joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421f07
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c27cc], 1
jne 0x421f6e
or dword [0x4c27cc], 1
mov dword [0x4c0a48], 0x4b444a4f
mov dword [0x4c0a4c], 0x46505657
mov dword [0x4c0a50], 0x57424751
mov dword [0x4c0a54], 0x46507c42
mov dword [0x4c0a58], 0x42557c57
mov dword [0x4c0a5c], 0x4d424a51
mov dword [0x4c0a60], 0x564d7c57
mov dword [0x4c0a64], 0x5146414e
mov byte [0x4c0a68], 0x23
xor eax, eax
mov cl, byte [eax + 0x4c0a48]
xor cl, 0x23
mov byte [eax + 0x4c0c20], cl
inc eax
cmp eax, 0x21
jb 0x421f70
mov eax, 0x4c0c20
ret

Function at 0x421f8b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c27c8], 1
jne 0x421ff4
or dword [0x4c27c8], 1
mov dword [0x4c0a6c], 0x4b444a4f
mov dword [0x4c0a70], 0x46505657
mov dword [0x4c0a74], 0x57424751
mov dword [0x4c0a78], 0x46507c42
mov dword [0x4c0a7c], 0x42557c57
mov dword [0x4c0a80], 0x4d424a51
mov dword [0x4c0a84], 0x4c417c57
mov dword [0x4c0a88], 0x42464f4c
mov word [0x4c0a8c], 0x234d
xor eax, eax
mov cl, byte [eax + 0x4c0a6c]
xor cl, 0x23
mov byte [eax + 0x4c0c44], cl
inc eax
cmp eax, 0x22
jb 0x421ff6
mov eax, 0x4c0c44
ret

Function at 0x422011
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c27c4], 1
jne 0x422077
or dword [0x4c27c4], 1
mov dword [0x4c0a90], 0x4b444a4f
mov dword [0x4c0a94], 0x46505657
mov dword [0x4c0a98], 0x57424751
mov dword [0x4c0a9c], 0x46507c42
mov dword [0x4c0aa0], 0x42557c57
mov dword [0x4c0aa4], 0x4d424a51
mov dword [0x4c0aa8], 0x564d7c57
mov word [0x4c0aac], 0x4f4f
mov byte [0x4c0aae], 0x23
xor eax, eax
mov cl, byte [eax + 0x4c0a90]
xor cl, 0x23
mov byte [eax + 0x4c0c68], cl
inc eax
cmp eax, 0x1f
jb 0x422079
mov eax, 0x4c0c68
ret

Function at 0x422309
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48a9ed
call fcn.00489c38
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x4920a8]
test byte [0x4c27a4], 1
mov edi, eax
jne 0x422356
or dword [0x4c27a4], 1
mov dword [0x4c0d04], 0x4d4a4d53
mov dword [0x4c0d08], 0xa50414a
mov dword [0x4c0d0c], 0x24484840
xor ecx, ecx
mov al, byte [ecx + 0x4c0d04]
xor al, 0x24
mov byte [ecx + 0x4c0fbc], al
inc ecx
cmp ecx, 0xc
jb 0x422358
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x4c0fbc
call dword [0x4920d4]
push eax
push 0x1b00
call dword [0x49212c]
test eax, eax
jne 0x4223a4
call fcn.0042241a
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040d2ba
pop ecx
pop ecx
jmp 0x422409
test byte [0x4c279c], 1
jne 0x4223c4
or dword [0x4c279c], 1
mov word [0x4c0d2c], 0x41e
mov byte [0x4c0d2e], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0d2c]
xor cl, 0x24
mov byte [eax + 0x4c0fe4], cl
inc eax
cmp eax, 3
jb 0x4223c6
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x4c0fe4
push eax
call fcn.0040d2ba
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0040d66d
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404cea
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42241a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c27a0], 1
jne 0x42246f
or dword [0x4c27a0], 1
mov dword [0x4c0d10], 0x45620c04
mov dword [0x4c0d14], 0x4041484d
mov dword [0x4c0d18], 0x44b5004
mov dword [0x4c0d1c], 0x49564b42
mov dword [0x4c0d20], 0x41045045
mov dword [0x4c0d24], 0x564b5656
mov word [0x4c0d28], 0x240d
xor eax, eax
mov cl, byte [eax + 0x4c0d10]
xor cl, 0x24
mov byte [eax + 0x4c0fc8], cl
inc eax
cmp eax, 0x1a
jb 0x422471
mov eax, 0x4c0fc8
ret

