joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427824
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x427866
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x4ace40]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x4ace40]
inc edx
cmp dword [ebp + 8], 0
jne 0x427831
pop esi
not eax
pop ebp
ret

Function at 0x4294b1
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x4294d6
cmp dword [ecx + 0x38], ebx
je 0x4294d6
cmp eax, dword [ecx + 0x10]
jae 0x4294d6
cmp dword [ecx + 0x14], 1
jne 0x4294d6
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x4294d8
xor edi, edi
cmp edi, ebx
je 0x4295bb
cmp esi, ebx
je 0x4295bb
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00428c5a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x429567
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00467a90
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x42958c
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00467a90
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x4295bd
xor eax, eax
pop edi
pop ebx
ret
Function at 0x42a84d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3678], 1
jne 0x42a8d2
or dword [0x4c3678], 1
mov dword [0x4c2414], 0x7a7f7750
mov dword [0x4c2418], 0x62367273
mov dword [0x4c241c], 0x64753679
mov dword [0x4c2420], 0x73627773
mov dword [0x4c2424], 0x77637a36
mov dword [0x4c2428], 0x77626536
mov dword [0x4c242c], 0x3e367362
mov dword [0x4c2430], 0x7d647961
mov dword [0x4c2434], 0x62366473
mov dword [0x4c2438], 0x7773647e
mov dword [0x4c243c], 0x362c3f72
mov byte [0x4c2440], 0x16
xor eax, eax
mov cl, byte [eax + 0x4c2414]
xor cl, 0x16
mov byte [eax + 0x4c24dc], cl
inc eax
cmp eax, 0x2d
jb 0x42a8d4
mov eax, 0x4c24dc
ret

Function at 0x42a8ef
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3668], 1
jne 0x42a956
or dword [0x4c3668], 1
mov dword [0x4c2450], 0x73367958
mov dword [0x4c2454], 0x64796464
mov dword [0x4c2458], 0x65737b36
mov dword [0x4c245c], 0x73717765
mov dword [0x4c2460], 0x62736436
mov dword [0x4c2464], 0x73786463
mov dword [0x4c2468], 0x6f743672
mov dword [0x4c246c], 0x74797c36
mov byte [0x4c2470], 0x16
xor eax, eax
mov cl, byte [eax + 0x4c2450]
xor cl, 0x16
mov byte [eax + 0x4c2518], cl
inc eax
cmp eax, 0x21
jb 0x42a958
mov eax, 0x4c2518
ret

Function at 0x42a973
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c365c], 1
jne 0x42a9dc
or dword [0x4c365c], 1
mov dword [0x4c249c], 0x3677635a
mov dword [0x4c24a0], 0x79646473
mov dword [0x4c24a4], 0x63643664
mov dword [0x4c24a8], 0x787f7878
mov dword [0x4c24ac], 0x64733671
mov dword [0x4c24b0], 0x36647964
mov dword [0x4c24b4], 0x7278777e
mov dword [0x4c24b8], 0x2c64737a
mov word [0x4c24bc], 0x1636
xor eax, eax
mov cl, byte [eax + 0x4c249c]
xor cl, 0x16
mov byte [eax + 0x4c2564], cl
inc eax
cmp eax, 0x22
jb 0x42a9de
mov eax, 0x4c2564
ret

