0x89afa896
mov dword [0x4c63d0], 0x90b1b5b5
mov dword [0x4c63d4], 0xb8b3a4b4
mov dword [0x4c63d8], 0xa0b5a085
mov dword [0x4c63dc], 0xa8a0b780
mov dword [0x4c63e0], 0xada3a0ad
mov dword [0x4c63e4], 0xe1e8e9a4
mov dword [0x4c63e8], 0xada8a0a7
mov word [0x4c63ec], 0xa5a4
mov byte [0x4c63ee], 0xc1
xor eax, eax
mov cl, byte [eax + 0x4c63cc]
xor cl, 0xc1
mov byte [eax + 0x4c6684], cl
inc eax
cmp eax, 0x23
jb 0x426524
mov eax, 0x4c6684
ret

Function at 0x42653f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dc8], 1
jne 0x426594
or dword [0x4c7dc8], 1
mov dword [0x4c63f0], 0xa4b5af88
mov dword [0x4c63f4], 0xb5a4afb3
mov dword [0x4c63f8], 0xa5a0a493
mov dword [0x4c63fc], 0xa4ada887
mov dword [0x4c6400], 0xa7e1e8e9
mov dword [0x4c6404], 0xa4ada8a0
mov word [0x4c6408], 0xc1a5
xor eax, eax
mov cl, byte [eax + 0x4c63f0]
xor cl, 0xc1
mov byte [eax + 0x4c66a8], cl
inc eax
cmp eax, 0x1a
jb 0x426596
mov eax, 0x4c66a8
ret

Function at 0x42733b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dac], 1
jne 0x4273c2
or dword [0x4c7dac], 1
mov dword [0x4c66e0], 0xb7e2ac83
mov dword [0x4c66e4], 0xa1a7b0ac
mov dword [0x4c66e8], 0xabaca5ad
mov dword [0x4c66ec], 0xe2a6a7b8
mov dword [0x4c66f0], 0xa7a9adb6
mov dword [0x4c66f4], 0xa3b5e2ac
mov dword [0x4c66f8], 0xada4e2b1
mov dword [0x4c66fc], 0xe2a6acb7
mov dword [0x4c6700], 0xa1e2b6a3
mov dword [0x4c6704], 0xa3b0a3aa
mov dword [0x4c6708], 0xb0a7b6a1
mov word [0x4c670c], 0xc2e2
xor eax, eax
mov cl, byte [eax + 0x4c66e0]
xor cl, 0xc2
mov byte [eax + 0x4c6830], cl
inc eax
cmp eax, 0x2e
jb 0x4273c4
mov eax, 0x4c6830
ret
Function at 0x427808
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7da8], 1
jne 0x427864
or dword [0x4c7da8], 1
mov dword [0x4c6710], 0xb1b1ab8f
mov dword [0x4c6714], 0xe2a5acab
mov dword [0x4c6718], 0xa7aee2a3
mov dword [0x4c671c], 0xb2e2b6a4
mov dword [0x4c6720], 0xaca7b0a3
mov dword [0x4c6724], 0xb1a7aab6
mov word [0x4c6728], 0xb1ab
mov byte [0x4c672a], 0xc2
xor eax, eax
mov cl, byte [eax + 0x4c6710]
xor cl, 0xc2
mov byte [eax + 0x4c6860], cl
inc eax
cmp eax, 0x1b
jb 0x427866
mov eax, 0x4c6860
ret

Function at 0x427881
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7da4], 1
jne 0x4278ea
or dword [0x4c7da4], 1
mov dword [0x4c672c], 0xe2b6ad8c
mov dword [0x4c6730], 0xb7adaca7
mov dword [0x4c6734], 0xade2aaa5
mov dword [0x4c6738], 0xa3b0a7b2
mov dword [0x4c673c], 0xe2b1a6ac
mov dword [0x4c6740], 0xa7e2acab
mov dword [0x4c6744], 0xa7b0b2ba
mov dword [0x4c6748], 0xadabb1b1
mov word [0x4c674c], 0xc2ac
xor eax, eax
mov cl, byte [eax + 0x4c672c]
xor cl, 0xc2
mov byte [eax + 0x4c687c], cl
inc eax
cmp eax, 0x22
jb 0x4278ec
mov eax, 0x4c687c
ret

