joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406465
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83a4], 1
jne 0x4064ba
or dword [0x4c83a4], 1
mov dword [0x4c286c], 0x97b396ac
mov dword [0x4c2870], 0xab9b9087
mov dword [0x4c2874], 0x908d848c
mov dword [0x4c2878], 0x8b96838f
mov dword [0x4c287c], 0x90b28c8d
mov dword [0x4c2880], 0x9187818d
mov word [0x4c2884], 0xe291
xor eax, eax
mov cl, byte [eax + 0x4c286c]
xor cl, 0xe2
mov byte [eax + 0x4c2a6c], cl
inc eax
cmp eax, 0x1a
jb 0x4064bc
mov eax, 0x4c2a6c
ret

Function at 0x4064d7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c83a0], 1
jne 0x40656d
or dword [0x4c83a0], 1
mov dword [0x4c2888], 0xb29687a5
mov dword [0x4c288c], 0xa3818d90
mov dword [0x4c2890], 0x87908686
mov dword [0x4c2894], 0x84c29191
mov dword [0x4c2898], 0x878e8b83
mov dword [0x4c289c], 0xaccac286
mov dword [0x4c28a0], 0x8797b396
mov dword [0x4c28a4], 0x8cab9b90
mov dword [0x4c28a8], 0x8f908d84
mov dword [0x4c28ac], 0x8d8b9683
mov dword [0x4c28b0], 0x8d90b28c
mov dword [0x4c28b4], 0x91918781
mov dword [0x4c28b8], 0xe2c2d8cb
xor eax, eax
mov cl, byte [eax + 0x4c2888]
xor cl, 0xe2
mov byte [eax + 0x4c2a88], cl
inc eax
cmp eax, 0x34
jb 0x40656f
mov eax, 0x4c2a88
ret

Function at 0x40658a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c839c], 1
jne 0x4065fa
or dword [0x4c839c], 1
mov dword [0x4c28bc], 0x97b396ac
mov dword [0x4c28c0], 0xab9b9087
mov dword [0x4c28c4], 0x908d848c
mov dword [0x4c28c8], 0x8b96838f
mov dword [0x4c28cc], 0x90b28c8d
mov dword [0x4c28d0], 0x9187818d
mov dword [0x4c28d4], 0x8384c291
mov dword [0x4c28d8], 0x86878e8b
mov word [0x4c28dc], 0xc2d8
mov byte [0x4c28de], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c28bc]
xor cl, 0xe2
mov byte [eax + 0x4c2abc], cl
inc eax
cmp eax, 0x23
jb 0x4065fc
mov eax, 0x4c2abc
ret

