joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411f6d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4987b8], 1
jne 0x411fd8
or dword [0x4987b8], 1
mov dword [0x496a60], 0xf000e0b
mov dword [0x496a64], 0x2141213
mov dword [0x496a68], 0x13060315
mov dword [0x496a6c], 0x2143806
mov dword [0x496a70], 0x6113813
mov dword [0x496a74], 0x9060e15
mov dword [0x496a78], 0x8053813
mov dword [0x496a7c], 0x6020b08
mov word [0x496a80], 0x6709
mov cl, byte [eax + 0x496a60]
xor cl, 0x67
mov byte [eax + 0x496c38], cl
inc eax
cmp eax, 0x22
jb 0x411fd8
mov eax, 0x496c38
ret

Function at 0x411ff3
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4987b4], 1
jne 0x41205b
or dword [0x4987b4], 1
mov dword [0x496a84], 0xf000e0b
mov dword [0x496a88], 0x2141213
mov dword [0x496a8c], 0x13060315
mov dword [0x496a90], 0x2143806
mov dword [0x496a94], 0x6113813
mov dword [0x496a98], 0x9060e15
mov dword [0x496a9c], 0x12093813
mov word [0x496aa0], 0xb0b
mov byte [0x496aa2], 0x67
mov cl, byte [eax + 0x496a84]
xor cl, 0x67
mov byte [eax + 0x496c5c], cl
inc eax
cmp eax, 0x1f
jb 0x41205b
mov eax, 0x496c5c
ret

Function at 0x4122eb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x462ac7
call fcn.00461d38
sub esp, 0x20
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push esi
mov dword [ebp - 0x10], ebx
call dword [0x46a0a8]
test byte [0x498794], 1
mov esi, eax
jne 0x412338
or dword [0x498794], 1
mov dword [0x496cf8], 0x7001e
mov dword [0x496cfc], 0x471d0c07
mov dword [0x496d00], 0x6905050d
xor ecx, ecx
mov al, byte [ecx + 0x496cf8]
xor al, 0x69
mov byte [ecx + 0x496fac], al
inc ecx
cmp ecx, 0xc
jb 0x41233a
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0x496fac
call dword [0x46a0d4]
push eax
push 0x1b00
call dword [0x46a12c]
test eax, eax
jne 0x412384
call fcn.004123f7
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.003fd34b
pop ecx
pop ecx
jmp 0x4123e7
test byte [0x49878c], 1
jne 0x4123a4
or dword [0x49878c], 1
mov word [0x496d20], 0x4953
mov byte [0x496d22], 0x69
xor eax, eax
mov cl, byte [eax + 0x496d20]
xor cl, 0x69
mov byte [eax + 0x496fd4], cl
inc eax
cmp eax, 3
jb 0x4123a6
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push 0x496fd4
push eax
call fcn.003fd34b
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
push eax
push edi
call fcn.003fd6fe
add esp, 0x14
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.003f4ce6
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4123f7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498790], 1
jne 0x41244e
or dword [0x498790], 1
mov dword [0x496d04], 0x82f4149
mov dword [0x496d08], 0xd0c0500
mov dword [0x496d0c], 0x49061d49
mov dword [0x496d10], 0x41b060f
mov dword [0x496d14], 0xc491d08
mov dword [0x496d18], 0x1b061b1b
mov word [0x496d1c], 0x6940
mov cl, byte [eax + 0x496d04]
xor cl, 0x69
mov byte [eax + 0x496fb8], cl
inc eax
cmp eax, 0x1a
jb 0x41244e
mov eax, 0x496fb8
ret
Function at 0x4125b6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498788], 1
jne 0x412601
or dword [0x498788], 1
mov dword [0x496d24], 0x2107003e
mov dword [0x496d28], 0x26191d1d
mov dword [0x496d2c], 0x41070c19
mov dword [0x496d30], 0x80f4940
mov dword [0x496d34], 0xd0c0500
mov byte [0x496d38], 0x69
mov cl, byte [eax + 0x496d24]
xor cl, 0x69
mov byte [eax + 0x496fd8], cl
inc eax
cmp eax, 0x15
jb 0x412601
mov eax, 0x496fd8
ret

