joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426430
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6db8], 1
jne 0x4264a0
or dword [0x4c6db8], 1
mov dword [0x4c53cc], 0xddfbfcc2
mov dword [0x4c53d0], 0xc4e5e1e1
mov dword [0x4c53d4], 0xece7f0e0
mov dword [0x4c53d8], 0xf4e1f4d1
mov dword [0x4c53dc], 0xfcf4e3d4
mov dword [0x4c53e0], 0xf9f7f4f9
mov dword [0x4c53e4], 0xb5bcbdf0
mov dword [0x4c53e8], 0xf9fcf4f3
mov word [0x4c53ec], 0xf1f0
mov byte [0x4c53ee], 0x95
xor eax, eax
mov cl, byte [eax + 0x4c53cc]
xor cl, 0x95
mov byte [eax + 0x4c5684], cl
inc eax
cmp eax, 0x23
jb 0x4264a2
mov eax, 0x4c5684
ret

Function at 0x4264bd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6db4], 1
jne 0x426512
or dword [0x4c6db4], 1
mov dword [0x4c53f0], 0xf0e1fbdc
mov dword [0x4c53f4], 0xe1f0fbe7
mov dword [0x4c53f8], 0xf1f4f0c7
mov dword [0x4c53fc], 0xf0f9fcd3
mov dword [0x4c5400], 0xf3b5bcbd
mov dword [0x4c5404], 0xf0f9fcf4
mov word [0x4c5408], 0x95f1
xor eax, eax
mov cl, byte [eax + 0x4c53f0]
xor cl, 0x95
mov byte [eax + 0x4c56a8], cl
inc eax
cmp eax, 0x1a
jb 0x426514
mov eax, 0x4c56a8
ret

Function at 0x4272c9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d98], 1
jne 0x427350
or dword [0x4c6d98], 1
mov dword [0x4c56e0], 0xedb8f6d9
mov dword [0x4c56e4], 0xfbfdeaf6
mov dword [0x4c56e8], 0xf1f6fff7
mov dword [0x4c56ec], 0xb8fcfde2
mov dword [0x4c56f0], 0xfdf3f7ec
mov dword [0x4c56f4], 0xf9efb8f6
mov dword [0x4c56f8], 0xf7feb8eb
mov dword [0x4c56fc], 0xb8fcf6ed
mov dword [0x4c5700], 0xfbb8ecf9
mov dword [0x4c5704], 0xf9eaf9f0
mov dword [0x4c5708], 0xeafdecfb
mov word [0x4c570c], 0x98b8
xor eax, eax
mov cl, byte [eax + 0x4c56e0]
xor cl, 0x98
mov byte [eax + 0x4c5830], cl
inc eax
cmp eax, 0x2e
jb 0x427352
mov eax, 0x4c5830
ret
Function at 0x427796
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d94], 1
jne 0x4277f2
or dword [0x4c6d94], 1
mov dword [0x4c5710], 0xebebf1d5
mov dword [0x4c5714], 0xb8fff6f1
mov dword [0x4c5718], 0xfdf4b8f9
mov dword [0x4c571c], 0xe8b8ecfe
mov dword [0x4c5720], 0xf6fdeaf9
mov dword [0x4c5724], 0xebfdf0ec
mov word [0x4c5728], 0xebf1
mov byte [0x4c572a], 0x98
xor eax, eax
mov cl, byte [eax + 0x4c5710]
xor cl, 0x98
mov byte [eax + 0x4c5860], cl
inc eax
cmp eax, 0x1b
jb 0x4277f4
mov eax, 0x4c5860
ret

