joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047bc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2d2c], 1
jne 0x404836
or dword [0x4c2d2c], 1
mov dword [0x4bcfbc], 0xc8cadff8
mov dword [0x4bcfc0], 0xdecf8bc0
mov dword [0x4bcfc4], 0xce8bdbc6
mov dword [0x4bcfc8], 0xd9c4d9d9
mov dword [0x4bcfcc], 0xd2f88b91
mov dword [0x4bcfd0], 0xc2c5e2c6
mov dword [0x4bcfd4], 0xc7cac2df
mov dword [0x4bcfd8], 0x8bced1c2
mov dword [0x4bcfdc], 0xc7c2cacd
mov word [0x4bcfe0], 0xcfce
mov byte [0x4bcfe2], 0xab
xor eax, eax
mov cl, byte [eax + 0x4bcfbc]
xor cl, 0xab
mov byte [eax + 0x4bd668], cl
inc eax
cmp eax, 0x27
jb 0x404838
mov eax, 0x4bd668
ret

Function at 0x404853
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2d28], 1
jne 0x4048b9
or dword [0x4c2d28], 1
mov dword [0x4bcfe4], 0xc2c0d897
mov dword [0x4bcfe8], 0xcfcedbdb
mov dword [0x4bcfec], 0xcad9cd8b
mov dword [0x4bcff0], 0x8b87cec6
mov dword [0x4bcff4], 0xdc8be8fb
mov dword [0x4bcff8], 0xc58bd8ca
mov dword [0x4bcffc], 0x95c7c7de
mov word [0x4bd000], 0xa1a6
mov byte [0x4bd002], 0xab
xor eax, eax
mov cl, byte [eax + 0x4bcfe4]
xor cl, 0xab
mov byte [eax + 0x4bd690], cl
inc eax
cmp eax, 0x1f
jb 0x4048bb
mov eax, 0x4bd690
ret

Function at 0x4048d6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2d24], 1
jne 0x404969
or dword [0x4c2d24], 1
mov dword [0x4bd004], 0xc2c0d897
mov dword [0x4bd008], 0xcfcedbdb
mov dword [0x4bd00c], 0xcad9cd8b
mov dword [0x4bd010], 0x8b87cec6
mov dword [0x4bd014], 0xdc8be8fb
mov dword [0x4bd018], 0xd88bd8ca
mov dword [0x4bd01c], 0x8bcec6ca
mov dword [0x4bd020], 0xd98bd8ca
mov dword [0x4bd024], 0xd9dedfce
mov dword [0x4bd028], 0xcfca8bc5
mov dword [0x4bd02c], 0xd8ced9cf
mov dword [0x4bd030], 0xa1a695d8
mov byte [0x4bd034], 0xab
xor eax, eax
mov cl, byte [eax + 0x4bd004]
xor cl, 0xab
mov byte [eax + 0x4bd6b0], cl
inc eax
cmp eax, 0x31
jb 0x40496b
mov eax, 0x4bd6b0
ret
Function at 0x404986
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.00476aa0
push ebx
push esi
push edi
call dword [0x492094]
test byte [0x4c2d20], 1
mov dword [ebp - 4], eax
jne 0x4049cd
or dword [0x4c2d20], 1
mov dword [0x4bd038], 0xcfc4c697
mov dword [0x4bd03c], 0x94cec7de
mov dword [0x4bd040], 0xab959494
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x4bd038]
xor cl, 0xab
mov byte [eax + 0x4bd6e4], cl
inc eax
cmp eax, 0xc
jb 0x4049d1
test byte [0x4c2d1c], 1
mov dword [ebp - 8], 0x4bd6e4
jne 0x404a1b
or dword [0x4c2d1c], 1
mov dword [0x4bd044], 0xc6d2d897
mov dword [0x4bd048], 0x94c7c4c9
mov dword [0x4bd04c], 0xab959494
xor eax, eax
mov cl, byte [eax + 0x4bd044]
xor cl, 0xab
mov byte [eax + 0x4bd6f0], cl
inc eax
cmp eax, 0xc
jb 0x404a1d
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x4bd6f0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00466f50
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x4923b0]
test eax, eax
je 0x404a82
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.00466f50
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x4923bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x404ace
mov ecx, dword [ebp - 0x1c]
test byte [0x4c2d18], 1
jne 0x404b05
or dword [0x4c2d18], 1
mov dword [0x4bd050], 0x8e8bdb8e
mov dword [0x4bd054], 0xd88e8ad8
mov dword [0x4bd058], 0x8ed39b80
mov word [0x4bd05c], 0xabd3
xor eax, eax
mov dl, byte [eax + 0x4bd050]
xor dl, 0xab
mov byte [eax + 0x4bd6fc], dl
inc eax
cmp eax, 0xe
jb 0x404b07
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x4bd6fc
push dword [ebp + 0xc]
call fcn.0046417d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x4923a4]
test eax, eax
je 0x404b7e
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00404bcb
push eax
push dword [ebp + 0xc]
call fcn.0046417d
add esp, 0x14
test byte [0x4c2d10], 1
jne 0x404b9e
or dword [0x4c2d10], 1
mov word [0x4bd070], 0xa1a6
mov byte [0x4bd072], 0xab
xor eax, eax
mov cl, byte [eax + 0x4bd070]
xor cl, 0xab
mov byte [eax + 0x4bd71c], cl
inc eax
cmp eax, 3
jb 0x404ba0
push dword [ebp + 0xc]
push 0x4bd71c
call fcn.00463df1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404bcb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2d14], 1
jne 0x404c03
or dword [0x4c2d14], 1
mov dword [0x4bd060], 0xd88e838b
mov dword [0x4bd064], 0x8bcf8e91
mov dword [0x4bd068], 0xd39b8b80
mov dword [0x4bd06c], 0xab82d38e
xor eax, eax
mov cl, byte [eax + 0x4bd060]
xor cl, 0xab
mov byte [eax + 0x4bd70c], cl
inc eax
cmp eax, 0x10
jb 0x404c05
mov eax, 0x4bd70c
ret