Function at 0x427907
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7da0], 1
jne 0x427967
or dword [0x4c7da0], 1
mov dword [0x4c6750], 0xe2adad96
mov dword [0x4c6754], 0xbbaca3af
mov dword [0x4c6758], 0xa7b2ade2
mov dword [0x4c675c], 0xa6aca3b0
mov dword [0x4c6760], 0xacabe2b1
mov dword [0x4c6764], 0xb2baa7e2
mov dword [0x4c6768], 0xb1b1a7b0
mov dword [0x4c676c], 0xc2acadab
xor eax, eax
mov cl, byte [eax + 0x4c6750]
xor cl, 0xc2
mov byte [eax + 0x4c68a0], cl
inc eax
cmp eax, 0x20
jb 0x427969
mov eax, 0x4c68a0
ret

Function at 0x427984
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d9c], 1
jne 0x4279da
or dword [0x4c7d9c], 1
mov dword [0x4c6770], 0xb1b1ab8f
mov dword [0x4c6774], 0xe2a5acab
mov dword [0x4c6778], 0xabb0e2a3
mov dword [0x4c677c], 0xe2b6aaa5
mov dword [0x4c6780], 0xa7b0a3b2
mov dword [0x4c6784], 0xa7aab6ac
mov dword [0x4c6788], 0xc2b1abb1
xor eax, eax
mov cl, byte [eax + 0x4c6770]
xor cl, 0xc2
mov byte [eax + 0x4c68c0], cl
inc eax
cmp eax, 0x1c
jb 0x4279dc
mov eax, 0x4c68c0
ret

Function at 0x4279f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d98], 1
jne 0x427a68
or dword [0x4c7d98], 1
mov dword [0x4c678c], 0xb0a3ac97
mov dword [0x4c6790], 0xb2ade2bb
mov dword [0x4c6794], 0xb6a3b0a7
mov dword [0x4c6798], 0xafe2b0ad
mov dword [0x4c679c], 0xe2b6b1b7
mov dword [0x4c67a0], 0xa7b4a3aa
mov dword [0x4c67a4], 0xa7acade2
mov dword [0x4c67a8], 0xa7b2ade2
mov dword [0x4c67ac], 0xa6aca3b0
mov byte [0x4c67b0], 0xc2
xor eax, eax
mov cl, byte [eax + 0x4c678c]
xor cl, 0xc2
mov byte [eax + 0x4c68dc], cl
inc eax
cmp eax, 0x25
jb 0x427a6a
mov eax, 0x4c68dc
ret
Function at 0x427a85
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d94], 1
jne 0x427aff
or dword [0x4c7d94], 1
mov dword [0x4c67b4], 0xa3acab80
mov dword [0x4c67b8], 0xade2bbb0
mov dword [0x4c67bc], 0xa3b0a7b2
mov dword [0x4c67c0], 0xe2b0adb6
mov dword [0x4c67c4], 0xb6b1b7af
mov dword [0x4c67c8], 0xb4a3aae2
mov dword [0x4c67cc], 0xb5b6e2a7
mov dword [0x4c67d0], 0xb2ade2ad
mov dword [0x4c67d4], 0xaca3b0a7
mov word [0x4c67d8], 0xb1a6
mov byte [0x4c67da], 0xc2
xor eax, eax
mov cl, byte [eax + 0x4c67b4]
xor cl, 0xc2
mov byte [eax + 0x4c6904], cl
inc eax
cmp eax, 0x27
jb 0x427b01
mov eax, 0x4c6904
ret