Function at 0x42a9f9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3658], 1
jne 0x42aa4b
or dword [0x4c3658], 1
mov dword [0x4c24c0], 0x5a77637a
mov dword [0x4c24c4], 0x77797a49
mov dword [0x4c24c8], 0x64626572
mov dword [0x4c24cc], 0x3671787f
mov dword [0x4c24d0], 0x7a7f7770
mov word [0x4c24d4], 0x7273
mov byte [0x4c24d6], 0x16
xor eax, eax
mov cl, byte [eax + 0x4c24c0]
xor cl, 0x16
mov byte [eax + 0x4c2588], cl
inc eax
cmp eax, 0x17
jb 0x42aa4d
mov eax, 0x4c2588
ret
Function at 0x42b796
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48b6b0
call fcn.0048a6f8
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x49312c]
test eax, eax
jne 0x42b7de
call fcn.0042b938
mov ecx, dword [ebp + 8]
push eax
call fcn.00405bf9
mov eax, dword [ebp + 8]
jmp 0x42b929
test byte [0x4c364c], 1
jne 0x42b7ff
or dword [0x4c364c], 1
mov dword [0x4c25c4], 0x39131410
mov byte [0x4c25c8], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c25c4]
xor cl, 0x19
mov byte [eax + 0x4c2d04], cl
inc eax
cmp eax, 5
jb 0x42b801
push 0xf
mov esi, 0x4c2d04
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x42b82c
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00404dd5
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00404bfd
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0042fe5e
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404c1e
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00404c1e
push dword [ebp - 0x10]
call dword [0x4930dc]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0042bc82
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0042b9a1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00405c36
add esp, 0xc
push 0x4ae31c
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0040cd49
add esp, 0xc
push ebx
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0040aaba
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00404c1e
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00404c1e
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00404c1e
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00404bb3
push ebx
push 1
mov ecx, esi
call fcn.00404c1e
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42b938
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3650], 1
jne 0x42b984
or dword [0x4c3650], 1
mov dword [0x4c25ac], 0x7c6b774c
mov dword [0x4c25b0], 0x777e767a
mov dword [0x4c25b4], 0x7d7c6370
mov dword [0x4c25b8], 0x6b6b7c39
mov dword [0x4c25bc], 0x7a396b76
mov dword [0x4c25c0], 0x197c7d76
xor eax, eax
mov cl, byte [eax + 0x4c25ac]
xor cl, 0x19
mov byte [eax + 0x4c2cec], cl
inc eax
cmp eax, 0x18
jb 0x42b986
mov eax, 0x4c2cec
ret

Function at 0x42b9a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3648], 1
jne 0x42b9df
or dword [0x4c3648], 1
mov dword [0x4c25cc], 0x6b7c3139
mov dword [0x4c25d0], 0x396b766b
mov dword [0x4c25d4], 0x7c7d767a
mov word [0x4c25d8], 0x3923
mov byte [0x4c25da], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c25cc]
xor cl, 0x19
mov byte [eax + 0x4c2d0c], cl
inc eax
cmp eax, 0xf
jb 0x42b9e1
mov eax, 0x4c2d0c
ret
Function at 0x42bc82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x4c3644], 1
jne 0x42bcad
or dword [0x4c3644], 1
mov dword [0x4c25dc], 0x7d75753c
mov byte [0x4c25e0], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c25dc]
xor cl, 0x19
mov byte [eax + 0x4c2d1c], cl
inc eax
cmp eax, 5
jb 0x42bcaf
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x4c2d1c
push eax
call fcn.0042feb7
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404bfd
mov eax, esi
leave
ret

Function at 0x42be2d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3640], 1
jne 0x42be89
or dword [0x4c3640], 1
mov dword [0x4c25e4], 0x546d7c5e
mov dword [0x4c25e8], 0x756c7d76
mov dword [0x4c25ec], 0x75705f7c
mov dword [0x4c25f0], 0x7478577c
mov dword [0x4c25f4], 0x787f397c
mov dword [0x4c25f8], 0x7d7c7570
mov word [0x4c25fc], 0x3923
mov byte [0x4c25fe], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c25e4]
xor cl, 0x19
mov byte [eax + 0x4c2d24], cl
inc eax
cmp eax, 0x1b
jb 0x42be8b
mov eax, 0x4c2d24
ret

Function at 0x42bea6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c363c], 1
jne 0x42bf03
or dword [0x4c363c], 1
mov dword [0x4c2600], 0x5a6d7c4a
mov dword [0x4c2604], 0x7c6b6b6c
mov dword [0x4c2608], 0x705d6d77
mov dword [0x4c260c], 0x6d7a7c6b
mov dword [0x4c2610], 0x39606b76
mov dword [0x4c2614], 0x7570787f
mov dword [0x4c2618], 0x39237d7c
mov byte [0x4c261c], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c2600]
xor cl, 0x19
mov byte [eax + 0x4c2d40], cl
inc eax
cmp eax, 0x1d
jb 0x42bf05
mov eax, 0x4c2d40
ret

