joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x471089
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x4a4ac8], 1
push esi
jne 0x405037
or dword [0x4a4ac8], 1
mov dword [0x49f758], 0x454d5d47
mov dword [0x49f75c], 0x454d0745
mov word [0x49f760], 0x2945
xor eax, eax
mov cl, byte [eax + 0x49f758]
xor cl, 0x29
mov byte [eax + 0x49f958], cl
inc eax
cmp eax, 0xa
jb 0x405039
push 0x49f958
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4050ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0042836c
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.004051f2
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00404b2c
push 0x4914a0
mov eax, esi
push eax
call fcn.004535e6
call fcn.00405258
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x405108
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.004052ca
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x4050a5
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x405190
cmp dword [esp + 4], 0x18
jne 0x405190
push dword [esp + 0x6c]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x4051df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.0040540a
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x4050a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.0040537d
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x4050a5
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4051f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ac4], 1
jne 0x40523b
or dword [0x4a4ac4], 1
mov dword [0x49f764], 0x4d484665
mov dword [0x49f768], 0x5b4b4065
mov dword [0x49f76c], 0x9505b48
mov dword [0x49f770], 0x4540484f
mov dword [0x49f774], 0x9134d4c
mov byte [0x49f778], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f764]
xor cl, 0x29
mov byte [eax + 0x49f964], cl
inc eax
cmp eax, 0x15
jb 0x40523d
mov eax, 0x49f964
ret
Function at 0x405258
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ac0], 1
jne 0x4052ad
or dword [0x4a4ac0], 1
mov dword [0x49f77c], 0x5c785d67
mov dword [0x49f780], 0x60505b4c
mov dword [0x49f784], 0x5b464f47
mov dword [0x49f788], 0x405d4844
mov dword [0x49f78c], 0x5b794746
mov dword [0x49f790], 0x5a4c4a46
mov word [0x49f794], 0x295a
xor eax, eax
mov cl, byte [eax + 0x49f77c]
xor cl, 0x29
mov byte [eax + 0x49f97c], cl
inc eax
cmp eax, 0x1a
jb 0x4052af
mov eax, 0x49f97c
ret

Function at 0x4052ca
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4abc], 1
jne 0x405362
or dword [0x4a4abc], 1
mov dword [0x49f798], 0x795d4c6e
mov dword [0x49f79c], 0x684a465b
mov dword [0x49f7a0], 0x4c5b4d4d
mov dword [0x49f7a4], 0x4f095a5a
mov dword [0x49f7a8], 0x4c454048
mov dword [0x49f7ac], 0x6701094d
mov dword [0x49f7b0], 0x4c5c785d
mov dword [0x49f7b4], 0x4760505b
mov dword [0x49f7b8], 0x445b464f
mov dword [0x49f7bc], 0x46405d48
mov dword [0x49f7c0], 0x465b7947
mov dword [0x49f7c4], 0x5a5a4c4a
mov dword [0x49f7c8], 0x29091300
mov cl, byte [eax + 0x49f798]
xor cl, 0x29
mov byte [eax + 0x49f998], cl
inc eax
cmp eax, 0x34
jb 0x405362
mov eax, 0x49f998
ret

Function at 0x40537d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ab8], 1
jne 0x4053ed
or dword [0x4a4ab8], 1
mov dword [0x49f7cc], 0x5c785d67
mov dword [0x49f7d0], 0x60505b4c
mov dword [0x49f7d4], 0x5b464f47
mov dword [0x49f7d8], 0x405d4844
mov dword [0x49f7dc], 0x5b794746
mov dword [0x49f7e0], 0x5a4c4a46
mov dword [0x49f7e4], 0x484f095a
mov dword [0x49f7e8], 0x4d4c4540
mov word [0x49f7ec], 0x913
mov byte [0x49f7ee], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f7cc]
xor cl, 0x29
mov byte [eax + 0x49f9cc], cl
inc eax
cmp eax, 0x23
jb 0x4053ef
mov eax, 0x49f9cc
ret