Function at 0x405e94
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2d04], 1
jne 0x405ee9
or dword [0x4c2d04], 1
mov dword [0x4bd740], 0xe9ffece5
mov dword [0x4bd744], 0xe8ffecfa
mov dword [0x4bd748], 0xfdeeecf1
mov dword [0x4bd74c], 0xfee9f1e4
mov dword [0x4bd750], 0xfbf1f9e9
mov dword [0x4bd754], 0xf2f5e2ef
mov word [0x4bd758], 0xadf2
xor eax, eax
mov cl, byte [eax + 0x4bd740]
xor cl, 0xad
mov byte [eax + 0x4bd940], cl
inc eax
cmp eax, 0x1a
jb 0x405eeb
mov eax, 0x4bd940
ret

Function at 0x405ffa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2d00], 1
jne 0x406024
or dword [0x4c2d00], 1
mov dword [0x4bd75c], 0xccfae0fb
mov word [0x4bd760], 0xc8df
mov byte [0x4bd762], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd75c]
xor cl, 0xad
mov byte [eax + 0x4bd95c], cl
inc eax
cmp eax, 7
jb 0x406026
mov eax, 0x4bd95c
ret

Function at 0x406041
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cfc], 1
jne 0x40606e
or dword [0x4c2cfc], 1
mov dword [0x4bd764], 0xd9dfc4fb
mov dword [0x4bd768], 0xfdc1ccd8
mov word [0x4bd76c], 0xadee
xor eax, eax
mov cl, byte [eax + 0x4bd764]
xor cl, 0xad
mov byte [eax + 0x4bd964], cl
inc eax
cmp eax, 0xa
jb 0x406070
mov eax, 0x4bd964
ret

Function at 0x40608b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cf8], 1
jne 0x4060bf
or dword [0x4c2cf8], 1
mov dword [0x4bd770], 0xd9dfc4fb
mov dword [0x4bd774], 0xefc1ccd8
mov word [0x4bd778], 0xd5c2
mov byte [0x4bd77a], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd770]
xor cl, 0xad
mov byte [eax + 0x4bd970], cl
inc eax
cmp eax, 0xb
jb 0x4060c1
mov eax, 0x4bd970
ret