Function at 0x42c004
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3638], 1
jne 0x42c061
or dword [0x4c3638], 1
mov dword [0x4c2620], 0x5a6d7c5e
mov dword [0x4c2624], 0x7c6b6b6c
mov dword [0x4c2628], 0x705d6d77
mov dword [0x4c262c], 0x6d7a7c6b
mov dword [0x4c2630], 0x39606b76
mov dword [0x4c2634], 0x7570787f
mov dword [0x4c2638], 0x39237d7c
mov byte [0x4c263c], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c2620]
xor cl, 0x19
mov byte [eax + 0x4c2d60], cl
inc eax
cmp eax, 0x1d
jb 0x42c063
mov eax, 0x4c2d60
ret
Function at 0x42c21c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3634], 1
jne 0x42c38b
mov eax, 0x8a45
mov ecx, eax
mov word [0x4c2640], cx
mov word [0x4c2642], cx
add ecx, 5
mov word [0x4c2644], cx
lea ecx, [eax + 0x28]
mov word [0x4c2646], cx
add ecx, 0xfffffffe
lea edx, [eax + 0x2b]
mov word [0x4c2648], cx
push ebx
mov ecx, edx
mov word [0x4c264a], cx
add ecx, 7
push esi
mov esi, ecx
lea ecx, [eax + 0x3a]
mov word [0x4c264c], si
lea esi, [eax + 0x39]
mov word [0x4c264e], si
mov word [0x4c265c], cx
add esi, 0xfffffff8
add edx, 5
mov ecx, esi
push edi
lea edi, [eax + 0x37]
mov word [0x4c265e], cx
mov ecx, eax
mov word [0x4c2654], dx
mov edx, edi
mov word [0x4c2660], cx
mov word [0x4c2662], cx
add ecx, 0xffffffe4
mov word [0x4c2656], dx
mov edx, ecx
or dword [0x4c3634], 1
mov word [0x4c2664], dx
lea edx, [eax - 0x18]
mov ebx, edx
mov word [0x4c2666], bx
mov ebx, ecx
mov word [0x4c2668], bx
lea ebx, [eax - 0x25]
mov word [0x4c2676], ax
mov word [0x4c266a], bx
mov ebx, ecx
mov ecx, eax
add eax, 4
mov word [0x4c2678], ax
lea eax, [ecx + 0x38]
mov word [0x4c267e], ax
add eax, 0xffffffef
mov word [0x4c2680], ax
lea eax, [ecx + 0x35]
mov word [0x4c2682], ax
add eax, 0xfffffff3
mov word [0x4c2684], ax
lea eax, [ecx + 0x12]
mov word [0x4c2686], ax
add eax, 0x21
pop edi
mov word [0x4c2688], ax
lea eax, [ecx - 0x2c]
pop esi
mov word [0x4c266c], bx
mov dword [0x4c2650], 0x8a708a5f
mov dword [0x4c2658], 0x8a778a50
mov word [0x4c266e], dx
mov dword [0x4c2670], 0x8a298a5b
mov word [0x4c2674], cx
mov dword [0x4c267a], 0x8a768a6b
mov dword [0x4c268a], 0x8a7c8a74
mov word [0x4c268e], ax
pop ebx
xor eax, eax
mov ecx, 0x8a19
xor cx, word [eax + 0x4c2640]
add eax, 2
mov word [eax + 0x4c2d7e], cx
cmp eax, 0x50
jb 0x42c38d
mov eax, 0x4c2d80
ret

Function at 0x42c3ae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3630], 1
jne 0x42c403
or dword [0x4c3630], 1
mov dword [0x4c2690], 0x6f397657
mov dword [0x4c2694], 0x706a6b7c
mov dword [0x4c2698], 0x70397776
mov dword [0x4c269c], 0x39767f77
mov dword [0x4c26a0], 0x70786f78
mov dword [0x4c26a4], 0x757b7875
mov word [0x4c26a8], 0x197c
xor eax, eax
mov cl, byte [eax + 0x4c2690]
xor cl, 0x19
mov byte [eax + 0x4c2dd0], cl
inc eax
cmp eax, 0x1a
jb 0x42c405
mov eax, 0x4c2dd0
ret