Function at 0x427b1c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d90], 1
jne 0x427b85
or dword [0x4c7d90], 1
mov dword [0x4c67dc], 0xa3acab80
mov dword [0x4c67e0], 0xade2bbb0
mov dword [0x4c67e4], 0xa3b0a7b2
mov dword [0x4c67e8], 0xe2b0adb6
mov dword [0x4c67ec], 0xe2b6adac
mov dword [0x4c67f0], 0xaeb2afab
mov dword [0x4c67f4], 0xaca7afa7
mov dword [0x4c67f8], 0xf8a6a7b6
mov word [0x4c67fc], 0xc2e2
xor eax, eax
mov cl, byte [eax + 0x4c67dc]
xor cl, 0xc2
mov byte [eax + 0x4c692c], cl
inc eax
cmp eax, 0x22
jb 0x427b87
mov eax, 0x4c692c
ret

Function at 0x428abb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d80], 1
mov edx, 0xdcc4
jne 0x428b4d
or dword [0x4c7d80], 1
lea ecx, [edx + 0x1d]
push esi
mov eax, ecx
mov word [0x4c698c], ax
add eax, 0xffffffb6
mov esi, eax
mov word [0x4c698e], si
lea eax, [edx - 0x34]
mov word [0x4c6994], ax
add eax, 0xfffffff1
mov esi, eax
mov word [0x4c6996], si
lea esi, [edx - 0x3b]
mov word [0x4c6998], si
add esi, 0xfffffff7
mov word [0x4c699a], si
lea esi, [edx - 0x2e]
mov word [0x4c699c], si
add esi, 0xfffffff7
mov eax, edx
mov word [0x4c699e], si
mov dword [0x4c6990], 0xdc97dc9d
mov dword [0x4c69a0], 0xdc81dc92
mov word [0x4c69a4], cx
mov word [0x4c69a6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c698c]
add eax, 2
mov word [eax + 0x4c6a46], cx
cmp eax, 0x1c
jb 0x428b4f
mov eax, 0x4c6a48
ret