Function at 0x4128c4
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498784], 1
jne 0x412919
or dword [0x498784], 1
mov dword [0x496d3c], 0x2107003e
mov dword [0x496d40], 0x2a191d1d
mov dword [0x496d44], 0x20a081b
mov dword [0x496d48], 0x41051b3c
mov dword [0x496d4c], 0x80f4940
mov dword [0x496d50], 0xd0c0500
mov byte [0x496d54], 0x69
mov cl, byte [eax + 0x496d3c]
xor cl, 0x69
mov byte [eax + 0x496ff0], cl
inc eax
cmp eax, 0x19
jb 0x412919
mov eax, 0x496ff0
ret

Function at 0x412934
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498780], 1
jne 0x412982
or dword [0x498780], 1
mov dword [0x496d58], 0x2107003e
mov dword [0x496d5c], 0x2a191d1d
mov dword [0x496d60], 0xc070706
mov dword [0x496d64], 0x40411d0a
mov dword [0x496d68], 0x80f49
mov dword [0x496d6c], 0x690d0c05
mov cl, byte [eax + 0x496d58]
xor cl, 0x69
mov byte [eax + 0x49700c], cl
inc eax
cmp eax, 0x18
jb 0x412982
mov eax, 0x49700c
ret

Function at 0x4132db
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x49877c], 1
jne 0x4133b6
or dword [0x49877c], 1
mov dword [0x496d70], 0x1c180c3b
mov dword [0x496d74], 0x491d1a0c
mov dword [0x496d78], 0x49051b1c
mov dword [0x496d7c], 0xd0c1a1c
mov dword [0x496d80], 0xd490849
mov dword [0x496d84], 0xc0f0f00
mov dword [0x496d88], 0x1d070c1b
mov dword [0x496d8c], 0x10a1a49
mov dword [0x496d90], 0x490c040c
mov dword [0x496d94], 0x708011d
mov dword [0x496d98], 0xc011d49
mov dword [0x496d9c], 0x7060a49
mov dword [0x496da0], 0x1d0a0c07
mov dword [0x496da4], 0x49070600
mov dword [0x496da8], 0x491a081e
mov dword [0x496dac], 0x1d000700
mov dword [0x496db0], 0x50800
mov dword [0x496db4], 0x490d0c13
mov dword [0x496db8], 0x11d001e
mov byte [0x496dbc], 0x69
mov cl, byte [eax + 0x496d70]
xor cl, 0x69
mov byte [eax + 0x497028], cl
inc eax
cmp eax, 0x4d
jb 0x4133b6
mov eax, 0x497028
ret
Function at 0x4133d1
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498778], 1
jne 0x4134af
or dword [0x498778], 1
mov dword [0x496dc0], 0x1c180c3b
mov dword [0x496dc4], 0x491d1a0c
mov dword [0x496dc8], 0x49051b1c
mov dword [0x496dcc], 0xd0c1a1c
mov dword [0x496dd0], 0xd490849
mov dword [0x496dd4], 0xc0f0f00
mov dword [0x496dd8], 0x1d070c1b
mov dword [0x496ddc], 0x1a060149
mov dword [0x496de0], 0x807491d
mov dword [0x496de4], 0x1d490c04
mov dword [0x496de8], 0x49070801
mov dword [0x496dec], 0x490c011d
mov dword [0x496df0], 0x707060a
mov dword [0x496df4], 0x1d0a0c
mov dword [0x496df8], 0x1e490706
mov dword [0x496dfc], 0x491a08
mov dword [0x496e00], 0x1d0007
mov dword [0x496e04], 0x13000508
mov dword [0x496e08], 0x1e490d0c
mov dword [0x496e0c], 0x69011d00
mov cl, byte [eax + 0x496dc0]
xor cl, 0x69
mov byte [eax + 0x497078], cl
inc eax
cmp eax, 0x50
jb 0x4134af
mov eax, 0x497078
ret