Function at 0x42780f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d90], 1
jne 0x427878
or dword [0x4c6d90], 1
mov dword [0x4c572c], 0xb8ecf7d6
mov dword [0x4c5730], 0xedf7f6fd
mov dword [0x4c5734], 0xf7b8f0ff
mov dword [0x4c5738], 0xf9eafde8
mov dword [0x4c573c], 0xb8ebfcf6
mov dword [0x4c5740], 0xfdb8f6f1
mov dword [0x4c5744], 0xfdeae8e0
mov dword [0x4c5748], 0xf7f1ebeb
mov word [0x4c574c], 0x98f6
xor eax, eax
mov cl, byte [eax + 0x4c572c]
xor cl, 0x98
mov byte [eax + 0x4c587c], cl
inc eax
cmp eax, 0x22
jb 0x42787a
mov eax, 0x4c587c
ret

Function at 0x427895
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d8c], 1
jne 0x4278f5
or dword [0x4c6d8c], 1
mov dword [0x4c5750], 0xb8f7f7cc
mov dword [0x4c5754], 0xe1f6f9f5
mov dword [0x4c5758], 0xfde8f7b8
mov dword [0x4c575c], 0xfcf6f9ea
mov dword [0x4c5760], 0xf6f1b8eb
mov dword [0x4c5764], 0xe8e0fdb8
mov dword [0x4c5768], 0xebebfdea
mov dword [0x4c576c], 0x98f6f7f1
xor eax, eax
mov cl, byte [eax + 0x4c5750]
xor cl, 0x98
mov byte [eax + 0x4c58a0], cl
inc eax
cmp eax, 0x20
jb 0x4278f7
mov eax, 0x4c58a0
ret

Function at 0x427912
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d88], 1
jne 0x427968
or dword [0x4c6d88], 1
mov dword [0x4c5770], 0xebebf1d5
mov dword [0x4c5774], 0xb8fff6f1
mov dword [0x4c5778], 0xf1eab8f9
mov dword [0x4c577c], 0xb8ecf0ff
mov dword [0x4c5780], 0xfdeaf9e8
mov dword [0x4c5784], 0xfdf0ecf6
mov dword [0x4c5788], 0x98ebf1eb
xor eax, eax
mov cl, byte [eax + 0x4c5770]
xor cl, 0x98
mov byte [eax + 0x4c58c0], cl
inc eax
cmp eax, 0x1c
jb 0x42796a
mov eax, 0x4c58c0
ret

Function at 0x427985
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d84], 1
jne 0x4279f6
or dword [0x4c6d84], 1
mov dword [0x4c578c], 0xeaf9f6cd
mov dword [0x4c5790], 0xe8f7b8e1
mov dword [0x4c5794], 0xecf9eafd
mov dword [0x4c5798], 0xf5b8eaf7
mov dword [0x4c579c], 0xb8ecebed
mov dword [0x4c57a0], 0xfdeef9f0
mov dword [0x4c57a4], 0xfdf6f7b8
mov dword [0x4c57a8], 0xfde8f7b8
mov dword [0x4c57ac], 0xfcf6f9ea
mov byte [0x4c57b0], 0x98
xor eax, eax
mov cl, byte [eax + 0x4c578c]
xor cl, 0x98
mov byte [eax + 0x4c58dc], cl
inc eax
cmp eax, 0x25
jb 0x4279f8
mov eax, 0x4c58dc
ret
Function at 0x427a13
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d80], 1
jne 0x427a8d
or dword [0x4c6d80], 1
mov dword [0x4c57b4], 0xf9f6f1da
mov dword [0x4c57b8], 0xf7b8e1ea
mov dword [0x4c57bc], 0xf9eafde8
mov dword [0x4c57c0], 0xb8eaf7ec
mov dword [0x4c57c4], 0xecebedf5
mov dword [0x4c57c8], 0xeef9f0b8
mov dword [0x4c57cc], 0xefecb8fd
mov dword [0x4c57d0], 0xe8f7b8f7
mov dword [0x4c57d4], 0xf6f9eafd
mov word [0x4c57d8], 0xebfc
mov byte [0x4c57da], 0x98
xor eax, eax
mov cl, byte [eax + 0x4c57b4]
xor cl, 0x98
mov byte [eax + 0x4c5904], cl
inc eax
cmp eax, 0x27
jb 0x427a8f
mov eax, 0x4c5904
ret