Function at 0x428b6d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d7c], 1
jne 0x428bcc
or dword [0x4c7d7c], 1
mov dword [0x4c69a8], 0x92b0a183
mov dword [0x4c69ac], 0xa9b1a8ab
mov dword [0x4c69b0], 0xa2aa8da1
mov dword [0x4c69b4], 0xa5a9b6ab
mov dword [0x4c69b8], 0xaaabadb0
mov dword [0x4c69bc], 0xada582e4
mov dword [0x4c69c0], 0xfea0a1a8
mov word [0x4c69c4], 0xc4e4
xor eax, eax
mov cl, byte [eax + 0x4c69a8]
xor cl, 0xc4
mov byte [eax + 0x4c6a64], cl
inc eax
cmp eax, 0x1e
jb 0x428bce
mov eax, 0x4c6a64
ret
Function at 0x428dab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d78], 1
jne 0x428fd3
push ebx
push esi
push edi
mov edi, 0xdc8c
mov eax, edi
mov word [0x4c69c8], ax
add eax, 3
mov word [0x4c69ca], ax
lea esi, [edi - 0xb]
mov eax, esi
mov word [0x4c69cc], ax
add eax, 0x1c
mov word [0x4c69ce], ax
lea edx, [edi + 0xf]
mov eax, edx
mov word [0x4c69d0], ax
lea ecx, [edi - 4]
mov eax, ecx
mov word [0x4c69d2], ax
add eax, 3
mov word [0x4c69d4], ax
lea eax, [edi - 5]
mov word [0x4c69d6], ax
add eax, 0xfffffffe
mov ebx, eax
mov word [0x4c69d8], bx
mov word [0x4c69e0], ax
lea ebx, [edi - 3]
mov ecx, ebx
lea eax, [edi + 1]
mov word [0x4c69e6], ax
add edx, 0xfffffffd
mov eax, edx
mov word [0x4c69ec], ax
lea eax, [edi + 0xb]
mov word [0x4c69ee], ax
mov word [0x4c69de], cx
add ecx, 0x22
mov eax, ecx
mov word [0x4c69f0], ax
lea eax, [edi + 0x16]
mov word [0x4c69f2], ax
add eax, 0xe
mov word [0x4c69f4], ax
lea eax, [edi + 0x27]
add edi, 0x19
mov word [0x4c69f6], ax
mov eax, edi
mov word [0x4c69f8], ax
lea eax, [esi + 0x35]
or dword [0x4c7d78], 1
mov esi, eax
mov word [0x4c69fa], si
add esi, 0xffffffeb
mov word [0x4c6a00], bx
mov word [0x4c69fc], si
mov esi, edx
mov word [0x4c69fe], si
lea esi, [ebx + 0x24]
mov ebx, esi
mov word [0x4c6a02], bx
add ebx, 0xfffffffa
mov word [0x4c6a04], bx
mov ebx, eax
mov word [0x4c6a06], bx
mov ebx, ecx
mov word [0x4c6a08], bx
lea ebx, [eax + 1]
mov word [0x4c6a0a], bx
mov ebx, ecx
mov word [0x4c6a0c], bx
lea ebx, [eax - 0x14]
mov word [0x4c6a0e], bx
add ebx, 0xe
mov word [0x4c6a10], bx
mov ebx, edx
mov word [0x4c6a12], bx
mov dword [0x4c69da], 0xdc9bdc88
mov dword [0x4c69e2], 0xdc8cdc87
mov dword [0x4c69e8], 0xdc81dc8a
lea ebx, [eax - 0x2f]
mov word [0x4c6a14], bx
mov ebx, eax
mov word [0x4c6a16], bx
add ebx, 7
mov word [0x4c6a18], bx
lea ebx, [eax - 2]
mov eax, edi
mov word [0x4c6a24], ax
mov eax, ebx
mov word [0x4c6a26], ax
add eax, 0xfffffff8
mov ecx, eax
mov eax, esi
mov word [0x4c6a36], ax
add eax, 0xfffffffd
mov word [0x4c6a38], ax
lea eax, [esi - 0xc]
mov word [0x4c6a3a], ax
add eax, 0xffffffe2
mov word [0x4c6a3c], ax
lea eax, [esi - 0xd]
pop edi
mov word [0x4c6a42], ax
add eax, 0x24
pop esi
mov word [0x4c6a1a], bx
mov dword [0x4c6a1c], 0xdcabdcb0
mov dword [0x4c6a20], 0xdcb6dca3
mov word [0x4c6a28], cx
mov dword [0x4c6a2a], 0xdc98dcbd
mov dword [0x4c6a2e], 0xdca5dc89
mov dword [0x4c6a32], 0xdcacdca7
mov dword [0x4c6a3e], 0xdcaddcb1
mov word [0x4c6a44], ax
pop ebx
xor eax, eax
mov ecx, 0xdcc4
xor cx, word [eax + 0x4c69c8]
add eax, 2
mov word [eax + 0x4c6a86], cx
cmp eax, 0x7e
jb 0x428fd5
mov eax, 0x4c6a88
ret
Function at 0x429a77
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x429c39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x429c7b
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x4afee0]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x4afee0]
inc edx
cmp dword [ebp + 8], 0
jne 0x429c46
pop esi
not eax
pop ebp
ret