Function at 0x4134ca
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498774], 1
jne 0x4135a4
or dword [0x498774], 1
mov dword [0x496e10], 0x1c180c3b
mov dword [0x496e14], 0x491d1a0c
mov dword [0x496e18], 0x49051b1c
mov dword [0x496e1c], 0xd0c1a1c
mov dword [0x496e20], 0xd490849
mov dword [0x496e24], 0xc0f0f00
mov dword [0x496e28], 0x1d070c1b
mov dword [0x496e2c], 0x1b061949
mov dword [0x496e30], 0x11d491d
mov dword [0x496e34], 0x1d490708
mov dword [0x496e38], 0xa490c01
mov dword [0x496e3c], 0xc070706
mov dword [0x496e40], 0x6001d0a
mov dword [0x496e44], 0x81e4907
mov dword [0x496e48], 0x700491a
mov dword [0x496e4c], 0x8001d00
mov dword [0x496e50], 0xc130005
mov dword [0x496e54], 0x1e490d
mov word [0x496e58], 0x11d
mov byte [0x496e5a], 0x69
mov cl, byte [eax + 0x496e10]
xor cl, 0x69
mov byte [eax + 0x4970c8], cl
inc eax
cmp eax, 0x4b
jb 0x4135a4
mov eax, 0x4970c8
ret

Function at 0x4135bf
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498770], 1
jne 0x413617
or dword [0x498770], 1
mov dword [0x496e5c], 0x2107003e
mov dword [0x496e60], 0x26191d1d
mov dword [0x496e64], 0x3b070c19
mov dword [0x496e68], 0xc1c180c
mov dword [0x496e6c], 0x40411d1a
mov dword [0x496e70], 0x80f49
mov dword [0x496e74], 0x690d0c05
mov cl, byte [eax + 0x496e5c]
xor cl, 0x69
mov byte [eax + 0x497114], cl
inc eax
cmp eax, 0x1c
jb 0x413617
mov eax, 0x497114
ret
Function at 0x413632
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x49876c], 1
jne 0x413703
or dword [0x49876c], 1
mov dword [0x496e78], 0x2107003e
mov dword [0x496e7c], 0x3a191d1d
mov dword [0x496e80], 0x19261d0c
mov dword [0x496e84], 0x706001d
mov dword [0x496e88], 0x27203e41
mov dword [0x496e8c], 0x393d3d21
mov dword [0x496e90], 0x3d392636
mov dword [0x496e94], 0x36272620
mov dword [0x496e98], 0x3c2a2c3a
mov dword [0x496e9c], 0x303d203b
mov dword [0x496ea0], 0x28252f36
mov dword [0x496ea4], 0x49403a2e
mov dword [0x496ea8], 0x1b490706
mov dword [0x496eac], 0xc1c180c
mov dword [0x496eb0], 0x1491d1a
mov dword [0x496eb4], 0x50d0708
mov dword [0x496eb8], 0x80f490c
mov dword [0x496ebc], 0xd0c0500
mov byte [0x496ec0], 0x69
mov cl, byte [eax + 0x496e78]
xor cl, 0x69
mov byte [eax + 0x497130], cl
inc eax
cmp eax, 0x49
jb 0x413703
mov eax, 0x497130
ret

Function at 0x41371e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498768], 1
jne 0x4137ee
or dword [0x498768], 1
mov dword [0x496ec8], 0x2107003e
mov dword [0x496ecc], 0x3a191d1d
mov dword [0x496ed0], 0x19261d0c
mov dword [0x496ed4], 0x706001d
mov dword [0x496ed8], 0x27203e41
mov dword [0x496edc], 0x393d3d21
mov dword [0x496ee0], 0x3d392636
mov dword [0x496ee4], 0x36272620
mov dword [0x496ee8], 0x2d272c3a
mov dword [0x496eec], 0x24203d36
mov dword [0x496ef0], 0x3d3c262c
mov dword [0x496ef4], 0x7064940
mov dword [0x496ef8], 0x180c1b49
mov dword [0x496efc], 0x1d1a0c1c
mov dword [0x496f00], 0x7080149
mov dword [0x496f04], 0x490c050d
mov dword [0x496f08], 0x500080f
mov word [0x496f0c], 0xd0c
mov byte [0x496f0e], 0x69
mov cl, byte [eax + 0x496ec8]
xor cl, 0x69
mov byte [eax + 0x497180], cl
inc eax
cmp eax, 0x47
jb 0x4137ee
mov eax, 0x497180
ret