Function at 0x4225da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2798], 1
jne 0x422623
or dword [0x4c2798], 1
mov dword [0x4c0d30], 0x6c4a4d73
mov dword [0x4c0d34], 0x6b545050
mov dword [0x4c0d38], 0xc4a4154
mov dword [0x4c0d3c], 0x4542040d
mov dword [0x4c0d40], 0x4041484d
mov byte [0x4c0d44], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0d30]
xor cl, 0x24
mov byte [eax + 0x4c0fe8], cl
inc eax
cmp eax, 0x15
jb 0x422625
mov eax, 0x4c0fe8
ret

Function at 0x4228ea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2794], 1
jne 0x42293d
or dword [0x4c2794], 1
mov dword [0x4c0d48], 0x6c4a4d73
mov dword [0x4c0d4c], 0x67545050
mov dword [0x4c0d50], 0x4f474556
mov dword [0x4c0d54], 0xc485671
mov dword [0x4c0d58], 0x4542040d
mov dword [0x4c0d5c], 0x4041484d
mov byte [0x4c0d60], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0d48]
xor cl, 0x24
mov byte [eax + 0x4c1000], cl
inc eax
cmp eax, 0x19
jb 0x42293f
mov eax, 0x4c1000
ret

Function at 0x42295a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2790], 1
jne 0x4229a6
or dword [0x4c2790], 1
mov dword [0x4c0d64], 0x6c4a4d73
mov dword [0x4c0d68], 0x67545050
mov dword [0x4c0d6c], 0x414a4a4b
mov dword [0x4c0d70], 0xd0c5047
mov dword [0x4c0d74], 0x4d454204
mov dword [0x4c0d78], 0x24404148
xor eax, eax
mov cl, byte [eax + 0x4c0d64]
xor cl, 0x24
mov byte [eax + 0x4c101c], cl
inc eax
cmp eax, 0x18
jb 0x4229a8
mov eax, 0x4c101c
ret

Function at 0x4232ff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c278c], 1
jne 0x4233d8
or dword [0x4c278c], 1
mov dword [0x4c0d80], 0x51554176
mov dword [0x4c0d84], 0x4505741
mov dword [0x4c0d88], 0x4485651
mov dword [0x4c0d8c], 0x40415751
mov dword [0x4c0d90], 0x40044504
mov dword [0x4c0d94], 0x4142424d
mov dword [0x4c0d98], 0x504a4156
mov dword [0x4c0d9c], 0x4c475704
mov dword [0x4c0da0], 0x4414941
mov dword [0x4c0da4], 0x4a454c50
mov dword [0x4c0da8], 0x414c5004
mov dword [0x4c0dac], 0x4a4b4704
mov dword [0x4c0db0], 0x5047414a
mov dword [0x4c0db4], 0x44a4b4d
mov dword [0x4c0db8], 0x4574553
mov dword [0x4c0dbc], 0x504d4a4d
mov dword [0x4c0dc0], 0x4d48454d
mov dword [0x4c0dc4], 0x440415e
mov dword [0x4c0dc8], 0x4c504d53
mov byte [0x4c0dcc], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0d80]
xor cl, 0x24
mov byte [eax + 0x4c1038], cl
inc eax
cmp eax, 0x4d
jb 0x4233da
mov eax, 0x4c1038
ret
Function at 0x4233f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2788], 1
jne 0x4234d1
or dword [0x4c2788], 1
mov dword [0x4c0dd0], 0x51554176
mov dword [0x4c0dd4], 0x4505741
mov dword [0x4c0dd8], 0x4485651
mov dword [0x4c0ddc], 0x40415751
mov dword [0x4c0de0], 0x40044504
mov dword [0x4c0de4], 0x4142424d
mov dword [0x4c0de8], 0x504a4156
mov dword [0x4c0dec], 0x574b4c04
mov dword [0x4c0df0], 0x454a0450
mov dword [0x4c0df4], 0x50044149
mov dword [0x4c0df8], 0x44a454c
mov dword [0x4c0dfc], 0x4414c50
mov dword [0x4c0e00], 0x4a4a4b47
mov dword [0x4c0e04], 0x4d504741
mov dword [0x4c0e08], 0x53044a4b
mov dword [0x4c0e0c], 0x4d045745
mov dword [0x4c0e10], 0x4d504d4a
mov dword [0x4c0e14], 0x5e4d4845
mov dword [0x4c0e18], 0x53044041
mov dword [0x4c0e1c], 0x244c504d
xor eax, eax
mov cl, byte [eax + 0x4c0dd0]
xor cl, 0x24
mov byte [eax + 0x4c1088], cl
inc eax
cmp eax, 0x50
jb 0x4234d3
mov eax, 0x4c1088
ret