Function at 0x40540a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ab4], 1
jne 0x405453
or dword [0x4a4ab4], 1
mov dword [0x49f7f0], 0x474c5966
mov dword [0x49f7f4], 0x4a465b79
mov dword [0x49f7f8], 0x95a5a4c
mov dword [0x49f7fc], 0x4540484f
mov dword [0x49f800], 0x9134d4c
mov byte [0x49f804], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f7f0]
xor cl, 0x29
mov byte [eax + 0x49f9f0], cl
inc eax
cmp eax, 0x15
jb 0x405455
mov eax, 0x49f9f0
ret
Function at 0x405470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x471036
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x4a4ab0], 1
push esi
push edi
jne 0x4054cd
or dword [0x4a4ab0], 1
mov dword [0x49f808], 0x475b4c42
mov dword [0x49f80c], 0x1b1a454c
mov dword [0x49f810], 0x45454d07
mov byte [0x49f814], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f808]
xor cl, 0x29
mov byte [eax + 0x49fa08], cl
inc eax
cmp eax, 0xd
jb 0x4054cf
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x49fa08
call edi
mov esi, eax
test esi, esi
jne 0x405543
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0042836c
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.004056a5
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00404b2c
push 0x4914a0
mov eax, esi
push eax
call fcn.004535e6
call fcn.00405722
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x405610
call fcn.00405795
push eax
call edi
mov edi, eax
test edi, edi
jne 0x4055b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.004057df
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x40553d
call fcn.00405859
push eax
push edi
call esi
test eax, eax
jne 0x405610
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.004058c9
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x40553d
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x405672
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00405982
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x40553d
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00403c54
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4056a5
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4aac], 1
jne 0x405707
or dword [0x4a4aac], 1
mov dword [0x49f818], 0x4d484665
mov dword [0x49f81c], 0x5b4b4065
mov dword [0x49f820], 0x9505b48
mov dword [0x49f824], 0x4540484f
mov dword [0x49f828], 0x1094d4c
mov dword [0x49f82c], 0x475b4c42
mov dword [0x49f830], 0x1b1a454c
mov dword [0x49f834], 0x29091300
mov cl, byte [eax + 0x49f818]
xor cl, 0x29
mov byte [eax + 0x49fa18], cl
inc eax
cmp eax, 0x20
jb 0x405707
mov eax, 0x49fa18
ret

Function at 0x405722
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4aa8], 1
jne 0x405778
or dword [0x4a4aa8], 1
mov dword [0x49f838], 0x6e1b1a62
mov dword [0x49f83c], 0x5b795d4c
mov dword [0x49f840], 0x5a4c4a46
mov dword [0x49f844], 0x4844605a
mov dword [0x49f848], 0x406f4c4e
mov dword [0x49f84c], 0x48674c45
mov dword [0x49f850], 0x29684c44
xor eax, eax
mov cl, byte [eax + 0x49f838]
xor cl, 0x29
mov byte [eax + 0x49fa38], cl
inc eax
cmp eax, 0x1c
jb 0x40577a
mov eax, 0x49fa38
ret

Function at 0x405795
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4aa4], 1
jne 0x4057c2
or dword [0x4a4aa4], 1
mov dword [0x49f854], 0x59485a59
mov dword [0x49f858], 0x454d0740
mov word [0x49f85c], 0x2945
xor eax, eax
mov cl, byte [eax + 0x49f854]
xor cl, 0x29
mov byte [eax + 0x49fa54], cl
inc eax
cmp eax, 0xa
jb 0x4057c4
mov eax, 0x49fa54
ret

Function at 0x4057df
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4aa0], 1
jne 0x40583e
or dword [0x4a4aa0], 1
mov dword [0x49f860], 0x4d484665
mov dword [0x49f864], 0x5b4b4065
mov dword [0x49f868], 0x9505b48
mov dword [0x49f86c], 0x4540484f
mov dword [0x49f870], 0x1094d4c
mov dword [0x49f874], 0x59485a59
mov dword [0x49f878], 0x9130040
mov byte [0x49f87c], 0x29
mov cl, byte [eax + 0x49f860]
xor cl, 0x29
mov byte [eax + 0x49fa60], cl
inc eax
cmp eax, 0x1d
jb 0x40583e
mov eax, 0x49fa60
ret