Function at 0x413809
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498764], 1
jne 0x413874
or dword [0x498764], 1
mov dword [0x496f10], 0x2107003e
mov dword [0x496f14], 0x28191d1d
mov dword [0x496f18], 0xc3b0d0d
mov dword [0x496f1c], 0x1a0c1c18
mov dword [0x496f20], 0x80c211d
mov dword [0x496f24], 0x1a1b0c0d
mov dword [0x496f28], 0xf494041
mov dword [0x496f2c], 0xc050008
mov word [0x496f30], 0x690d
mov cl, byte [eax + 0x496f10]
xor cl, 0x69
mov byte [eax + 0x4971c8], cl
inc eax
cmp eax, 0x22
jb 0x413874
mov eax, 0x4971c8
ret

Function at 0x41388f
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498760], 1
jne 0x4138e4
or dword [0x498760], 1
mov dword [0x496f34], 0x191d1d21
mov dword [0x496f38], 0xd070c3a
mov dword [0x496f3c], 0x1c180c3b
mov dword [0x496f40], 0x411d1a0c
mov dword [0x496f44], 0x80f4940
mov dword [0x496f48], 0xd0c0500
mov byte [0x496f4c], 0x69
mov cl, byte [eax + 0x496f34]
xor cl, 0x69
mov byte [eax + 0x4971ec], cl
inc eax
cmp eax, 0x19
jb 0x4138e4
mov eax, 0x4971ec
ret
Function at 0x4138ff
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x49875c], 1
jne 0x413953
or dword [0x49875c], 1
mov dword [0x496f50], 0x191d1d21
mov dword [0x496f54], 0x1b0c1c38
mov dword [0x496f58], 0xf072010
mov dword [0x496f5c], 0x49404106
mov dword [0x496f60], 0x500080f
mov word [0x496f64], 0xd0c
mov byte [0x496f66], 0x69
mov cl, byte [eax + 0x496f50]
xor cl, 0x69
mov byte [eax + 0x497208], cl
inc eax
cmp eax, 0x17
jb 0x413953
mov eax, 0x497208
ret
Function at 0x41413c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498754], 1
jne 0x4141ae
or dword [0x498754], 1
mov dword [0x496f6c], 0x2107003e
mov dword [0x496f70], 0x38191d1d
mov dword [0x496f74], 0x101b0c1c
mov dword [0x496f78], 0x81d082d
mov dword [0x496f7c], 0x81f28
mov dword [0x496f80], 0x50b0805
mov dword [0x496f84], 0x4940410c
mov dword [0x496f88], 0x500080f
mov word [0x496f8c], 0xd0c
mov byte [0x496f8e], 0x69
mov cl, byte [eax + 0x496f6c]
xor cl, 0x69
mov byte [eax + 0x497224], cl
inc eax
cmp eax, 0x23
jb 0x4141ae
mov eax, 0x497224
ret

Function at 0x4141c9
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x498750], 1
jne 0x414220
or dword [0x498750], 1
mov dword [0x496f90], 0xc1d0720
mov dword [0x496f94], 0x1d0c071b
mov dword [0x496f98], 0xd080c3b
mov dword [0x496f9c], 0xc05002f
mov dword [0x496fa0], 0xf494041
mov dword [0x496fa4], 0xc050008
mov word [0x496fa8], 0x690d
mov cl, byte [eax + 0x496f90]
xor cl, 0x69
mov byte [eax + 0x497248], cl
inc eax
cmp eax, 0x1a
jb 0x414220
mov eax, 0x497248
ret