Function at 0x406617
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8398], 1
jne 0x406660
or dword [0x4c8398], 1
mov dword [0x4c28e0], 0x8c8792ad
mov dword [0x4c28e4], 0x818d90b2
mov dword [0x4c28e8], 0xc2919187
mov dword [0x4c28ec], 0x8e8b8384
mov dword [0x4c28f0], 0xc2d88687
mov byte [0x4c28f4], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c28e0]
xor cl, 0xe2
mov byte [eax + 0x4c2ae0], cl
inc eax
cmp eax, 0x15
jb 0x406662
mov eax, 0x4c2ae0
ret
Function at 0x40667d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48e0a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x4c8394], 1
push esi
push edi
jne 0x4066da
or dword [0x4c8394], 1
mov dword [0x4c28f8], 0x8c908789
mov dword [0x4c28fc], 0xd0d18e87
mov dword [0x4c2900], 0x8e8e86cc
mov byte [0x4c2904], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c28f8]
xor cl, 0xe2
mov byte [eax + 0x4c2af8], cl
inc eax
cmp eax, 0xd
jb 0x4066dc
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x4c2af8
call edi
mov esi, eax
test esi, esi
jne 0x406750
call dword [0x4960a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0042dd34
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.004068b2
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00406c50
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00405d39
push 0x4b2d20
mov eax, esi
push eax
call fcn.00470885
call fcn.0040692f
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x40681d
call fcn.004069a2
push eax
call edi
mov edi, eax
test edi, edi
jne 0x4067c1
call dword [0x4960a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042dd34
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.004069ec
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406c50
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00405d39
push 0x4b2d20
mov eax, esi
jmp 0x40674a
call fcn.00406a66
push eax
push edi
call esi
test eax, eax
jne 0x40681d
call dword [0x4960a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042dd34
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00406ad6
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406c50
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00405d39
push 0x4b2d20
mov eax, esi
jmp 0x40674a
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x40687f
call dword [0x4960a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042dd34
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00406b8f
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406c50
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00405d39
push 0x4b2d20
mov eax, esi
jmp 0x40674a
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404dcd
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4068b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8390], 1
jne 0x406912
or dword [0x4c8390], 1
mov dword [0x4c2908], 0x86838dae
mov dword [0x4c290c], 0x90808bae
mov dword [0x4c2910], 0xc29b9083
mov dword [0x4c2914], 0x8e8b8384
mov dword [0x4c2918], 0xcac28687
mov dword [0x4c291c], 0x8c908789
mov dword [0x4c2920], 0xd0d18e87
mov dword [0x4c2924], 0xe2c2d8cb
xor eax, eax
mov cl, byte [eax + 0x4c2908]
xor cl, 0xe2
mov byte [eax + 0x4c2b08], cl
inc eax
cmp eax, 0x20
jb 0x406914
mov eax, 0x4c2b08
ret
Function at 0x40692f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c838c], 1
jne 0x406985
or dword [0x4c838c], 1
mov dword [0x4c2928], 0xa5d0d1a9
mov dword [0x4c292c], 0x90b29687
mov dword [0x4c2930], 0x9187818d
mov dword [0x4c2934], 0x838fab91
mov dword [0x4c2938], 0x8ba48785
mov dword [0x4c293c], 0x83ac878e
mov dword [0x4c2940], 0xe2a3878f
xor eax, eax
mov cl, byte [eax + 0x4c2928]
xor cl, 0xe2
mov byte [eax + 0x4c2b28], cl
inc eax
cmp eax, 0x1c
jb 0x406987
mov eax, 0x4c2b28
ret

Function at 0x4069a2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8388], 1
jne 0x4069cf
or dword [0x4c8388], 1
mov dword [0x4c2944], 0x92839192
mov dword [0x4c2948], 0x8e86cc8b
mov word [0x4c294c], 0xe28e
xor eax, eax
mov cl, byte [eax + 0x4c2944]
xor cl, 0xe2
mov byte [eax + 0x4c2b44], cl
inc eax
cmp eax, 0xa
jb 0x4069d1
mov eax, 0x4c2b44
ret

Function at 0x4069ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8384], 1
jne 0x406a49
or dword [0x4c8384], 1
mov dword [0x4c2950], 0x86838dae
mov dword [0x4c2954], 0x90808bae
mov dword [0x4c2958], 0xc29b9083
mov dword [0x4c295c], 0x8e8b8384
mov dword [0x4c2960], 0xcac28687
mov dword [0x4c2964], 0x92839192
mov dword [0x4c2968], 0xc2d8cb8b
mov byte [0x4c296c], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c2950]
xor cl, 0xe2
mov byte [eax + 0x4c2b50], cl
inc eax
cmp eax, 0x1d
jb 0x406a4b
mov eax, 0x4c2b50
ret

Function at 0x406a66
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8380], 1
jne 0x406ab9
or dword [0x4c8380], 1
mov dword [0x4c2970], 0xb29687a5
mov dword [0x4c2974], 0x87818d90
mov dword [0x4c2978], 0x8fab9191
mov dword [0x4c297c], 0xa4878583
mov dword [0x4c2980], 0xac878e8b
mov dword [0x4c2984], 0xa3878f83
mov byte [0x4c2988], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c2970]
xor cl, 0xe2
mov byte [eax + 0x4c2b70], cl
inc eax
cmp eax, 0x19
jb 0x406abb
mov eax, 0x4c2b70
ret