Function at 0x42c5f2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c362c], 1
jne 0x42c647
or dword [0x4c362c], 1
mov dword [0x4c26ac], 0x6f397657
mov dword [0x4c26b0], 0x706a6b7c
mov dword [0x4c26b4], 0x70397776
mov dword [0x4c26b8], 0x39767f77
mov dword [0x4c26bc], 0x70786f78
mov dword [0x4c26c0], 0x757b7875
mov word [0x4c26c4], 0x197c
xor eax, eax
mov cl, byte [eax + 0x4c26ac]
xor cl, 0x19
mov byte [eax + 0x4c2dec], cl
inc eax
cmp eax, 0x1a
jb 0x42c649
mov eax, 0x4c2dec
ret
Function at 0x42c664
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3628], 1
jne 0x42c6ca
or dword [0x4c3628], 1
mov dword [0x4c26c8], 0x786f7750
mov dword [0x4c26cc], 0x397d7075
mov dword [0x4c26d0], 0x6a6b7c6f
mov dword [0x4c26d4], 0x39777670
mov dword [0x4c26d8], 0x767f7770
mov dword [0x4c26dc], 0x7e706a39
mov dword [0x4c26e0], 0x6c6d7877
mov word [0x4c26e4], 0x7c6b
mov byte [0x4c26e6], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c26c8]
xor cl, 0x19
mov byte [eax + 0x4c2e08], cl
inc eax
cmp eax, 0x1f
jb 0x42c6cc
mov eax, 0x4c2e08
ret

Function at 0x42c9d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3624], 1
jne 0x42ca38
or dword [0x4c3624], 1
mov dword [0x4c26e8], 0x7570785f
mov dword [0x4c26ec], 0x6d397d7c
mov dword [0x4c26f0], 0x7c7e3976
mov dword [0x4c26f4], 0x7c6d396d
mov dword [0x4c26f8], 0x7f396974
mov dword [0x4c26fc], 0x7c7d7576
mov dword [0x4c2700], 0x7869396b
mov word [0x4c2704], 0x716d
mov byte [0x4c2706], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c26e8]
xor cl, 0x19
mov byte [eax + 0x4c2e28], cl
inc eax
cmp eax, 0x1f
jb 0x42ca3a
mov eax, 0x4c2e28
ret

Function at 0x42cba9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3620], 1
jne 0x42cbfb
or dword [0x4c3620], 1
mov dword [0x4c2708], 0x5f6d7c5e
mov dword [0x4c270c], 0x7c7d7576
mov dword [0x4c2710], 0x6d78496b
mov dword [0x4c2714], 0x787f3971
mov dword [0x4c2718], 0x7d7c7570
mov word [0x4c271c], 0x3923
mov byte [0x4c271e], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c2708]
xor cl, 0x19
mov byte [eax + 0x4c2e48], cl
inc eax
cmp eax, 0x17
jb 0x42cbfd
mov eax, 0x4c2e48
ret

Function at 0x42cedf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c361c], 1
mov edx, 0x8a19
jne 0x42cf76
or dword [0x4c361c], 1
lea ecx, [edx + 0x23]
mov eax, ecx
mov word [0x4c2720], ax
add eax, 0xd
mov word [0x4c2722], ax
push esi
lea eax, [edx + 0x52]
mov esi, eax
add eax, 0xd
mov word [0x4c272c], ax
lea eax, [edx + 0x5b]
mov word [0x4c272e], ax
add eax, 0xffffffda
mov word [0x4c2730], ax
lea eax, [edx + 0x16]
mov word [0x4c2724], si
add esi, 0xb
mov word [0x4c2732], ax
add eax, 0xfffffffe
mov word [0x4c2734], ax
lea eax, [edx + 0x11]
mov word [0x4c2736], ax
mov eax, edx
mov word [0x4c2726], si
mov dword [0x4c2728], 0x8a6b8a7e
mov dword [0x4c2738], 0x8a3c8a2b
mov word [0x4c273c], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c2720]
add eax, 2
mov word [eax + 0x4c2e5e], cx
cmp eax, 0x1e
jb 0x42cf78
mov eax, 0x4c2e60
ret