Function at 0x415006
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498734], 1
jne 0x41508d
or dword [0x498734], 1
mov dword [0x497280], 0x1f4a042b
mov dword [0x497284], 0x90f1804
mov dword [0x497288], 0x3040d05
mov dword [0x49728c], 0x4a0e0f10
mov dword [0x497290], 0xf01051e
mov dword [0x497294], 0xb1d4a04
mov dword [0x497298], 0x50c4a19
mov dword [0x49729c], 0x4a0e041f
mov dword [0x4972a0], 0x94a1e0b
mov dword [0x4972a4], 0xb180b02
mov dword [0x4972a8], 0x180f1e09
mov word [0x4972ac], 0x6a4a
xor eax, eax
mov cl, byte [eax + 0x497280]
xor cl, 0x6a
mov byte [eax + 0x4973d0], cl
inc eax
cmp eax, 0x2e
jb 0x41508f
mov eax, 0x4973d0
ret
Function at 0x4154d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498730], 1
jne 0x41552f
or dword [0x498730], 1
mov dword [0x4972b0], 0x19190327
mov dword [0x4972b4], 0x4a0d0403
mov dword [0x4972b8], 0xf064a0b
mov dword [0x4972bc], 0x1a4a1e0c
mov dword [0x4972c0], 0x40f180b
mov dword [0x4972c4], 0x190f021e
mov word [0x4972c8], 0x1903
mov byte [0x4972ca], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4972b0]
xor cl, 0x6a
mov byte [eax + 0x497400], cl
inc eax
cmp eax, 0x1b
jb 0x415531
mov eax, 0x497400
ret

Function at 0x41554c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49872c], 1
jne 0x4155b5
or dword [0x49872c], 1
mov dword [0x4972cc], 0x4a1e0524
mov dword [0x4972d0], 0x1f05040f
mov dword [0x4972d4], 0x54a020d
mov dword [0x4972d8], 0xb180f1a
mov dword [0x4972dc], 0x4a190e04
mov dword [0x4972e0], 0xf4a0403
mov dword [0x4972e4], 0xf181a12
mov dword [0x4972e8], 0x5031919
mov word [0x4972ec], 0x6a04
xor eax, eax
mov cl, byte [eax + 0x4972cc]
xor cl, 0x6a
mov byte [eax + 0x49741c], cl
inc eax
cmp eax, 0x22
jb 0x4155b7
mov eax, 0x49741c
ret

Function at 0x4155d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498728], 1
jne 0x415632
or dword [0x498728], 1
mov dword [0x4972f0], 0x4a05053e
mov dword [0x4972f4], 0x13040b07
mov dword [0x4972f8], 0xf1a054a
mov dword [0x4972fc], 0xe040b18
mov dword [0x497300], 0x4034a19
mov dword [0x497304], 0x1a120f4a
mov dword [0x497308], 0x19190f18
mov dword [0x49730c], 0x6a040503
xor eax, eax
mov cl, byte [eax + 0x4972f0]
xor cl, 0x6a
mov byte [eax + 0x497440], cl
inc eax
cmp eax, 0x20
jb 0x415634
mov eax, 0x497440
ret

Function at 0x41564f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498724], 1
jne 0x4156a5
or dword [0x498724], 1
mov dword [0x497310], 0x19190327
mov dword [0x497314], 0x4a0d0403
mov dword [0x497318], 0x3184a0b
mov dword [0x49731c], 0x4a1e020d
mov dword [0x497320], 0xf180b1a
mov dword [0x497324], 0xf021e04
mov dword [0x497328], 0x6a190319
xor eax, eax
mov cl, byte [eax + 0x497310]
xor cl, 0x6a
mov byte [eax + 0x497460], cl
inc eax
cmp eax, 0x1c
jb 0x4156a7
mov eax, 0x497460
ret