Function at 0x405859
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a9c], 1
jne 0x4058ac
or dword [0x4a4a9c], 1
mov dword [0x49f880], 0x795d4c6e
mov dword [0x49f884], 0x4c4a465b
mov dword [0x49f888], 0x44605a5a
mov dword [0x49f88c], 0x6f4c4e48
mov dword [0x49f890], 0x674c4540
mov dword [0x49f894], 0x684c4448
mov byte [0x49f898], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f880]
xor cl, 0x29
mov byte [eax + 0x49fa80], cl
inc eax
cmp eax, 0x19
jb 0x4058ae
mov eax, 0x49fa80
ret

Function at 0x4058c9
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4a98], 1
jne 0x405967
or dword [0x4a4a98], 1
mov dword [0x49f89c], 0x795d4c6e
mov dword [0x49f8a0], 0x684a465b
mov dword [0x49f8a4], 0x4c5b4d4d
mov dword [0x49f8a8], 0x4f095a5a
mov dword [0x49f8ac], 0x4c454048
mov dword [0x49f8b0], 0x6e01094d
mov dword [0x49f8b4], 0x5b795d4c
mov dword [0x49f8b8], 0x5a4c4a46
mov dword [0x49f8bc], 0x4844605a
mov dword [0x49f8c0], 0x406f4c4e
mov dword [0x49f8c4], 0x48674c45
mov dword [0x49f8c8], 0x684c44
mov word [0x49f8cc], 0x913
mov byte [0x49f8ce], 0x29
mov cl, byte [eax + 0x49f89c]
xor cl, 0x29
mov byte [eax + 0x49fa9c], cl
inc eax
cmp eax, 0x33
jb 0x405967
mov eax, 0x49fa9c
ret
Function at 0x405982
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a94], 1
jne 0x4059e9
or dword [0x4a4a94], 1
mov dword [0x49f8d0], 0x795d4c6e
mov dword [0x49f8d4], 0x4c4a465b
mov dword [0x49f8d8], 0x44605a5a
mov dword [0x49f8dc], 0x6f4c4e48
mov dword [0x49f8e0], 0x474c4540
mov dword [0x49f8e4], 0x94c4448
mov dword [0x49f8e8], 0x4540484f
mov dword [0x49f8ec], 0x9134d4c
mov byte [0x49f8f0], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f8d0]
xor cl, 0x29
mov byte [eax + 0x49fad0], cl
inc eax
cmp eax, 0x21
jb 0x4059eb
mov eax, 0x49fad0
ret