Function at 0x4234ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2784], 1
jne 0x4235c6
or dword [0x4c2784], 1
mov dword [0x4c0e20], 0x51554176
mov dword [0x4c0e24], 0x4505741
mov dword [0x4c0e28], 0x4485651
mov dword [0x4c0e2c], 0x40415751
mov dword [0x4c0e30], 0x40044504
mov dword [0x4c0e34], 0x4142424d
mov dword [0x4c0e38], 0x504a4156
mov dword [0x4c0e3c], 0x564b5404
mov dword [0x4c0e40], 0x4c500450
mov dword [0x4c0e44], 0x50044a45
mov dword [0x4c0e48], 0x4704414c
mov dword [0x4c0e4c], 0x414a4a4b
mov dword [0x4c0e50], 0x4b4d5047
mov dword [0x4c0e54], 0x4553044a
mov dword [0x4c0e58], 0x4a4d0457
mov dword [0x4c0e5c], 0x454d504d
mov dword [0x4c0e60], 0x415e4d48
mov dword [0x4c0e64], 0x4d530440
mov word [0x4c0e68], 0x4c50
mov byte [0x4c0e6a], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0e20]
xor cl, 0x24
mov byte [eax + 0x4c10d8], cl
inc eax
cmp eax, 0x4b
jb 0x4235c8
mov eax, 0x4c10d8
ret

Function at 0x4235e3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2780], 1
jne 0x423639
or dword [0x4c2780], 1
mov dword [0x4c0e6c], 0x6c4a4d73
mov dword [0x4c0e70], 0x6b545050
mov dword [0x4c0e74], 0x764a4154
mov dword [0x4c0e78], 0x41515541
mov dword [0x4c0e7c], 0xd0c5057
mov dword [0x4c0e80], 0x4d454204
mov dword [0x4c0e84], 0x24404148
xor eax, eax
mov cl, byte [eax + 0x4c0e6c]
xor cl, 0x24
mov byte [eax + 0x4c1124], cl
inc eax
cmp eax, 0x1c
jb 0x42363b
mov eax, 0x4c1124
ret
Function at 0x423656
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c277c], 1
jne 0x423725
or dword [0x4c277c], 1
mov dword [0x4c0e88], 0x6c4a4d73
mov dword [0x4c0e8c], 0x77545050
mov dword [0x4c0e90], 0x546b5041
mov dword [0x4c0e94], 0x4a4b4d50
mov dword [0x4c0e98], 0x6a6d730c
mov dword [0x4c0e9c], 0x7470706c
mov dword [0x4c0ea0], 0x70746b7b
mov dword [0x4c0ea4], 0x7b6a6b6d
mov dword [0x4c0ea8], 0x71676177
mov dword [0x4c0eac], 0x7d706d76
mov dword [0x4c0eb0], 0x6568627b
mov dword [0x4c0eb4], 0x40d7763
mov dword [0x4c0eb8], 0x56044a4b
mov dword [0x4c0ebc], 0x41515541
mov dword [0x4c0ec0], 0x4c045057
mov dword [0x4c0ec4], 0x48404a45
mov dword [0x4c0ec8], 0x45420441
mov dword [0x4c0ecc], 0x4041484d
mov byte [0x4c0ed0], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0e88]
xor cl, 0x24
mov byte [eax + 0x4c1140], cl
inc eax
cmp eax, 0x49
jb 0x423727
mov eax, 0x4c1140
ret