Function at 0x42cf96
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3618], 1
mov ecx, 0x8a19
jne 0x42cfd7
or dword [0x4c3618], 1
lea eax, [ecx + 0x49]
mov word [0x4c2740], ax
add eax, 7
mov word [0x4c2742], ax
lea eax, [ecx + 0x66]
mov word [0x4c2744], ax
add eax, 0xffffffe5
mov word [0x4c2746], ax
mov eax, ecx
mov word [0x4c2748], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c2740]
add eax, 2
mov word [eax + 0x4c2e7e], dx
cmp eax, 0xa
jb 0x42cfd9
mov eax, 0x4c2e80
ret
Function at 0x42cff7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3614], 1
mov ecx, 0x8a19
jne 0x42d04a
or dword [0x4c3614], 1
lea eax, [ecx + 0x49]
mov word [0x4c274c], ax
add eax, 7
mov word [0x4c274e], ax
lea eax, [ecx + 0x66]
mov word [0x4c2750], ax
add eax, 0xffffffab
mov word [0x4c2752], ax
lea eax, [ecx + 0x12]
mov word [0x4c2754], ax
add eax, 0x39
mov word [0x4c2756], ax
mov eax, ecx
mov word [0x4c2758], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c274c]
add eax, 2
mov word [eax + 0x4c2e8a], dx
cmp eax, 0xe
jb 0x42d04c
mov eax, 0x4c2e8c
ret

Function at 0x42d06a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3610], 1
mov ecx, 0x8a19
jne 0x42d0bd
or dword [0x4c3610], 1
lea eax, [ecx + 0x49]
mov word [0x4c275c], ax
add eax, 7
mov word [0x4c275e], ax
lea eax, [ecx + 0x66]
mov word [0x4c2760], ax
add eax, 0xffffffb0
mov word [0x4c2762], ax
lea eax, [ecx + 0x14]
mov word [0x4c2764], ax
add eax, 0x37
mov word [0x4c2766], ax
mov eax, ecx
mov word [0x4c2768], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c275c]
add eax, 2
mov word [eax + 0x4c2e9a], dx
cmp eax, 0xe
jb 0x42d0bf
mov eax, 0x4c2e9c
ret

Function at 0x42d0dd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c360c], 1
mov ecx, 0x8a19
jne 0x42d11e
or dword [0x4c360c], 1
lea eax, [ecx + 0x49]
mov word [0x4c276c], ax
add eax, 7
mov word [0x4c276e], ax
lea eax, [ecx + 0x66]
mov word [0x4c2770], ax
add eax, 0xffffffe5
mov word [0x4c2772], ax
mov eax, ecx
mov word [0x4c2774], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c276c]
add eax, 2
mov word [eax + 0x4c2eaa], dx
cmp eax, 0xa
jb 0x42d120
mov eax, 0x4c2eac
ret