Function at 0x406ad6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c837c], 1
jne 0x406b72
or dword [0x4c837c], 1
mov dword [0x4c298c], 0xb29687a5
mov dword [0x4c2990], 0xa3818d90
mov dword [0x4c2994], 0x87908686
mov dword [0x4c2998], 0x84c29191
mov dword [0x4c299c], 0x878e8b83
mov dword [0x4c29a0], 0xa5cac286
mov dword [0x4c29a4], 0x90b29687
mov dword [0x4c29a8], 0x9187818d
mov dword [0x4c29ac], 0x838fab91
mov dword [0x4c29b0], 0x8ba48785
mov dword [0x4c29b4], 0x83ac878e
mov dword [0x4c29b8], 0xcba3878f
mov word [0x4c29bc], 0xc2d8
mov byte [0x4c29be], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c298c]
xor cl, 0xe2
mov byte [eax + 0x4c2b8c], cl
inc eax
cmp eax, 0x33
jb 0x406b74
mov eax, 0x4c2b8c
ret

Function at 0x406b8f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8378], 1
jne 0x406bf6
or dword [0x4c8378], 1
mov dword [0x4c29c0], 0xb29687a5
mov dword [0x4c29c4], 0x87818d90
mov dword [0x4c29c8], 0x8fab9191
mov dword [0x4c29cc], 0xa4878583
mov dword [0x4c29d0], 0x8c878e8b
mov dword [0x4c29d4], 0xc2878f83
mov dword [0x4c29d8], 0x8e8b8384
mov dword [0x4c29dc], 0xc2d88687
mov byte [0x4c29e0], 0xe2
xor eax, eax
mov cl, byte [eax + 0x4c29c0]
xor cl, 0xe2
mov byte [eax + 0x4c2bc0], cl
inc eax
cmp eax, 0x21
jb 0x406bf8
mov eax, 0x4c2bc0
ret
Function at 0x4077a4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8374], 1
jne 0x40798a
or dword [0x4c8374], 1
mov dword [0x4c2be8], 0x97ca8b8d
mov dword [0x4c2bec], 0x918b8090
mov dword [0x4c2bf0], 0x8197de90
mov dword [0x4c2bf4], 0x91869290
mov dword [0x4c2bf8], 0x8ac3cc82
mov dword [0x4c2bfc], 0xeecdc38b
mov dword [0x4c2c00], 0x8f878594
mov dword [0x4c2c04], 0xca818385
mov dword [0x4c2c08], 0x8c908594
mov dword [0x4c2c0c], 0xc3c4d9c4
mov dword [0x4c2c10], 0x8196eec3
mov dword [0x4c2c14], 0x968d9195
mov dword [0x4c2c18], 0x97c3cc81
mov dword [0x4c2c1c], 0x878d9690
mov dword [0x4c2c20], 0xeecdc390
mov dword [0x4c2c24], 0x85878b88
mov dword [0x4c2c28], 0xc897c488
mov dword [0x4c2c2c], 0xd9c496c4
mov dword [0x4c2c30], 0x87949cc4
mov dword [0x4c2c34], 0xcc888885
mov dword [0x4c2c38], 0x878a9182
mov dword [0x4c2c3c], 0x8a8b8d90
mov dword [0x4c2c40], 0x96c4cdcc
mov dword [0x4c2c44], 0x96919081
mov dword [0x4c2c48], 0x8196c48a
mov dword [0x4c2c4c], 0x968d9195
mov dword [0x4c2c50], 0xc1c3cc81
mov dword [0x4c2c54], 0xcacdc3a9
mov dword [0x4c2c58], 0x8a8d8589
mov dword [0x4c2c5c], 0x85bbbbcc
mov dword [0x4c2c60], 0xcd978396
mov dword [0x4c2c64], 0x808a81c4
mov dword [0x4c2c68], 0x8180c4c8
mov dword [0x4c2c6c], 0xca839186
mov dword [0x4c2c70], 0x87859690
mov dword [0x4c2c74], 0x87858681
mov dword [0x4c2c78], 0x8deecd8f
mov dword [0x4c2c7c], 0x8b8ac482
mov dword [0x4c2c80], 0xc497c490
mov dword [0x4c2c84], 0x8a818c90
mov dword [0x4c2c88], 0x969681c4
mov dword [0x4c2c8c], 0x96cc968b
mov dword [0x4c2c90], 0x8a81c4cd
mov dword [0x4c2c94], 0x8196ee80
mov dword [0x4c2c98], 0x8a969190
mov word [0x4c2c9c], 0x96c4
mov byte [0x4c2c9e], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2be8]
xor cl, 0xe4
mov byte [eax + 0x4c3318], cl
inc eax
cmp eax, 0xb7
jb 0x40798c
mov eax, 0x4c3318
ret
Function at 0x4079a9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8370], 1