Function at 0x406a1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x4a4a50], 1
jne 0x406a41
or dword [0x4a4a50], 1
mov dword [0x49fd98], 0x424a4859
mov dword [0x49fd9c], 0x294c4e48
xor eax, eax
mov cl, byte [eax + 0x49fd98]
xor cl, 0x29
mov byte [eax + 0x4a0368], cl
inc eax
cmp eax, 8
jb 0x406a43
push 0x4a0368
push dword [ebp + 8]
call fcn.00436985
test byte [0x4a4a4c], 1
pop ecx
pop ecx
jne 0x406a8b
or dword [0x4a4a4c], 1
mov dword [0x49fda0], 0x454c5b59
mov dword [0x49fda4], 0x294d4846
xor eax, eax
mov cl, byte [eax + 0x49fda0]
xor cl, 0x29
mov byte [eax + 0x4a0370], cl
inc eax
cmp eax, 8
jb 0x406a8d
push esi
push 0x4a0370
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004369f9
add esp, 0xc
cmp dword [0x49aba8], 0
mov esi, 0x49aba8
je 0x406aed
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.004368a5
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00436c26
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x406ac6
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.004360fa
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x406afc
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x471b5c
call fcn.0046f99c
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.004359f8
and dword [ebp - 4], 0
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call fcn.00437506
push esi
call fcn.00406a1a
pop ecx
pop ecx
mov ebx, esi
call fcn.00412446
lea eax, [ebp - 0x18]
xor edi, edi
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push edi
push edi
push esi
mov dword [ebp - 0x1c], eax
call fcn.00436aa0
add esp, 0xc
cmp dword [ebp - 0x1c], edi
je 0x406bce
xor ebx, ebx
cmp ebx, dword [ebp - 0x18]
jge 0x406bce
mov eax, dword [ebp - 0x1c]
push dword [eax + ebx*4]
lea esi, [ebp - 0x54]
call fcn.00409331
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004285d2
pop ecx
push 1
xor edi, edi
mov byte [ebp - 4], 0
call fcn.00403da6
inc ebx
push ebx
push dword [ebp - 0x14]
call fcn.00436770
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
pop ecx
pop ecx
jae 0x406ba5
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call fcn.004367f9
push 0xfffffffffffffffd
push dword [ebp - 0x14]
call fcn.00436bfb
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.00403c75
mov esi, dword [ebp - 0x14]
xor edi, edi
jmp 0x406b5d
test byte [0x4a4a48], 1
jne 0x406bf8
or dword [0x4a4a48], 1
mov dword [0x49fda8], 0x5b487676
mov word [0x49fdac], 0x5a4e
mov byte [0x49fdae], 0x29
xor eax, eax
mov bl, 0x29
cmp eax, 7
jae 0x406c12
mov cl, byte [eax + 0x49fda8]
xor cl, bl
mov byte [eax + 0x4a0378], cl
inc eax
jmp 0x406bfc
push 0x4a0378
push esi
call fcn.00436ba4
push edi
push esi
call fcn.00436922
add esp, 0x10
test byte [0x4a4a44], 1
jne 0x406c57
or dword [0x4a4a44], 1
mov dword [0x49fdb0], 0x4c4d7676
mov word [0x49fdb4], 0x5c4b
mov byte [0x49fdb6], 0x4e
mov byte [0x49fdb7], bl
xor eax, eax
cmp eax, 8
jae 0x406c6f
mov cl, byte [eax + 0x49fdb0]
xor cl, bl
mov byte [eax + 0x4a0380], cl
inc eax
jmp 0x406c59
push 0x4a0380
push esi
call fcn.00436ba4
push edi
push esi
call fcn.00436922
add esp, 0x10
test byte [0x4a4a40], 1
jne 0x406cb5
or dword [0x4a4a40], 1
mov dword [0x49fdb8], 0x4c5d7676
mov dword [0x49fdbc], 0x47405d5a
mov byte [0x49fdc0], 0x4e
mov byte [0x49fdc1], bl
xor eax, eax
cmp eax, 0xa
jae 0x406ccd
mov cl, byte [eax + 0x49fdb8]
xor cl, bl
mov byte [eax + 0x4a0388], cl
inc eax
jmp 0x406cb7
push 0x4a0388
push esi
call fcn.00436ba4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x406ce5
mov eax, dword [eax]
push eax
push esi
call fcn.004367f9
test byte [0x4a4a3c], 1
pop ecx
pop ecx