Function at 0x42b8c6
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x42b8eb
cmp dword [ecx + 0x38], ebx
je 0x42b8eb
cmp eax, dword [ecx + 0x10]
jae 0x42b8eb
cmp dword [ecx + 0x14], 1
jne 0x42b8eb
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x42b8ed
xor edi, edi
cmp edi, ebx
je 0x42b9d0
cmp esi, ebx
je 0x42b9d0
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0042b06f
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x42b97c
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00469f40
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x42b9a1
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00469f40
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x42b9d2
xor eax, eax
pop edi
pop ebx
ret
Function at 0x42cc86
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d70], 1
jne 0x42cd0b
or dword [0x4c7d70], 1
mov dword [0x4c6b0c], 0xaaafa780
mov dword [0x4c6b10], 0xb2e6a2a3
mov dword [0x4c6b14], 0xb4a5e6a9
mov dword [0x4c6b18], 0xa3b2a7a3
mov dword [0x4c6b1c], 0xa7b3aae6
mov dword [0x4c6b20], 0xa7b2b5e6
mov dword [0x4c6b24], 0xeee6a3b2
mov dword [0x4c6b28], 0xadb4a9b1
mov dword [0x4c6b2c], 0xb2e6b4a3
mov dword [0x4c6b30], 0xa7a3b4ae
mov dword [0x4c6b34], 0xe6fcefa2
mov byte [0x4c6b38], 0xc6
xor eax, eax
mov cl, byte [eax + 0x4c6b0c]
xor cl, 0xc6
mov byte [eax + 0x4c6bd4], cl
inc eax
cmp eax, 0x2d
jb 0x42cd0d
mov eax, 0x4c6bd4
ret

Function at 0x42cd28
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d60], 1
jne 0x42cd8f
or dword [0x4c7d60], 1
mov dword [0x4c6b48], 0xa3e6a988
mov dword [0x4c6b4c], 0xb4a9b4b4
mov dword [0x4c6b50], 0xb5a3abe6
mov dword [0x4c6b54], 0xa3a1a7b5
mov dword [0x4c6b58], 0xb2a3b4e6
mov dword [0x4c6b5c], 0xa3a8b4b3
mov dword [0x4c6b60], 0xbfa4e6a2
mov dword [0x4c6b64], 0xa4a9ace6
mov byte [0x4c6b68], 0xc6
xor eax, eax
mov cl, byte [eax + 0x4c6b48]
xor cl, 0xc6
mov byte [eax + 0x4c6c10], cl
inc eax
cmp eax, 0x21
jb 0x42cd91
mov eax, 0x4c6c10
ret

Function at 0x42cdac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d54], 1
jne 0x42ce15
or dword [0x4c7d54], 1
mov dword [0x4c6b94], 0xe6a7b38a
mov dword [0x4c6b98], 0xa9b4b4a3
mov dword [0x4c6b9c], 0xb3b4e6b4
mov dword [0x4c6ba0], 0xa8afa8a8
mov dword [0x4c6ba4], 0xb4a3e6a1
mov dword [0x4c6ba8], 0xe6b4a9b4
mov dword [0x4c6bac], 0xa2a8a7ae
mov dword [0x4c6bb0], 0xfcb4a3aa
mov word [0x4c6bb4], 0xc6e6
xor eax, eax
mov cl, byte [eax + 0x4c6b94]
xor cl, 0xc6
mov byte [eax + 0x4c6c5c], cl
inc eax
cmp eax, 0x22
jb 0x42ce17
mov eax, 0x4c6c5c
ret

Function at 0x42ce32
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d50], 1
jne 0x42ce84
or dword [0x4c7d50], 1
mov dword [0x4c6bb8], 0x8aa7b3aa
mov dword [0x4c6bbc], 0xa7a9aa99
mov dword [0x4c6bc0], 0xb4b2b5a2
mov dword [0x4c6bc4], 0xe6a1a8af
mov dword [0x4c6bc8], 0xaaafa7a0
mov word [0x4c6bcc], 0xa2a3
mov byte [0x4c6bce], 0xc6
xor eax, eax
mov cl, byte [eax + 0x4c6bb8]
xor cl, 0xc6
mov byte [eax + 0x4c6c80], cl
inc eax
cmp eax, 0x17
jb 0x42ce86
mov eax, 0x4c6c80
ret