jne 0x407c2f
or dword [0x4c8370], 1
mov dword [0x4c2ca0], 0x97ca8b8d
mov dword [0x4c2ca4], 0x918b8090
mov dword [0x4c2ca8], 0x8197de90
mov dword [0x4c2cac], 0x91869290
mov dword [0x4c2cb0], 0x8ac3cc82
mov dword [0x4c2cb4], 0xeecdc38b
mov dword [0x4c2cb8], 0x8f878594
mov dword [0x4c2cbc], 0xca818385
mov dword [0x4c2cc0], 0x8c908594
mov dword [0x4c2cc4], 0xeec3c3d9
mov dword [0x4c2cc8], 0x91958196
mov dword [0x4c2ccc], 0xcc81968d
mov dword [0x4c2cd0], 0x969097c3
mov dword [0x4c2cd4], 0xc390878d
mov dword [0x4c2cd8], 0x8b88eecd
mov dword [0x4c2cdc], 0xc4888587
mov dword [0x4c2ce0], 0xd9c48889
mov dword [0x4c2ce4], 0x958196c4
mov dword [0x4c2ce8], 0x81968d91
mov dword [0x4c2cec], 0x8889c3cc
mov dword [0x4c2cf0], 0x88eecdc3
mov dword [0x4c2cf4], 0x8885878b
mov dword [0x4c2cf8], 0x96c897c4
mov dword [0x4c2cfc], 0xd9c481c8
mov dword [0x4c2d00], 0x87949cc4
mov dword [0x4c2d04], 0xcc888885
mov dword [0x4c2d08], 0x878a9182
mov dword [0x4c2d0c], 0x8a8b8d90
mov dword [0x4c2d10], 0x96c4cdcc
mov dword [0x4c2d14], 0x96919081
mov dword [0x4c2d18], 0x8196c48a
mov dword [0x4c2d1c], 0x968d9195
mov dword [0x4c2d20], 0xc1c3cc81
mov dword [0x4c2d24], 0xcacdc3a9
mov dword [0x4c2d28], 0xc1cca2c1
mov dword [0x4c2d2c], 0x81c4cda5
mov dword [0x4c2d30], 0xc4c8808a
mov dword [0x4c2d34], 0x91868180
mov dword [0x4c2d38], 0x9690ca83
mov dword [0x4c2d3c], 0x86818785
mov dword [0x4c2d40], 0xcd8f8785
mov dword [0x4c2d44], 0xc4828dee
mov dword [0x4c2d48], 0xc4908b8a
mov dword [0x4c2d4c], 0x8c90c497
mov dword [0x4c2d50], 0x96c48a81
mov dword [0x4c2d54], 0x96919081
mov dword [0x4c2d58], 0x8d8ac48a
mov dword [0x4c2d5c], 0x96c4c888
mov dword [0x4c2d60], 0x808a81c4
mov dword [0x4c2d64], 0xc4828dee
mov dword [0x4c2d68], 0xd99ac496
mov dword [0x4c2d6c], 0x888d8ac4
mov dword [0x4c2d70], 0x818c90c4
mov dword [0x4c2d74], 0xc496c48a
mov dword [0x4c2d78], 0x8889c4d9
mov dword [0x4c2d7c], 0x909790ca
mov dword [0x4c2d80], 0x838a8d96
mov dword [0x4c2d84], 0xc4cd96cc
mov dword [0x4c2d88], 0xee808a81
mov dword [0x4c2d8c], 0x91908196
mov dword [0x4c2d90], 0x96c48a96
mov word [0x4c2d94], 0x81c8
mov byte [0x4c2d96], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2ca0]
xor cl, 0xe4
mov byte [eax + 0x4c33d0], cl
inc eax
cmp eax, 0xf7
jb 0x407c31
mov eax, 0x4c33d0
ret
Function at 0x407c4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x4c8330], 1
jne 0x407c75
or dword [0x4c8330], 1
mov dword [0x4c2e8c], 0x8f878594
mov dword [0x4c2e90], 0xe4818385
xor eax, eax
mov cl, byte [eax + 0x4c2e8c]
xor cl, 0xe4
mov byte [eax + 0x4c35bc], cl
inc eax
cmp eax, 8
jb 0x407c77
push 0x4c35bc
push dword [ebp + 8]
call fcn.00453ba5
test byte [0x4c832c], 1
pop ecx
pop ecx
jne 0x407cbf
or dword [0x4c832c], 1
mov dword [0x4c2e94], 0x88819694
mov dword [0x4c2e98], 0xe480858b
xor eax, eax
mov cl, byte [eax + 0x4c2e94]
xor cl, 0xe4
mov byte [eax + 0x4c35c4], cl
inc eax
cmp eax, 8
jb 0x407cc1
push esi
push 0x4c35c4
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00453c19
add esp, 0xc
cmp dword [0x4bdc20], 0
mov esi, 0x4bdc20
je 0x407d21
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00453ac5
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00453e46