Function at 0x427aaa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d7c], 1
jne 0x427b13
or dword [0x4c6d7c], 1
mov dword [0x4c57dc], 0xf9f6f1da
mov dword [0x4c57e0], 0xf7b8e1ea
mov dword [0x4c57e4], 0xf9eafde8
mov dword [0x4c57e8], 0xb8eaf7ec
mov dword [0x4c57ec], 0xb8ecf7f6
mov dword [0x4c57f0], 0xf4e8f5f1
mov dword [0x4c57f4], 0xf6fdf5fd
mov dword [0x4c57f8], 0xa2fcfdec
mov word [0x4c57fc], 0x98b8
xor eax, eax
mov cl, byte [eax + 0x4c57dc]
xor cl, 0x98
mov byte [eax + 0x4c592c], cl
inc eax
cmp eax, 0x22
jb 0x427b15
mov eax, 0x4c592c
ret

Function at 0x428a94
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d6c], 1
mov edx, 0x859a
jne 0x428b26
or dword [0x4c6d6c], 1
lea ecx, [edx + 0x25]
push esi
mov eax, ecx
mov word [0x4c598c], ax
add eax, 0xa
mov esi, eax
mov word [0x4c598e], si
lea eax, [edx + 0x34]
mov word [0x4c5994], ax
add eax, 0x11
mov esi, eax
mov word [0x4c5996], si
lea esi, [edx + 0x3d]
mov word [0x4c5998], si
add esi, 7
mov word [0x4c599a], si
lea esi, [edx + 0x2e]
mov word [0x4c599c], si
add esi, 0xb
mov eax, edx
mov word [0x4c599e], si
mov dword [0x4c5990], 0x85c985c3
mov dword [0x4c59a0], 0x85df85cc
mov word [0x4c59a4], cx
mov word [0x4c59a6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c598c]
add eax, 2
mov word [eax + 0x4c5a46], cx
cmp eax, 0x1c
jb 0x428b28
mov eax, 0x4c5a48
ret