Function at 0x4060dc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cf4], 1
jne 0x406100
or dword [0x4c2cf4], 1
mov dword [0x4bd77c], 0xc8c3c8ea
mov dword [0x4bd780], 0xadcec4df
xor eax, eax
mov cl, byte [eax + 0x4bd77c]
xor cl, 0xad
mov byte [eax + 0x4bd97c], cl
inc eax
cmp eax, 8
jb 0x406102
mov eax, 0x4bd97c
ret
Function at 0x40611d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48b2bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x4c2cf0], 1
push esi
jne 0x406170
or dword [0x4c2cf0], 1
mov dword [0x4bd784], 0xc1c9d9c3
mov dword [0x4bd788], 0xc1c983c1
mov word [0x4bd78c], 0xadc1
xor eax, eax
mov cl, byte [eax + 0x4bd784]
xor cl, 0xad
mov byte [eax + 0x4bd984], cl
inc eax
cmp eax, 0xa
jb 0x406172
push 0x4bd984
call dword [0x4920cc]
mov esi, eax
test esi, esi
jne 0x4061e4
call dword [0x4920a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0042a914
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0040632b
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.00405c65
push 0x4aec28
mov eax, esi
push eax
call fcn.0046d8b5
call fcn.00406391
push eax
push esi
call dword [0x4920c8]
test eax, eax
jne 0x406241
call dword [0x4920a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042a914
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.00406403
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.00405c65
push 0x4aec28
mov eax, esi
jmp 0x4061de
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x4062c9
cmp dword [esp + 4], 0x18
jne 0x4062c9
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x4920c4]
test eax, eax
jne 0x406318
call dword [0x4920a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0042a914
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.00406543
push eax
lea eax, [esp + 0x94]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.00405c65
push 0x4aec28
mov eax, esi
jmp 0x4061de
call dword [0x4920a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042a914
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.004064b6
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.00405c65
push 0x4aec28
mov eax, esi
jmp 0x4061de
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40632b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cec], 1
jne 0x406374
or dword [0x4c2cec], 1
mov dword [0x4bd790], 0xc9ccc2e1
mov dword [0x4bd794], 0xdfcfc4e1
mov dword [0x4bd798], 0x8dd4dfcc
mov dword [0x4bd79c], 0xc1c4cccb
mov dword [0x4bd7a0], 0x8d97c9c8
mov byte [0x4bd7a4], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd790]
xor cl, 0xad
mov byte [eax + 0x4bd990], cl
inc eax
cmp eax, 0x15
jb 0x406376
mov eax, 0x4bd990
ret
Function at 0x406391
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ce8], 1
jne 0x4063e6
or dword [0x4c2ce8], 1
mov dword [0x4bd7a8], 0xd8fcd9e3
mov dword [0x4bd7ac], 0xe4d4dfc8
mov dword [0x4bd7b0], 0xdfc2cbc3
mov dword [0x4bd7b4], 0xc4d9ccc0
mov dword [0x4bd7b8], 0xdffdc3c2
mov dword [0x4bd7bc], 0xdec8cec2
mov word [0x4bd7c0], 0xadde
xor eax, eax
mov cl, byte [eax + 0x4bd7a8]
xor cl, 0xad
mov byte [eax + 0x4bd9a8], cl
inc eax
cmp eax, 0x1a
jb 0x4063e8
mov eax, 0x4bd9a8
ret

Function at 0x406403
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ce4], 1
jne 0x406499
or dword [0x4c2ce4], 1
mov dword [0x4bd7c4], 0xfdd9c8ea
mov dword [0x4bd7c8], 0xeccec2df
mov dword [0x4bd7cc], 0xc8dfc9c9
mov dword [0x4bd7d0], 0xcb8ddede
mov dword [0x4bd7d4], 0xc8c1c4cc
mov dword [0x4bd7d8], 0xe3858dc9
mov dword [0x4bd7dc], 0xc8d8fcd9
mov dword [0x4bd7e0], 0xc3e4d4df
mov dword [0x4bd7e4], 0xc0dfc2cb
mov dword [0x4bd7e8], 0xc2c4d9cc
mov dword [0x4bd7ec], 0xc2dffdc3
mov dword [0x4bd7f0], 0xdedec8ce
mov dword [0x4bd7f4], 0xad8d9784
xor eax, eax
mov cl, byte [eax + 0x4bd7c4]
xor cl, 0xad
mov byte [eax + 0x4bd9c4], cl
inc eax
cmp eax, 0x34
jb 0x40649b
mov eax, 0x4bd9c4
ret