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x407cfa
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0045331a
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x407f9b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48dba0
call fcn.0048cc68
sub esp, 0x64
test byte [0x4c8318], 1
jne 0x407fc8
or dword [0x4c8318], 1
mov word [0x4c2ec4], 0xa9c1
mov byte [0x4c2ec6], 0xe4
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x4c2ec4]
xor cl, 0xe4
mov byte [eax + 0x4c35f4], cl
inc eax
cmp eax, 3
jb 0x407fcf
mov esi, 0x4c35f4
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407ffb
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00404fb2
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0040eaba
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00404dee
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x408042
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.00452718
pop ecx
pop ecx
cmp eax, ebx
je 0x408093
cmp eax, 3
jne 0x408080
call fcn.0040819a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00466965
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x4b2d20
lea eax, [ebp - 0x1c]
push eax
call fcn.00470885
cmp eax, 4
jne 0x40808c
call fcn.0040824d
jmp 0x40805c
call fcn.00408300
jmp 0x40805c
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0045414e
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x40814a
push ebx
call fcn.00408384
push eax
push 0xffffffffffffffff
push esi
call fcn.00452eaf
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00404dcd
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x408102
call fcn.004083cb
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040eb2b
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.00405d39
jmp 0x408072
cmp edi, 4
jne 0x408121
call fcn.0040842a
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040eb2b
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x4080f5
cmp edi, 6
jne 0x408140
call fcn.0040848f
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040eb2b
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x4080f5
call fcn.00408513
jmp 0x40805c
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.0045350a
pop ecx
pop ecx
test eax, eax
je 0x40816b
push ebx
push edi
push esi
call fcn.004536ce
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.00453304
sub edi, eax
push edi
push esi
call fcn.0045331a
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00404dee
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40819a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8314], 1
jne 0x408230
or dword [0x4c8314], 1
mov dword [0x4c2ec8], 0x888d85a2
mov dword [0x4c2ecc], 0x90c48081
mov dword [0x4c2ed0], 0x9281c48b
mov dword [0x4c2ed4], 0x85918885
mov dword [0x4c2ed8], 0x86c48190
mov dword [0x4c2edc], 0x97908b8b
mov dword [0x4c2ee0], 0x94859690
mov dword [0x4c2ee4], 0x859682c4
mov dword [0x4c2ee8], 0x8a818983
mov dword [0x4c2eec], 0x97c4c890
mov dword [0x4c2ef0], 0x85908a9d
mov dword [0x4c2ef4], 0x9681c49c
mov dword [0x4c2ef8], 0xe4968b96
xor eax, eax
mov cl, byte [eax + 0x4c2ec8]
xor cl, 0xe4
mov byte [eax + 0x4c35f8], cl
inc eax
cmp eax, 0x34
jb 0x408232
mov eax, 0x4c35f8
ret