Function at 0x42d13e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3608], 1
mov ecx, 0x8a19
jne 0x42d191
or dword [0x4c3608], 1
lea eax, [ecx + 0x49]
mov word [0x4c2778], ax
add eax, 7
mov word [0x4c277a], ax
lea eax, [ecx + 0x66]
mov word [0x4c277c], ax
add eax, 0xffffffab
mov word [0x4c277e], ax
lea eax, [ecx + 0x12]
mov word [0x4c2780], ax
add eax, 0x39
mov word [0x4c2782], ax
mov eax, ecx
mov word [0x4c2784], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c2778]
add eax, 2
mov word [eax + 0x4c2eb6], dx
cmp eax, 0xe
jb 0x42d193
mov eax, 0x4c2eb8
ret
Function at 0x42d28b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3604], 1
mov ecx, 0x8a19
jne 0x42d4d0
or dword [0x4c3604], 1
lea eax, [ecx + 0x10]
mov word [0x4c2790], ax
dec eax
mov word [0x4c2792], ax
lea eax, [ecx + 0x12]
mov word [0x4c2794], ax
dec eax
mov word [0x4c2796], ax
lea eax, [ecx + 0x14]
mov word [0x4c2798], ax
dec eax
mov word [0x4c279a], ax
lea eax, [ecx + 0x16]
mov word [0x4c279c], ax
dec eax
mov word [0x4c279e], ax
lea eax, [ecx + 8]
mov word [0x4c27a0], ax
dec eax
mov word [0x4c27a2], ax
lea eax, [ecx + 0x3f]
mov word [0x4c27a4], ax
add eax, 3
mov word [0x4c27a6], ax
lea eax, [ecx + 0x41]
mov word [0x4c27a8], ax
add eax, 3
mov word [0x4c27aa], ax
lea eax, [ecx + 0x43]
mov word [0x4c27ac], ax
add eax, 3
mov word [0x4c27ae], ax
lea eax, [ecx + 0x45]
mov word [0x4c27b0], ax
add eax, 0xfffffff3
mov word [0x4c27b2], ax
lea eax, [ecx + 0x37]
mov word [0x4c27b4], ax
add eax, 3
mov word [0x4c27b6], ax
lea eax, [ecx + 0x39]
mov word [0x4c27b8], ax
add eax, 3
mov word [0x4c27ba], ax
lea eax, [ecx + 0x3b]
mov word [0x4c27bc], ax
add eax, 3
mov word [0x4c27be], ax
lea eax, [ecx + 0x3d]
mov word [0x4c27c0], ax
add eax, 0xfffffff3
mov word [0x4c27c2], ax
lea eax, [ecx + 0x2f]
mov word [0x4c27c4], ax
add eax, 3
mov word [0x4c27c6], ax
lea eax, [ecx + 0x31]
mov word [0x4c27c8], ax
add eax, 3
mov word [0x4c27ca], ax
lea eax, [ecx + 0x33]
mov word [0x4c27cc], ax
add eax, 3
mov word [0x4c27ce], ax
lea eax, [ecx + 0x35]
mov word [0x4c27d0], ax
add eax, 0xfffffff3
mov word [0x4c27d2], ax
lea eax, [ecx + 0x27]
mov word [0x4c27d4], ax
add eax, 3
mov word [0x4c27d6], ax
lea eax, [ecx + 0x5f]
mov word [0x4c27d8], ax
add eax, 3
mov word [0x4c27da], ax
lea eax, [ecx + 0x61]
mov word [0x4c27dc], ax
add eax, 3
mov word [0x4c27de], ax
lea eax, [ecx + 0x63]
mov word [0x4c27e0], ax
add eax, 3
mov word [0x4c27e2], ax
lea eax, [ecx + 0x65]
mov word [0x4c27e4], ax
add eax, 0xfffffff3
mov word [0x4c27e6], ax
lea eax, [ecx + 0x57]
mov word [0x4c27e8], ax
add eax, 3
mov word [0x4c27ea], ax
lea eax, [ecx + 0x59]
mov word [0x4c27ec], ax
add eax, 3
mov word [0x4c27ee], ax
lea eax, [ecx + 0x5b]
mov word [0x4c27f0], ax
add eax, 3
mov word [0x4c27f2], ax
lea eax, [ecx + 0x5d]
mov word [0x4c27f4], ax
add eax, 0xfffffff3
mov word [0x4c27f6], ax
lea eax, [ecx + 0x4f]
mov word [0x4c27f8], ax
add eax, 3
mov word [0x4c27fa], ax
lea eax, [ecx + 0x51]
mov word [0x4c27fc], ax
add eax, 3
mov word [0x4c27fe], ax
lea eax, [ecx + 0x53]
mov word [0x4c2800], ax
add eax, 3
mov word [0x4c2802], ax
lea eax, [ecx + 0x55]
mov word [0x4c2804], ax
add eax, 0xfffffff3
mov word [0x4c2806], ax
lea eax, [ecx + 0x47]
mov word [0x4c2808], ax
add eax, 3
mov word [0x4c280a], ax
mov eax, ecx
mov word [0x4c280c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4c2790]
add eax, 2
mov word [eax + 0x4c2ec6], dx
cmp eax, 0x7e
jb 0x42d4d2
mov eax, 0x4c2ec8
ret
Function at 0x42d660
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3600], 1
jne 0x42d69e
or dword [0x4c3600], 1
mov dword [0x4c2810], 0x764e6a50
mov dword [0x4c2814], 0x492d2f6e
mov dword [0x4c2818], 0x7c7a766b
mov word [0x4c281c], 0x6a6a
mov byte [0x4c281e], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c2810]
xor cl, 0x19
mov byte [eax + 0x4c2f48], cl
inc eax
cmp eax, 0xf
jb 0x42d6a0
mov eax, 0x4c2f48
ret