Function at 0x4064b6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ce0], 1
jne 0x406526
or dword [0x4c2ce0], 1
mov dword [0x4bd7f8], 0xd8fcd9e3
mov dword [0x4bd7fc], 0xe4d4dfc8
mov dword [0x4bd800], 0xdfc2cbc3
mov dword [0x4bd804], 0xc4d9ccc0
mov dword [0x4bd808], 0xdffdc3c2
mov dword [0x4bd80c], 0xdec8cec2
mov dword [0x4bd810], 0xcccb8dde
mov dword [0x4bd814], 0xc9c8c1c4
mov word [0x4bd818], 0x8d97
mov byte [0x4bd81a], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd7f8]
xor cl, 0xad
mov byte [eax + 0x4bd9f8], cl
inc eax
cmp eax, 0x23
jb 0x406528
mov eax, 0x4bd9f8
ret

Function at 0x406543
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cdc], 1
jne 0x40658c
or dword [0x4c2cdc], 1
mov dword [0x4bd81c], 0xc3c8dde2
mov dword [0x4bd820], 0xcec2dffd
mov dword [0x4bd824], 0x8ddedec8
mov dword [0x4bd828], 0xc1c4cccb
mov dword [0x4bd82c], 0x8d97c9c8
mov byte [0x4bd830], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd81c]
xor cl, 0xad
mov byte [eax + 0x4bda1c], cl
inc eax
cmp eax, 0x15
jb 0x40658e
mov eax, 0x4bda1c
ret
Function at 0x4065a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48b26a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x4c2cd8], 1
push esi
push edi
jne 0x406606
or dword [0x4c2cd8], 1
mov dword [0x4bd834], 0xc3dfc8c6
mov dword [0x4bd838], 0x9f9ec1c8
mov dword [0x4bd83c], 0xc1c1c983
mov byte [0x4bd840], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd834]
xor cl, 0xad
mov byte [eax + 0x4bda34], cl
inc eax
cmp eax, 0xd
jb 0x406608
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x4bda34
call edi
mov esi, eax
test esi, esi
jne 0x40667c
call dword [0x4920a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0042a914
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.004067de
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.00405c65
push 0x4aec28
mov eax, esi
push eax
call fcn.0046d8b5
call fcn.0040685b
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x406749
call fcn.004068ce
push eax
call edi
mov edi, eax
test edi, edi
jne 0x4066ed
call dword [0x4920a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042a914
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.00406918
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.00405c65
push 0x4aec28
mov eax, esi
jmp 0x406676
call fcn.00406992
push eax
push edi
call esi
test eax, eax
jne 0x406749
call dword [0x4920a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042a914
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.00406a02
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.00405c65
push 0x4aec28
mov eax, esi
jmp 0x406676
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x4067ab
call dword [0x4920a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0042a914
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.00406abb
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.00405c65
push 0x4aec28
mov eax, esi
jmp 0x406676
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404d60
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4067de
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cd4], 1
jne 0x40683e
or dword [0x4c2cd4], 1
mov dword [0x4bd844], 0xc9ccc2e1
mov dword [0x4bd848], 0xdfcfc4e1
mov dword [0x4bd84c], 0x8dd4dfcc
mov dword [0x4bd850], 0xc1c4cccb
mov dword [0x4bd854], 0x858dc9c8
mov dword [0x4bd858], 0xc3dfc8c6
mov dword [0x4bd85c], 0x9f9ec1c8
mov dword [0x4bd860], 0xad8d9784
xor eax, eax
mov cl, byte [eax + 0x4bd844]
xor cl, 0xad
mov byte [eax + 0x4bda44], cl
inc eax
cmp eax, 0x20
jb 0x406840
mov eax, 0x4bda44
ret
Function at 0x40685b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cd0], 1
jne 0x4068b1
or dword [0x4c2cd0], 1
mov dword [0x4bd864], 0xea9f9ee6
mov dword [0x4bd868], 0xdffdd9c8
mov dword [0x4bd86c], 0xdec8cec2
mov dword [0x4bd870], 0xccc0e4de
mov dword [0x4bd874], 0xc4ebc8ca
mov dword [0x4bd878], 0xcce3c8c1
mov dword [0x4bd87c], 0xadecc8c0
xor eax, eax
mov cl, byte [eax + 0x4bd864]
xor cl, 0xad
mov byte [eax + 0x4bda64], cl
inc eax
cmp eax, 0x1c
jb 0x4068b3
mov eax, 0x4bda64
ret