Function at 0x40824d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8310], 1
jne 0x4082e3
or dword [0x4c8310], 1
mov dword [0x4c2efc], 0x888d85a2
mov dword [0x4c2f00], 0x90c48081
mov dword [0x4c2f04], 0x9281c48b
mov dword [0x4c2f08], 0x85918885
mov dword [0x4c2f0c], 0x86c48190
mov dword [0x4c2f10], 0x97908b8b
mov dword [0x4c2f14], 0x94859690
mov dword [0x4c2f18], 0x859682c4
mov dword [0x4c2f1c], 0x8a818983
mov dword [0x4c2f20], 0x89c4c890
mov dword [0x4c2f24], 0x968b8981
mov dword [0x4c2f28], 0x9681c49d
mov dword [0x4c2f2c], 0xe4968b96
xor eax, eax
mov cl, byte [eax + 0x4c2efc]
xor cl, 0xe4
mov byte [eax + 0x4c362c], cl
inc eax
cmp eax, 0x34
jb 0x4082e5
mov eax, 0x4c362c
ret

Function at 0x408300
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c830c], 1
jne 0x408367
or dword [0x4c830c], 1
mov dword [0x4c2f30], 0x8a8f8ab1
mov dword [0x4c2f34], 0xc48a938b
mov dword [0x4c2f38], 0x8b969681
mov dword [0x4c2f3c], 0x8a8dc496
mov dword [0x4c2f40], 0x859188c4
mov dword [0x4c2f44], 0x8b88bba8
mov dword [0x4c2f48], 0x90978085
mov dword [0x4c2f4c], 0x838a8d96
mov byte [0x4c2f50], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2f30]
xor cl, 0xe4
mov byte [eax + 0x4c3660], cl
inc eax
cmp eax, 0x21
jb 0x408369
mov eax, 0x4c3660
ret

Function at 0x408384
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8308], 1
jne 0x4083ae
or dword [0x4c8308], 1
mov dword [0x4c2f54], 0x8a8b8ad8
mov word [0x4c2f58], 0xda81
mov byte [0x4c2f5a], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2f54]
xor cl, 0xe4
mov byte [eax + 0x4c3684], cl
inc eax
cmp eax, 7
jb 0x4083b0
mov eax, 0x4c3684
ret

Function at 0x4083cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8304], 1
jne 0x40840d
or dword [0x4c8304], 1
mov dword [0x4c2f5c], 0xc48591a8
mov dword [0x4c2f60], 0x908a9196
mov dword [0x4c2f64], 0xc481898d
mov dword [0x4c2f68], 0x8b969681
mov dword [0x4c2f6c], 0xe4c4de96
xor eax, eax
mov cl, byte [eax + 0x4c2f5c]
xor cl, 0xe4
mov byte [eax + 0x4c368c], cl
inc eax
cmp eax, 0x14
jb 0x40840f
mov eax, 0x4c368c
ret
Function at 0x40842a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c8300], 1
jne 0x408472
or dword [0x4c8300], 1
mov dword [0x4c2f70], 0xc48591a8
mov dword [0x4c2f74], 0x8b898189
mov dword [0x4c2f78], 0x81c49d96
mov dword [0x4c2f7c], 0x968b9696
mov word [0x4c2f80], 0xc4de
mov byte [0x4c2f82], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2f70]
xor cl, 0xe4
mov byte [eax + 0x4c36a0], cl
inc eax
cmp eax, 0x13
jb 0x408474
mov eax, 0x4c36a0
ret