Function at 0x423742
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2778], 1
jne 0x423810
or dword [0x4c2778], 1
mov dword [0x4c0ed8], 0x6c4a4d73
mov dword [0x4c0edc], 0x77545050
mov dword [0x4c0ee0], 0x546b5041
mov dword [0x4c0ee4], 0x4a4b4d50
mov dword [0x4c0ee8], 0x6a6d730c
mov dword [0x4c0eec], 0x7470706c
mov dword [0x4c0ef0], 0x70746b7b
mov dword [0x4c0ef4], 0x7b6a6b6d
mov dword [0x4c0ef8], 0x606a6177
mov dword [0x4c0efc], 0x696d707b
mov dword [0x4c0f00], 0x70716b61
mov dword [0x4c0f04], 0x4a4b040d
mov dword [0x4c0f08], 0x55415604
mov dword [0x4c0f0c], 0x50574151
mov dword [0x4c0f10], 0x4a454c04
mov dword [0x4c0f14], 0x4414840
mov dword [0x4c0f18], 0x484d4542
mov word [0x4c0f1c], 0x4041
mov byte [0x4c0f1e], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0ed8]
xor cl, 0x24
mov byte [eax + 0x4c1190], cl
inc eax
cmp eax, 0x47
jb 0x423812
mov eax, 0x4c1190
ret

Function at 0x42382d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2774], 1
jne 0x423896
or dword [0x4c2774], 1
mov dword [0x4c0f20], 0x6c4a4d73
mov dword [0x4c0f24], 0x65545050
mov dword [0x4c0f28], 0x41764040
mov dword [0x4c0f2c], 0x57415155
mov dword [0x4c0f30], 0x45416c50
mov dword [0x4c0f34], 0x57564140
mov dword [0x4c0f38], 0x42040d0c
mov dword [0x4c0f3c], 0x41484d45
mov word [0x4c0f40], 0x2440
xor eax, eax
mov cl, byte [eax + 0x4c0f20]
xor cl, 0x24
mov byte [eax + 0x4c11d8], cl
inc eax
cmp eax, 0x22
jb 0x423898
mov eax, 0x4c11d8
ret

Function at 0x4238b3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2770], 1
jne 0x423906
or dword [0x4c2770], 1
mov dword [0x4c0f44], 0x5450506c
mov dword [0x4c0f48], 0x404a4177
mov dword [0x4c0f4c], 0x51554176
mov dword [0x4c0f50], 0xc505741
mov dword [0x4c0f54], 0x4542040d
mov dword [0x4c0f58], 0x4041484d
mov byte [0x4c0f5c], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0f44]
xor cl, 0x24
mov byte [eax + 0x4c11fc], cl
inc eax
cmp eax, 0x19
jb 0x423908
mov eax, 0x4c11fc
ret
Function at 0x423923
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c276c], 1
jne 0x423975
or dword [0x4c276c], 1
mov dword [0x4c0f60], 0x5450506c
mov dword [0x4c0f64], 0x56415175
mov dword [0x4c0f68], 0x424a6d5d
mov dword [0x4c0f6c], 0x40d0c4b
mov dword [0x4c0f70], 0x484d4542
mov word [0x4c0f74], 0x4041
mov byte [0x4c0f76], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0f60]
xor cl, 0x24
mov byte [eax + 0x4c1218], cl
inc eax
cmp eax, 0x17
jb 0x423977
mov eax, 0x4c1218
ret
Function at 0x424155
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2764], 1
jne 0x4241c5
or dword [0x4c2764], 1
mov dword [0x4c0f7c], 0x6c4a4d73
mov dword [0x4c0f80], 0x75545050
mov dword [0x4c0f84], 0x5d564151
mov dword [0x4c0f88], 0x45504560
mov dword [0x4c0f8c], 0x4d455265
mov dword [0x4c0f90], 0x48464548
mov dword [0x4c0f94], 0x40d0c41
mov dword [0x4c0f98], 0x484d4542
mov word [0x4c0f9c], 0x4041
mov byte [0x4c0f9e], 0x24
xor eax, eax
mov cl, byte [eax + 0x4c0f7c]
xor cl, 0x24
mov byte [eax + 0x4c1234], cl
inc eax
cmp eax, 0x23
jb 0x4241c7
mov eax, 0x4c1234
ret