Function at 0x4068ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ccc], 1
jne 0x4068fb
or dword [0x4c2ccc], 1
mov dword [0x4bd880], 0xddccdedd
mov dword [0x4bd884], 0xc1c983c4
mov word [0x4bd888], 0xadc1
xor eax, eax
mov cl, byte [eax + 0x4bd880]
xor cl, 0xad
mov byte [eax + 0x4bda80], cl
inc eax
cmp eax, 0xa
jb 0x4068fd
mov eax, 0x4bda80
ret

Function at 0x406918
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cc8], 1
jne 0x406975
or dword [0x4c2cc8], 1
mov dword [0x4bd88c], 0xc9ccc2e1
mov dword [0x4bd890], 0xdfcfc4e1
mov dword [0x4bd894], 0x8dd4dfcc
mov dword [0x4bd898], 0xc1c4cccb
mov dword [0x4bd89c], 0x858dc9c8
mov dword [0x4bd8a0], 0xddccdedd
mov dword [0x4bd8a4], 0x8d9784c4
mov byte [0x4bd8a8], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd88c]
xor cl, 0xad
mov byte [eax + 0x4bda8c], cl
inc eax
cmp eax, 0x1d
jb 0x406977
mov eax, 0x4bda8c
ret

Function at 0x406992
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cc4], 1
jne 0x4069e5
or dword [0x4c2cc4], 1
mov dword [0x4bd8ac], 0xfdd9c8ea
mov dword [0x4bd8b0], 0xc8cec2df
mov dword [0x4bd8b4], 0xc0e4dede
mov dword [0x4bd8b8], 0xebc8cacc
mov dword [0x4bd8bc], 0xe3c8c1c4
mov dword [0x4bd8c0], 0xecc8c0cc
mov byte [0x4bd8c4], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd8ac]
xor cl, 0xad
mov byte [eax + 0x4bdaac], cl
inc eax
cmp eax, 0x19
jb 0x4069e7
mov eax, 0x4bdaac
ret

Function at 0x406a02
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cc0], 1
jne 0x406a9e
or dword [0x4c2cc0], 1
mov dword [0x4bd8c8], 0xfdd9c8ea
mov dword [0x4bd8cc], 0xeccec2df
mov dword [0x4bd8d0], 0xc8dfc9c9
mov dword [0x4bd8d4], 0xcb8ddede
mov dword [0x4bd8d8], 0xc8c1c4cc
mov dword [0x4bd8dc], 0xea858dc9
mov dword [0x4bd8e0], 0xdffdd9c8
mov dword [0x4bd8e4], 0xdec8cec2
mov dword [0x4bd8e8], 0xccc0e4de
mov dword [0x4bd8ec], 0xc4ebc8ca
mov dword [0x4bd8f0], 0xcce3c8c1
mov dword [0x4bd8f4], 0x84ecc8c0
mov word [0x4bd8f8], 0x8d97
mov byte [0x4bd8fa], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd8c8]
xor cl, 0xad
mov byte [eax + 0x4bdac8], cl
inc eax
cmp eax, 0x33
jb 0x406aa0
mov eax, 0x4bdac8
ret