jne 0x406d1f
or dword [0x4a4a3c], 1
mov dword [0x49fdc4], 0x464a7676
mov dword [0x49fdc8], 0x514c5d47
mov byte [0x49fdcc], 0x5d
mov byte [0x49fdcd], bl
xor eax, eax
cmp eax, 0xa
jae 0x406d37
mov cl, byte [eax + 0x49fdc4]
xor cl, bl
mov byte [eax + 0x4a0394], cl
inc eax
jmp 0x406d21
push 0x4a0394
push esi
call fcn.00436ba4
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x406d68
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x470a95
call fcn.0046f99c
sub esp, 0x64
test byte [0x4a4a38], 1
jne 0x406d95
or dword [0x4a4a38], 1
mov word [0x49fdd0], 0x640c
mov byte [0x49fdd2], 0x29
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x49fdd0]
xor cl, 0x29
mov byte [eax + 0x4a03a0], cl
inc eax
cmp eax, 3
jb 0x406d9c
push 0xf
mov ecx, 0x4a03a0
pop edi
mov eax, ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x406dc7
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x54]
call fcn.00403bdf
push dword [ebp + 0x10]
lea eax, [ebp - 0x70]
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
lea ebx, [ebp - 0x54]
call fcn.0040be98
add esp, 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00403c75
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x406e0f
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 8]
call fcn.004354f8
pop ecx
pop ecx
cmp eax, ebx
je 0x406e5f
cmp eax, 3
jne 0x406e4c
call fcn.00406f69
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00449745
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x4914a0
lea eax, [ebp - 0x1c]
push eax
call fcn.004535e6
cmp eax, 4
jne 0x406e58
call fcn.0040701c
jmp 0x406e28
call fcn.004070cf
jmp 0x406e28
push ebx
push ebx
push ebx
push 1
push ebx
push dword [ebp + 8]
call fcn.00436f2e
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x406f16
push ebx
call fcn.00407153
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00435c8f
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00403c54
mov byte [ebp - 4], 3
cmp esi, 2
jne 0x406ece
call fcn.0040719a
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040bf05
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.00404b2c
jmp 0x406e3e
cmp esi, 4
jne 0x406eed
call fcn.004071f9
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040bf05
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x406ec1
cmp esi, 6
jne 0x406f0c
call fcn.0040725e
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040bf05
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x406ec1
call fcn.004072e2
jmp 0x406e28
mov edi, dword [ebp + 8]
or esi, 0xffffffff
push esi
push edi
mov dword [ebp - 0x10], esi
call fcn.004362ea
pop ecx
pop ecx
test eax, eax
je 0x406f3a
push ebx
push esi
push edi
call fcn.004364ae
add esp, 0xc
mov dword [ebp - 0x10], eax
push edi
call fcn.004360e4
sub esi, eax
push esi
push edi
call fcn.004360fa
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00403c75
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406f69
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a34], 1
jne 0x406fff
or dword [0x4a4a34], 1
mov dword [0x49fdd4], 0x4540486f
mov dword [0x49fdd8], 0x5d094d4c
mov dword [0x49fddc], 0x5f4c0946
mov dword [0x49fde0], 0x485c4548
mov dword [0x49fde4], 0x4b094c5d
mov dword [0x49fde8], 0x5a5d4646
mov dword [0x49fdec], 0x59485b5d
mov dword [0x49fdf0], 0x485b4f09
mov dword [0x49fdf4], 0x474c444e
mov dword [0x49fdf8], 0x5a09055d
mov dword [0x49fdfc], 0x485d4750
mov dword [0x49fe00], 0x5b4c0951
mov dword [0x49fe04], 0x295b465b
xor eax, eax
mov cl, byte [eax + 0x49fdd4]
xor cl, 0x29
mov byte [eax + 0x4a03a4], cl
inc eax
cmp eax, 0x34
jb 0x407001
mov eax, 0x4a03a4
ret