Function at 0x4241e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2760], 1
jne 0x424237
or dword [0x4c2760], 1
mov dword [0x4c0fa0], 0x41504a6d
mov dword [0x4c0fa4], 0x50414a56
mov dword [0x4c0fa8], 0x40454176
mov dword [0x4c0fac], 0x41484d62
mov dword [0x4c0fb0], 0x42040d0c
mov dword [0x4c0fb4], 0x41484d45
mov word [0x4c0fb8], 0x2440
xor eax, eax
mov cl, byte [eax + 0x4c0fa0]
xor cl, 0x24
mov byte [eax + 0x4c1258], cl
inc eax
cmp eax, 0x1a
jb 0x424239
mov eax, 0x4c1258
ret

Function at 0x425037
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2744], 1
jne 0x4250be
or dword [0x4c2744], 1
mov dword [0x4c1290], 0x50054b64
mov dword [0x4c1294], 0x4640574b
mov dword [0x4c1298], 0x4c4b424a
mov dword [0x4c129c], 0x541405f
mov dword [0x4c12a0], 0x404e4a51
mov dword [0x4c12a4], 0x4452054b
mov dword [0x4c12a8], 0x4a430556
mov dword [0x4c12ac], 0x5414b50
mov dword [0x4c12b0], 0x46055144
mov dword [0x4c12b4], 0x4457444d
mov dword [0x4c12b8], 0x57405146
mov word [0x4c12bc], 0x2505
xor eax, eax
mov cl, byte [eax + 0x4c1290]
xor cl, 0x25
mov byte [eax + 0x4c13e0], cl
inc eax
cmp eax, 0x2e
jb 0x4250c0
mov eax, 0x4c13e0
ret
Function at 0x425504
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2740], 1
jne 0x425560
or dword [0x4c2740], 1
mov dword [0x4c12c0], 0x56564c68
mov dword [0x4c12c4], 0x5424b4c
mov dword [0x4c12c8], 0x40490544
mov dword [0x4c12cc], 0x55055143
mov dword [0x4c12d0], 0x4b405744
mov dword [0x4c12d4], 0x56404d51
mov word [0x4c12d8], 0x564c
mov byte [0x4c12da], 0x25
xor eax, eax
mov cl, byte [eax + 0x4c12c0]
xor cl, 0x25
mov byte [eax + 0x4c1410], cl
inc eax
cmp eax, 0x1b
jb 0x425562
mov eax, 0x4c1410
ret

Function at 0x42557d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c273c], 1
jne 0x4255e6
or dword [0x4c273c], 1
mov dword [0x4c12dc], 0x5514a6b
mov dword [0x4c12e0], 0x504a4b40
mov dword [0x4c12e4], 0x4a054d42
mov dword [0x4c12e8], 0x44574055
mov dword [0x4c12ec], 0x556414b
mov dword [0x4c12f0], 0x40054b4c
mov dword [0x4c12f4], 0x4057555d
mov dword [0x4c12f8], 0x4a4c5656
mov word [0x4c12fc], 0x254b
xor eax, eax
mov cl, byte [eax + 0x4c12dc]
xor cl, 0x25
mov byte [eax + 0x4c142c], cl
inc eax
cmp eax, 0x22
jb 0x4255e8
mov eax, 0x4c142c
ret