Function at 0x42d7b6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c35fc], 1
jne 0x42d81f
or dword [0x4c35fc], 1
mov dword [0x4c2820], 0x76757558
mov dword [0x4c2824], 0x7c6d787a
mov dword [0x4c2828], 0x507d7758
mov dword [0x4c282c], 0x706d7077
mov dword [0x4c2830], 0x63707578
mov dword [0x4c2834], 0x7d704a7c
mov dword [0x4c2838], 0x70787f39
mov dword [0x4c283c], 0x237d7c75
mov word [0x4c2840], 0x1939
xor eax, eax
mov cl, byte [eax + 0x4c2820]
xor cl, 0x19
mov byte [eax + 0x4c2f58], cl
inc eax
cmp eax, 0x22
jb 0x42d821
mov eax, 0x4c2f58
ret

Function at 0x42d83c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c35f8], 1
jne 0x42d89b
or dword [0x4c35f8], 1
mov dword [0x4c2844], 0x7a7c715a
mov dword [0x4c2848], 0x72764d72
mov dword [0x4c284c], 0x7c54777c
mov dword [0x4c2850], 0x6b7c7b74
mov dword [0x4c2854], 0x6970716a
mov dword [0x4c2858], 0x70787f39
mov dword [0x4c285c], 0x237d7c75
mov word [0x4c2860], 0x1939
xor eax, eax
mov cl, byte [eax + 0x4c2844]
xor cl, 0x19
mov byte [eax + 0x4c2f7c], cl
inc eax
cmp eax, 0x1e
jb 0x42d89d
mov eax, 0x4c2f7c
ret

Function at 0x42da35
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c35f4], 1
jne 0x42daba
or dword [0x4c35f4], 1
mov dword [0x4c2864], 0x7777785a
mov dword [0x4c2868], 0x68396d76
mov dword [0x4c286c], 0x606b7c6c
mov dword [0x4c2870], 0x2f397839
mov dword [0x4c2874], 0x707b392d
mov dword [0x4c2878], 0x706f396d
mov dword [0x4c287c], 0x76396e7c
mov dword [0x4c2880], 0x2b2a3977
mov dword [0x4c2884], 0x6d707b39
mov dword [0x4c2888], 0x77706e39
mov dword [0x4c288c], 0x6a6e767d
mov byte [0x4c2890], 0x19
xor eax, eax
mov cl, byte [eax + 0x4c2864]
xor cl, 0x19
mov byte [eax + 0x4c2f9c], cl
inc eax
cmp eax, 0x2d
jb 0x42dabc
mov eax, 0x4c2f9c
ret

Function at 0x42dad7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c35f0], 1
jne 0x42db87
or dword [0x4c35f0], 1
push ebx
push esi
mov eax, 0x8a51
mov word [0x4c2894], ax
inc eax
mov word [0x4c2896], ax
push edi
mov edi, 0x8a5c
mov eax, edi
mov word [0x4c2898], ax
add eax, 0xffffffe4
mov word [0x4c289a], ax
lea esi, [edi - 0x16]
mov eax, esi
mov word [0x4c289c], ax
lea edx, [edi - 7]
mov eax, edx
mov word [0x4c289e], ax
inc eax
mov word [0x4c28a0], ax
lea ecx, [edi - 2]
mov eax, ecx
mov word [0x4c28a2], ax
add eax, 0xfffffffe
mov ebx, eax
lea eax, [edi - 0xc]
pop edi
mov word [0x4c28b2], ax
add eax, 0xffffffc9
pop esi
mov word [0x4c28a4], bx
mov dword [0x4c28a6], 0x8a468a55
mov dword [0x4c28aa], 0x8a588a54
mov dword [0x4c28ae], 0x8a518a5a
mov dword [0x4c28b4], 0x8a5c8a57
mov word [0x4c28b8], ax
pop ebx
xor eax, eax
mov ecx, 0x8a19
xor cx, word [eax + 0x4c2894]
add eax, 2
mov word [eax + 0x4c2fca], cx
cmp eax, 0x26
jb 0x42db89
mov eax, 0x4c2fcc
ret