Function at 0x4156c2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498720], 1
jne 0x415733
or dword [0x498720], 1
mov dword [0x49732c], 0x180b043f
mov dword [0x497330], 0x1a054a13
mov dword [0x497334], 0x1e0b180f
mov dword [0x497338], 0x74a1805
mov dword [0x49733c], 0x4a1e191f
mov dword [0x497340], 0xf1c0b02
mov dword [0x497344], 0xf04054a
mov dword [0x497348], 0xf1a054a
mov dword [0x49734c], 0xe040b18
mov byte [0x497350], 0x6a
xor eax, eax
mov cl, byte [eax + 0x49732c]
xor cl, 0x6a
mov byte [eax + 0x49747c], cl
inc eax
cmp eax, 0x25
jb 0x415735
mov eax, 0x49747c
ret
Function at 0x415750
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49871c], 1
jne 0x4157ca
or dword [0x49871c], 1
mov dword [0x497354], 0xb040328
mov dword [0x497358], 0x54a1318
mov dword [0x49735c], 0xb180f1a
mov dword [0x497360], 0x4a18051e
mov dword [0x497364], 0x1e191f07
mov dword [0x497368], 0x1c0b024a
mov dword [0x49736c], 0x1d1e4a0f
mov dword [0x497370], 0x1a054a05
mov dword [0x497374], 0x40b180f
mov word [0x497378], 0x190e
mov byte [0x49737a], 0x6a
xor eax, eax
mov cl, byte [eax + 0x497354]
xor cl, 0x6a
mov byte [eax + 0x4974a4], cl
inc eax
cmp eax, 0x27
jb 0x4157cc
mov eax, 0x4974a4
ret

Function at 0x4157e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498718], 1
jne 0x415850
or dword [0x498718], 1
mov dword [0x49737c], 0xb040328
mov dword [0x497380], 0x54a1318
mov dword [0x497384], 0xb180f1a
mov dword [0x497388], 0x4a18051e
mov dword [0x49738c], 0x4a1e0504
mov dword [0x497390], 0x61a0703
mov dword [0x497394], 0x40f070f
mov dword [0x497398], 0x500e0f1e
mov word [0x49739c], 0x6a4a
xor eax, eax
mov cl, byte [eax + 0x49737c]
xor cl, 0x6a
mov byte [eax + 0x4974cc], cl
inc eax
cmp eax, 0x22
jb 0x415852
mov eax, 0x4974cc
ret
Function at 0x417202
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x417244
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x481f08]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x481f08]
inc edx
cmp dword [ebp + 8], 0
jne 0x41720f
pop esi
not eax
pop ebp
ret

Function at 0x418e8f
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x418eb4
cmp dword [ecx + 0x38], ebx
je 0x418eb4
cmp eax, dword [ecx + 0x10]
jae 0x418eb4
cmp dword [ecx + 0x14], 1
jne 0x418eb4
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x418eb6
xor edi, edi
cmp edi, ebx
je 0x418f99
cmp esi, ebx
je 0x418f99
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00418638
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x418f45
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0043f0d0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x418f6a
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0043f0d0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x418f9b
xor eax, eax
pop edi
pop ebx
ret

Function at 0x419974
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49870c], 1
jne 0x4199f9
or dword [0x49870c], 1
mov dword [0x497508], 0x6030b2c
mov dword [0x49750c], 0x1e4a0e0f
mov dword [0x497510], 0x18094a05
mov dword [0x497514], 0xf1e0b0f
mov dword [0x497518], 0xb1f064a
mov dword [0x49751c], 0xb1e194a
mov dword [0x497520], 0x424a0f1e
mov dword [0x497524], 0x118051d
mov dword [0x497528], 0x1e4a180f
mov dword [0x49752c], 0xb0f1802
mov dword [0x497530], 0x4a50430e
mov byte [0x497534], 0x6a
xor eax, eax
mov cl, byte [eax + 0x497508]
xor cl, 0x6a
mov byte [eax + 0x4975d0], cl
inc eax
cmp eax, 0x2d
jb 0x4199fb
mov eax, 0x4975d0
ret
Function at 0x419a16
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4986fc], 1
jne 0x419a7f
or dword [0x4986fc], 1
mov dword [0x497544], 0xf4a0524
mov dword [0x497548], 0x18051818
mov dword [0x49754c], 0x190f074a
mov dword [0x497550], 0xf0d0b19
mov dword [0x497554], 0x1e0f184a
mov dword [0x497558], 0xf04181f
mov dword [0x49755c], 0x13084a0e
mov dword [0x497560], 0x805004a
mov byte [0x497564], 0x6a
mov cl, byte [eax + 0x497544]
xor cl, 0x6a
mov byte [eax + 0x49760c], cl
inc eax
cmp eax, 0x21
jb 0x419a7f
mov eax, 0x49760c
ret