Function at 0x425603
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2738], 1
jne 0x425663
or dword [0x4c2738], 1
mov dword [0x4c1300], 0x54a4a71
mov dword [0x4c1304], 0x5c4b4448
mov dword [0x4c1308], 0x40554a05
mov dword [0x4c130c], 0x414b4457
mov dword [0x4c1310], 0x4b4c0556
mov dword [0x4c1314], 0x555d4005
mov dword [0x4c1318], 0x56564057
mov dword [0x4c131c], 0x254b4a4c
xor eax, eax
mov cl, byte [eax + 0x4c1300]
xor cl, 0x25
mov byte [eax + 0x4c1450], cl
inc eax
cmp eax, 0x20
jb 0x425665
mov eax, 0x4c1450
ret

Function at 0x425680
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2734], 1
jne 0x4256d6
or dword [0x4c2734], 1
mov dword [0x4c1320], 0x56564c68
mov dword [0x4c1324], 0x5424b4c
mov dword [0x4c1328], 0x4c570544
mov dword [0x4c132c], 0x5514d42
mov dword [0x4c1330], 0x40574455
mov dword [0x4c1334], 0x404d514b
mov dword [0x4c1338], 0x25564c56
xor eax, eax
mov cl, byte [eax + 0x4c1320]
xor cl, 0x25
mov byte [eax + 0x4c1470], cl
inc eax
cmp eax, 0x1c
jb 0x4256d8
mov eax, 0x4c1470
ret

Function at 0x4256f3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2730], 1
jne 0x425764
or dword [0x4c2730], 1
mov dword [0x4c133c], 0x57444b70
mov dword [0x4c1340], 0x554a055c
mov dword [0x4c1344], 0x51445740
mov dword [0x4c1348], 0x4805574a
mov dword [0x4c134c], 0x5515650
mov dword [0x4c1350], 0x4053444d
mov dword [0x4c1354], 0x404b4a05
mov dword [0x4c1358], 0x40554a05
mov dword [0x4c135c], 0x414b4457
mov byte [0x4c1360], 0x25
xor eax, eax
mov cl, byte [eax + 0x4c133c]
xor cl, 0x25
mov byte [eax + 0x4c148c], cl
inc eax
cmp eax, 0x25
jb 0x425766
mov eax, 0x4c148c
ret
Function at 0x425781
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c272c], 1
jne 0x4257fb
or dword [0x4c272c], 1
mov dword [0x4c1364], 0x444b4c67
mov dword [0x4c1368], 0x4a055c57
mov dword [0x4c136c], 0x44574055
mov dword [0x4c1370], 0x5574a51
mov dword [0x4c1374], 0x51565048
mov dword [0x4c1378], 0x53444d05
mov dword [0x4c137c], 0x52510540
mov dword [0x4c1380], 0x554a054a
mov dword [0x4c1384], 0x4b445740
mov word [0x4c1388], 0x5641
mov byte [0x4c138a], 0x25
xor eax, eax
mov cl, byte [eax + 0x4c1364]
xor cl, 0x25
mov byte [eax + 0x4c14b4], cl
inc eax
cmp eax, 0x27
jb 0x4257fd
mov eax, 0x4c14b4
ret

Function at 0x425818
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2728], 1
jne 0x425881
or dword [0x4c2728], 1
mov dword [0x4c138c], 0x444b4c67
mov dword [0x4c1390], 0x4a055c57
mov dword [0x4c1394], 0x44574055
mov dword [0x4c1398], 0x5574a51
mov dword [0x4c139c], 0x5514a4b
mov dword [0x4c13a0], 0x4955484c
mov dword [0x4c13a4], 0x4b404840
mov dword [0x4c13a8], 0x1f414051
mov word [0x4c13ac], 0x2505
xor eax, eax
mov cl, byte [eax + 0x4c138c]
xor cl, 0x25
mov byte [eax + 0x4c14dc], cl
inc eax
cmp eax, 0x22
jb 0x425883
mov eax, 0x4c14dc
ret
Function at 0x427233
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x427275
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x4abe20]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x4abe20]
inc edx
cmp dword [ebp + 8], 0
jne 0x427240
pop esi
not eax
pop ebp
ret