Function at 0x406abb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cbc], 1
jne 0x406b22
or dword [0x4c2cbc], 1
mov dword [0x4bd8fc], 0xfdd9c8ea
mov dword [0x4bd900], 0xc8cec2df
mov dword [0x4bd904], 0xc0e4dede
mov dword [0x4bd908], 0xebc8cacc
mov dword [0x4bd90c], 0xc3c8c1c4
mov dword [0x4bd910], 0x8dc8c0cc
mov dword [0x4bd914], 0xc1c4cccb
mov dword [0x4bd918], 0x8d97c9c8
mov byte [0x4bd91c], 0xad
xor eax, eax
mov cl, byte [eax + 0x4bd8fc]
xor cl, 0xad
mov byte [eax + 0x4bdafc], cl
inc eax
cmp eax, 0x21
jb 0x406b24
mov eax, 0x4bdafc
ret
Function at 0x4076d5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cb8], 1
jne 0x4078bb
or dword [0x4c2cb8], 1
mov dword [0x4bdb28], 0xdd80c1c7
mov dword [0x4bdb2c], 0xdbc1cada
mov dword [0x4bdb30], 0xcbdd94da
mov dword [0x4bdb34], 0xdbccd8da
mov dword [0x4bdb38], 0xc08986c8
mov dword [0x4bdb3c], 0xa48789c1
mov dword [0x4bdb40], 0xc5cdcfde
mov dword [0x4bdb44], 0x80cbc9cf
mov dword [0x4bdb48], 0xc6dacfde
mov dword [0x4bdb4c], 0x898e938e
mov dword [0x4bdb50], 0xcbdca489
mov dword [0x4bdb54], 0xdcc7dbdf
mov dword [0x4bdb58], 0xdd8986cb
mov dword [0x4bdb5c], 0xcdc7dcda
mov dword [0x4bdb60], 0xa48789da
mov dword [0x4bdb64], 0xcfcdc1c2
mov dword [0x4bdb68], 0x82dd8ec2
mov dword [0x4bdb6c], 0x938edc8e
mov dword [0x4bdb70], 0xcdded68e
mov dword [0x4bdb74], 0x86c2c2cf
mov dword [0x4bdb78], 0xcdc0dbc8
mov dword [0x4bdb7c], 0xc0c1c7da
mov dword [0x4bdb80], 0xdc8e8786
mov dword [0x4bdb84], 0xdcdbdacb
mov dword [0x4bdb88], 0xcbdc8ec0
mov dword [0x4bdb8c], 0xdcc7dbdf
mov dword [0x4bdb90], 0x8b8986cb
mov dword [0x4bdb94], 0x808789e3
mov dword [0x4bdb98], 0xc0c7cfc3
mov dword [0x4bdb9c], 0xcff1f186
mov dword [0x4bdba0], 0x87ddc9dc
mov dword [0x4bdba4], 0xcac0cb8e
mov dword [0x4bdba8], 0xcbca8e82
mov dword [0x4bdbac], 0x80c9dbcc
mov dword [0x4bdbb0], 0xcdcfdcda
mov dword [0x4bdbb4], 0xcdcfcccb
mov dword [0x4bdbb8], 0xc7a487c5
mov dword [0x4bdbbc], 0xc1c08ec8
mov dword [0x4bdbc0], 0x8edd8eda
mov dword [0x4bdbc4], 0xc0cbc6da
mov dword [0x4bdbc8], 0xdcdccb8e
mov dword [0x4bdbcc], 0xdc86dcc1
mov dword [0x4bdbd0], 0xc0cb8e87
mov dword [0x4bdbd4], 0xcbdca4ca
mov dword [0x4bdbd8], 0xc0dcdbda
mov word [0x4bdbdc], 0xdc8e
mov byte [0x4bdbde], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdb28]
xor cl, 0xae
mov byte [eax + 0x4be120], cl
inc eax
cmp eax, 0xb7
jb 0x4078bd
mov eax, 0x4be120
ret
Function at 0x4078da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2cb4], 1
jne 0x407b60
or dword [0x4c2cb4], 1
mov dword [0x4bdbe0], 0xdd80c1c7
mov dword [0x4bdbe4], 0xdbc1cada
mov dword [0x4bdbe8], 0xcbdd94da
mov dword [0x4bdbec], 0xdbccd8da
mov dword [0x4bdbf0], 0xc08986c8
mov dword [0x4bdbf4], 0xa48789c1
mov dword [0x4bdbf8], 0xc5cdcfde
mov dword [0x4bdbfc], 0x80cbc9cf
mov dword [0x4bdc00], 0xc6dacfde
mov dword [0x4bdc04], 0xa4898993
mov dword [0x4bdc08], 0xdbdfcbdc
mov dword [0x4bdc0c], 0x86cbdcc7