Function at 0x40848f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82fc], 1
jne 0x4084f6
or dword [0x4c82fc], 1
mov dword [0x4c2f84], 0xc48591a8
mov dword [0x4c2f88], 0x8b969681
mov dword [0x4c2f8c], 0x8a8dc496
mov dword [0x4c2f90], 0x81808d97
mov dword [0x4c2f94], 0x969681c4
mov dword [0x4c2f98], 0x8cc4968b
mov dword [0x4c2f9c], 0x88808a85
mov dword [0x4c2fa0], 0xc4de9681
mov byte [0x4c2fa4], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2f84]
xor cl, 0xe4
mov byte [eax + 0x4c36b4], cl
inc eax
cmp eax, 0x21
jb 0x4084f8
mov eax, 0x4c36b4
ret

Function at 0x408513
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82f8], 1
jne 0x40856f
or dword [0x4c82f8], 1
mov dword [0x4c2fa8], 0x8a8f8ab1
mov dword [0x4c2fac], 0xc48a938b
mov dword [0x4c2fb0], 0x8b969681
mov dword [0x4c2fb4], 0x8a8dc496
mov dword [0x4c2fb8], 0x859188c4
mov dword [0x4c2fbc], 0x858794bb
mov word [0x4c2fc0], 0x8888
mov byte [0x4c2fc2], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2fa8]
xor cl, 0xe4
mov byte [eax + 0x4c36d8], cl
inc eax
cmp eax, 0x1b
jb 0x408571
mov eax, 0x4c36d8
ret

Function at 0x4087ad
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82f4], 1
jne 0x4087f6
or dword [0x4c82f4], 1
mov dword [0x4c2fc4], 0x819785a6
mov dword [0x4c2fc8], 0x80c4d0d2
mov dword [0x4c2fcc], 0x808b8781
mov dword [0x4c2fd0], 0x8582c481
mov dword [0x4c2fd4], 0x8081888d
mov byte [0x4c2fd8], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2fc4]
xor cl, 0xe4
mov byte [eax + 0x4c36f4], cl
inc eax
cmp eax, 0x15
jb 0x4087f8
mov eax, 0x4c36f4
ret
Function at 0x408813
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48f2b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0042fbb5
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0042df9c
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.00404f2c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.0040be6f
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x4088a0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.00432195
add esp, 0x10
test al, al
jne 0x4088e5
call fcn.0040895c
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00466965
push 0x4b2d20
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00470885
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.0040be6f
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x408925
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x408904
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.0040b198
lea esi, [esp + 0x20]
call fcn.0040be56
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00404dee
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40895c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82f0], 1
jne 0x4089a5
or dword [0x4c82f0], 1
mov dword [0x4c2fdc], 0x819785a6
mov dword [0x4c2fe0], 0x80c4d0d2
mov dword [0x4c2fe4], 0x808b8781
mov dword [0x4c2fe8], 0x8582c481
mov dword [0x4c2fec], 0x8081888d
mov byte [0x4c2ff0], 0xe4
xor eax, eax
mov cl, byte [eax + 0x4c2fdc]
xor cl, 0xe4
mov byte [eax + 0x4c370c], cl
inc eax
cmp eax, 0x15
jb 0x4089a7
mov eax, 0x4c370c
ret

Function at 0x409068
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c82ec], 1
jne 0x4090bd
or dword [0x4c82ec], 1
mov dword [0x4c2ff4], 0x88918ba7
mov dword [0x4c2ff8], 0x8b8ac480
mov dword [0x4c2ffc], 0x948bc490
mov dword [0x4c3000], 0x87c48a81
mov dword [0x4c3004], 0x8c978596
mov dword [0x4c3008], 0x899180c4
mov word [0x4c300c], 0xe494
xor eax, eax
mov cl, byte [eax + 0x4c2ff4]
xor cl, 0xe4
mov byte [eax + 0x4c3724], cl
inc eax
cmp eax, 0x1a
jb 0x4090bf
mov eax, 0x4c3724
ret