Function at 0x428ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x428ee5
cmp dword [ecx + 0x38], ebx
je 0x428ee5
cmp eax, dword [ecx + 0x10]
jae 0x428ee5
cmp dword [ecx + 0x14], 1
jne 0x428ee5
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x428ee7
xor edi, edi
cmp edi, ebx
je 0x428fca
cmp esi, ebx
je 0x428fca
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00428669
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x428f76
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00466fe0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x428f9b
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00466fe0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x428fcc
xor eax, eax
pop edi
pop ebx
ret

Function at 0x4299c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c271c], 1
jne 0x429a45
or dword [0x4c271c], 1
mov dword [0x4c1518], 0x4a4f4760
mov dword [0x4c151c], 0x52064243
mov dword [0x4c1520], 0x54450649
mov dword [0x4c1524], 0x43524743
mov dword [0x4c1528], 0x47534a06
mov dword [0x4c152c], 0x47525506
mov dword [0x4c1530], 0xe064352
mov dword [0x4c1534], 0x4d544951
mov dword [0x4c1538], 0x52065443
mov dword [0x4c153c], 0x4743544e
mov dword [0x4c1540], 0x61c0f42
mov byte [0x4c1544], 0x26
xor eax, eax
mov cl, byte [eax + 0x4c1518]
xor cl, 0x26
mov byte [eax + 0x4c15e0], cl
inc eax
cmp eax, 0x2d
jb 0x429a47
mov eax, 0x4c15e0
ret
Function at 0x429a62
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c270c], 1
jne 0x429ac9
or dword [0x4c270c], 1
mov dword [0x4c1554], 0x43064968
mov dword [0x4c1558], 0x54495454
mov dword [0x4c155c], 0x55434b06
mov dword [0x4c1560], 0x43414755
mov dword [0x4c1564], 0x52435406
mov dword [0x4c1568], 0x43485453
mov dword [0x4c156c], 0x5f440642
mov dword [0x4c1570], 0x44494c06
mov byte [0x4c1574], 0x26
xor eax, eax
mov cl, byte [eax + 0x4c1554]
xor cl, 0x26
mov byte [eax + 0x4c161c], cl
inc eax
cmp eax, 0x21
jb 0x429acb
mov eax, 0x4c161c
ret

Function at 0x429ae6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2700], 1
jne 0x429b4f
or dword [0x4c2700], 1
mov dword [0x4c15a0], 0x647536a
mov dword [0x4c15a4], 0x49545443
mov dword [0x4c15a8], 0x53540654
mov dword [0x4c15ac], 0x484f4848
mov dword [0x4c15b0], 0x54430641
mov dword [0x4c15b4], 0x6544954
mov dword [0x4c15b8], 0x4248474e
mov dword [0x4c15bc], 0x1c54434a
mov word [0x4c15c0], 0x2606
xor eax, eax
mov cl, byte [eax + 0x4c15a0]
xor cl, 0x26
mov byte [eax + 0x4c1668], cl
inc eax
cmp eax, 0x22
jb 0x429b51
mov eax, 0x4c1668
ret

Function at 0x429b6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c26fc], 1
jne 0x429bbe
or dword [0x4c26fc], 1
mov dword [0x4c15c4], 0x6a47534a
mov dword [0x4c15c8], 0x47494a79
mov dword [0x4c15cc], 0x54525542
mov dword [0x4c15d0], 0x641484f
mov dword [0x4c15d4], 0x4a4f4740
mov word [0x4c15d8], 0x4243
mov byte [0x4c15da], 0x26
xor eax, eax
mov cl, byte [eax + 0x4c15c4]
xor cl, 0x26
mov byte [eax + 0x4c168c], cl
inc eax
cmp eax, 0x17
jb 0x429bc0
mov eax, 0x4c168c
ret