mov dword [0x4bdc10], 0xdcdadd89
mov dword [0x4bdc14], 0x89dacdc7
mov dword [0x4bdc18], 0xc1c2a487
mov dword [0x4bdc1c], 0x8ec2cfcd
mov dword [0x4bdc20], 0x938ec2c3
mov dword [0x4bdc24], 0xdfcbdc8e
mov dword [0x4bdc28], 0xcbdcc7db
mov dword [0x4bdc2c], 0xc2c38986
mov dword [0x4bdc30], 0xc2a48789
mov dword [0x4bdc34], 0xc2cfcdc1
mov dword [0x4bdc38], 0xdc82dd8e
mov dword [0x4bdc3c], 0x938ecb82
mov dword [0x4bdc40], 0xcdded68e
mov dword [0x4bdc44], 0x86c2c2cf
mov dword [0x4bdc48], 0xcdc0dbc8
mov dword [0x4bdc4c], 0xc0c1c7da
mov dword [0x4bdc50], 0xdc8e8786
mov dword [0x4bdc54], 0xdcdbdacb
mov dword [0x4bdc58], 0xcbdc8ec0
mov dword [0x4bdc5c], 0xdcc7dbdf
mov dword [0x4bdc60], 0x8b8986cb
mov dword [0x4bdc64], 0x808789e3
mov dword [0x4bdc68], 0x8b86e88b
mov dword [0x4bdc6c], 0xcb8e87ef
mov dword [0x4bdc70], 0x8e82cac0
mov dword [0x4bdc74], 0xdbcccbca
mov dword [0x4bdc78], 0xdcda80c9
mov dword [0x4bdc7c], 0xcccbcdcf
mov dword [0x4bdc80], 0x87c5cdcf
mov dword [0x4bdc84], 0x8ec8c7a4
mov dword [0x4bdc88], 0x8edac1c0
mov dword [0x4bdc8c], 0xc6da8edd
mov dword [0x4bdc90], 0xdc8ec0cb
mov dword [0x4bdc94], 0xdcdbdacb
mov dword [0x4bdc98], 0xc7c08ec0
mov dword [0x4bdc9c], 0xdc8e82c2
mov dword [0x4bdca0], 0xcac0cb8e
mov dword [0x4bdca4], 0x8ec8c7a4
mov dword [0x4bdca8], 0x93d08edc
mov dword [0x4bdcac], 0xc2c7c08e
mov dword [0x4bdcb0], 0xcbc6da8e
mov dword [0x4bdcb4], 0x8edc8ec0
mov dword [0x4bdcb8], 0xc2c38e93
mov dword [0x4bdcbc], 0xdaddda80
mov dword [0x4bdcc0], 0xc9c0c7dc
mov dword [0x4bdcc4], 0x8e87dc86
mov dword [0x4bdcc8], 0xa4cac0cb
mov dword [0x4bdccc], 0xdbdacbdc
mov dword [0x4bdcd0], 0xdc8ec0dc
mov word [0x4bdcd4], 0xcb82
mov byte [0x4bdcd6], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdbe0]
xor cl, 0xae
mov byte [eax + 0x4be1d8], cl
inc eax
cmp eax, 0xf7
jb 0x407b62
mov eax, 0x4be1d8
ret
Function at 0x407b7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x4c2c74], 1
jne 0x407ba6
or dword [0x4c2c74], 1
mov dword [0x4bddcc], 0xc5cdcfde
mov dword [0x4bddd0], 0xaecbc9cf
xor eax, eax
mov cl, byte [eax + 0x4bddcc]
xor cl, 0xae
mov byte [eax + 0x4be3c4], cl
inc eax
cmp eax, 8
jb 0x407ba8
push 0x4be3c4
push dword [ebp + 8]
call fcn.00450bd8
test byte [0x4c2c70], 1
pop ecx
pop ecx
jne 0x407bf0
or dword [0x4c2c70], 1
mov dword [0x4bddd4], 0xc2cbdcde
mov dword [0x4bddd8], 0xaecacfc1
xor eax, eax
mov cl, byte [eax + 0x4bddd4]
xor cl, 0xae
mov byte [eax + 0x4be3cc], cl
inc eax
cmp eax, 8
jb 0x407bf2
push esi
push 0x4be3cc
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00450c4c
add esp, 0xc
cmp dword [0x4b8be0], 0
mov esi, 0x4b8be0
je 0x407c52
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.00450af8
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00450e79
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x407c2b
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0045034d
pop ecx
pop ecx
pop esi
pop ebp
ret