Function at 0x40701c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a30], 1
jne 0x4070b2
or dword [0x4a4a30], 1
mov dword [0x49fe08], 0x4540486f
mov dword [0x49fe0c], 0x5d094d4c
mov dword [0x49fe10], 0x5f4c0946
mov dword [0x49fe14], 0x485c4548
mov dword [0x49fe18], 0x4b094c5d
mov dword [0x49fe1c], 0x5a5d4646
mov dword [0x49fe20], 0x59485b5d
mov dword [0x49fe24], 0x485b4f09
mov dword [0x49fe28], 0x474c444e
mov dword [0x49fe2c], 0x4409055d
mov dword [0x49fe30], 0x5b46444c
mov dword [0x49fe34], 0x5b4c0950
mov dword [0x49fe38], 0x295b465b
xor eax, eax
mov cl, byte [eax + 0x49fe08]
xor cl, 0x29
mov byte [eax + 0x4a03d8], cl
inc eax
cmp eax, 0x34
jb 0x4070b4
mov eax, 0x4a03d8
ret

Function at 0x4070cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a2c], 1
jne 0x407136
or dword [0x4a4a2c], 1
mov dword [0x49fe3c], 0x4742477c
mov dword [0x49fe40], 0x9475e46
mov dword [0x49fe44], 0x465b5b4c
mov dword [0x49fe48], 0x4740095b
mov dword [0x49fe4c], 0x485c4509
mov dword [0x49fe50], 0x46457665
mov dword [0x49fe54], 0x5d5a4d48
mov dword [0x49fe58], 0x4e47405b
mov byte [0x49fe5c], 0x29
xor eax, eax
mov cl, byte [eax + 0x49fe3c]
xor cl, 0x29
mov byte [eax + 0x4a040c], cl
inc eax
cmp eax, 0x21
jb 0x407138
mov eax, 0x4a040c
ret

Function at 0x407153
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a28], 1
jne 0x40717d
or dword [0x4a4a28], 1
mov dword [0x49fe60], 0x47464715
mov word [0x49fe64], 0x174c
mov byte [0x49fe66], 0x29
xor eax, eax
mov cl, byte [eax + 0x49fe60]
xor cl, 0x29
mov byte [eax + 0x4a0430], cl
inc eax
cmp eax, 7
jb 0x40717f
mov eax, 0x4a0430
ret

Function at 0x40719a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a24], 1
jne 0x4071dc
or dword [0x4a4a24], 1
mov dword [0x49fe68], 0x9485c65
mov dword [0x49fe6c], 0x5d475c5b
mov dword [0x49fe70], 0x94c4440
mov dword [0x49fe74], 0x465b5b4c
mov dword [0x49fe78], 0x2909135b
xor eax, eax
mov cl, byte [eax + 0x49fe68]
xor cl, 0x29
mov byte [eax + 0x4a0438], cl
inc eax
cmp eax, 0x14
jb 0x4071de
mov eax, 0x4a0438
ret
Function at 0x4071f9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a20], 1
jne 0x407241
or dword [0x4a4a20], 1
mov dword [0x49fe7c], 0x9485c65
mov dword [0x49fe80], 0x46444c44
mov dword [0x49fe84], 0x4c09505b
mov dword [0x49fe88], 0x5b465b5b
mov word [0x49fe8c], 0x913
mov byte [0x49fe8e], 0x29
xor eax, eax
mov cl, byte [eax + 0x49fe7c]
xor cl, 0x29
mov byte [eax + 0x4a044c], cl
inc eax
cmp eax, 0x13
jb 0x407243
mov eax, 0x4a044c
ret

Function at 0x40725e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a1c], 1
jne 0x4072c5
or dword [0x4a4a1c], 1
mov dword [0x49fe90], 0x9485c65
mov dword [0x49fe94], 0x465b5b4c
mov dword [0x49fe98], 0x4740095b
mov dword [0x49fe9c], 0x4c4d405a
mov dword [0x49fea0], 0x5b5b4c09
mov dword [0x49fea4], 0x41095b46
mov dword [0x49fea8], 0x454d4748
mov dword [0x49feac], 0x9135b4c
mov byte [0x49feb0], 0x29
xor eax, eax
mov cl, byte [eax + 0x49fe90]
xor cl, 0x29
mov byte [eax + 0x4a0460], cl
inc eax
cmp eax, 0x21
jb 0x4072c7
mov eax, 0x4a0460
ret

Function at 0x4072e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4a18], 1
jne 0x40733e
or dword [0x4a4a18], 1
mov dword [0x49feb4], 0x4742477c
mov dword [0x49feb8], 0x9475e46
mov dword [0x49febc], 0x465b5b4c
mov dword [0x49fec0], 0x4740095b
mov dword [0x49fec4], 0x485c4509
mov dword [0x49fec8], 0x484a5976
mov word [0x49fecc], 0x4545
mov byte [0x49fece], 0x29
xor eax, eax
mov cl, byte [eax + 0x49feb4]
xor cl, 0x29
mov byte [eax + 0x4a0484], cl
inc eax
cmp eax, 0x1b
jb 0x407340
mov eax, 0x4a0484
ret