Function at 0x419a9a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4986f0], 1
jne 0x419b03
or dword [0x4986f0], 1
mov dword [0x497590], 0x4a0b1f26
mov dword [0x497594], 0x518180f
mov dword [0x497598], 0x1f184a18
mov dword [0x49759c], 0x4030404
mov dword [0x4975a0], 0x180f4a0d
mov dword [0x4975a4], 0x4a180518
mov dword [0x4975a8], 0xe040b02
mov dword [0x4975ac], 0x50180f06
mov word [0x4975b0], 0x6a4a
xor eax, eax
mov cl, byte [eax + 0x497590]
xor cl, 0x6a
mov byte [eax + 0x497658], cl
inc eax
cmp eax, 0x22
jb 0x419b05
mov eax, 0x497658
ret

Function at 0x419b20
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4986ec], 1
jne 0x419b72
or dword [0x4986ec], 1
mov dword [0x4975b4], 0x260b1f06
mov dword [0x4975b8], 0xb050635
mov dword [0x4975bc], 0x181e190e
mov dword [0x4975c0], 0x4a0d0403
mov dword [0x4975c4], 0x6030b0c
mov word [0x4975c8], 0xe0f
mov byte [0x4975ca], 0x6a
xor eax, eax
mov cl, byte [eax + 0x4975b4]
xor cl, 0x6a
mov byte [eax + 0x49767c], cl
inc eax
cmp eax, 0x17
jb 0x419b74
mov eax, 0x49767c
ret
Function at 0x41a8c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x462e6d
call fcn.00461d38
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x46a12c]
test eax, eax
jne 0x41a908
call fcn.0041aa61
mov ecx, dword [ebp + 8]
push eax
call fcn.003f6b19
mov eax, dword [ebp + 8]
jmp 0x41aa52
test byte [0x4986e0], 1
jne 0x41a929
or dword [0x4986e0], 1
mov dword [0x4976b8], 0x4b616662
mov byte [0x4976bc], 0x6b
xor eax, eax
mov cl, byte [eax + 0x4976b8]
xor cl, 0x6b
mov byte [eax + 0x497e8c], cl
inc eax
cmp eax, 5
jb 0x41a92b
push 0xf
mov esi, 0x497e8c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41a956
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.003f4c50
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.003f4cc5
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0041fd75
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.003f4ce6
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.003f4ce6
push dword [ebp - 0x10]
call dword [0x46a0e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0041adac
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0041aaca
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.003f6b56
add esp, 0xc
push 0x48338c
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.003fd6fe
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.003fb623
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.003f4ce6
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.003f4ce6
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.003f4ce6
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.003f4c06
push ebx
push 1
mov ecx, esi
call fcn.003f4ce6
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41aa61
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4986e4], 1
jne 0x41aaad
or dword [0x4986e4], 1
mov dword [0x4976a0], 0xe19053e
mov dword [0x4976a4], 0x50c0408
mov dword [0x4976a8], 0xf0e1102
mov dword [0x4976ac], 0x19190e4b
mov dword [0x4976b0], 0x84b1904
mov dword [0x4976b4], 0x6b0e0f04
xor eax, eax
mov cl, byte [eax + 0x4976a0]
xor cl, 0x6b
mov byte [eax + 0x497e74], cl
inc eax
cmp eax, 0x18
jb 0x41aaaf
mov eax, 0x497e74
ret

Function at 0x41aaca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4986dc], 1
jne 0x41ab08
or dword [0x4986dc], 1
mov dword [0x4976c0], 0x190e434b
mov dword [0x4976c4], 0x4b190419
mov dword [0x4976c8], 0xe0f0408
mov word [0x4976cc], 0x4b51
mov byte [0x4976ce], 0x6b
xor eax, eax
mov cl, byte [eax + 0x4976c0]
xor cl, 0x6b
mov byte [eax + 0x497e94], cl
inc eax
cmp eax, 0xf
jb 0x41ab0a
mov eax, 0x497e94
ret