Function at 0x428b46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d68], 1
jne 0x428ba5
or dword [0x4c6d68], 1
mov dword [0x4c59a8], 0xcceeffdd
mov dword [0x4c59ac], 0xf7eff6f5
mov dword [0x4c59b0], 0xfcf4d3ff
mov dword [0x4c59b4], 0xfbf7e8f5
mov dword [0x4c59b8], 0xf4f5f3ee
mov dword [0x4c59bc], 0xf3fbdcba
mov dword [0x4c59c0], 0xa0fefff6
mov word [0x4c59c4], 0x9aba
xor eax, eax
mov cl, byte [eax + 0x4c59a8]
xor cl, 0x9a
mov byte [eax + 0x4c5a64], cl
inc eax
cmp eax, 0x1e
jb 0x428ba7
mov eax, 0x4c5a64
ret
Function at 0x428d84
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d64], 1
jne 0x428fa4
or dword [0x4c6d64], 1
push ebx
push esi
push edi
mov edi, 0x85d2
mov eax, edi
mov word [0x4c59c8], ax
dec eax
mov word [0x4c59ca], ax
lea esi, [edi + 0xd]
mov eax, esi
mov word [0x4c59cc], ax
add eax, 0xffffffe4
mov word [0x4c59ce], ax
lea edx, [edi - 0xd]
mov eax, edx
mov word [0x4c59d0], ax
lea ecx, [edi + 4]
mov eax, ecx
mov word [0x4c59d2], ax
dec eax
mov word [0x4c59d4], ax
lea eax, [edi + 7]
mov word [0x4c59d6], ax
add eax, 2
mov ebx, eax
mov word [0x4c59d8], bx
mov word [0x4c59e0], ax
lea ebx, [edi + 5]
mov ecx, ebx
lea eax, [edi + 1]
mov word [0x4c59e6], ax
inc edx
mov eax, edx
mov word [0x4c59ec], ax
lea eax, [edi - 9]
mov word [0x4c59ee], ax
mov word [0x4c59de], cx
add ecx, 0x1e
mov eax, ecx
mov word [0x4c59f0], ax
lea eax, [edi + 0x2a]
mov word [0x4c59f2], ax
add eax, 0xfffffff2
mov word [0x4c59f4], ax
lea eax, [edi + 0x1b]
add edi, 0x29
mov word [0x4c59f6], ax
mov eax, edi
mov word [0x4c59f8], ax
lea eax, [esi + 9]
mov esi, eax
mov word [0x4c59fa], si
add esi, 0x17
mov word [0x4c5a00], bx
mov word [0x4c59fc], si
mov esi, edx
mov word [0x4c59fe], si
lea esi, [ebx + 0x1c]
mov ebx, esi
mov word [0x4c5a02], bx
add ebx, 6
mov word [0x4c5a04], bx
mov ebx, eax
mov word [0x4c5a06], bx
mov ebx, ecx
mov word [0x4c5a08], bx
lea ebx, [eax + 1]
mov word [0x4c5a0a], bx
mov ebx, ecx
mov word [0x4c5a0c], bx
lea ebx, [eax + 0x14]
mov word [0x4c5a0e], bx
add ebx, 0xfffffff2
mov word [0x4c5a10], bx
mov ebx, edx
mov word [0x4c5a12], bx
mov dword [0x4c59da], 0x85c585d6
mov dword [0x4c59e2], 0x85d285d9
mov dword [0x4c59e8], 0x85df85d4
lea ebx, [eax - 0xf]
mov word [0x4c5a14], bx
mov ebx, eax
mov word [0x4c5a16], bx
add ebx, 0xfffffffb
mov word [0x4c5a18], bx
lea ebx, [eax + 2]
mov eax, edi
mov word [0x4c5a24], ax
mov eax, ebx
mov word [0x4c5a26], ax
add eax, 8
mov ecx, eax
mov eax, esi
mov word [0x4c5a36], ax
inc eax
mov word [0x4c5a38], ax
lea eax, [esi + 0xc]
mov word [0x4c5a3a], ax
add eax, 0xffffffde
mov word [0x4c5a3c], ax
lea eax, [esi + 0xb]
pop edi
mov word [0x4c5a42], ax
add eax, 0xffffff9c
pop esi
mov word [0x4c5a1a], bx
mov dword [0x4c5a1c], 0x85f585ee
mov dword [0x4c5a20], 0x85e885fd
mov word [0x4c5a28], cx
mov dword [0x4c5a2a], 0x85c685e3
mov dword [0x4c5a2e], 0x85fb85d7
mov dword [0x4c5a32], 0x85f285f9
mov dword [0x4c5a3e], 0x85f385ef
mov word [0x4c5a44], ax
pop ebx
xor eax, eax
mov ecx, 0x859a
xor cx, word [eax + 0x4c59c8]
add eax, 2
mov word [eax + 0x4c5a86], cx
cmp eax, 0x7e
jb 0x428fa6
mov eax, 0x4c5a88
ret
Function at 0x429a48
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x429c0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x429c4c
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x4aeef0]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x4aeef0]
inc edx
cmp dword [ebp + 8], 0
jne 0x429c17
pop esi
not eax
pop ebp
ret

Function at 0x42b897
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x42b8bc
cmp dword [ecx + 0x38], ebx
je 0x42b8bc
cmp eax, dword [ecx + 0x10]
jae 0x42b8bc
cmp dword [ecx + 0x14], 1
jne 0x42b8bc
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x42b8be
xor edi, edi
cmp edi, ebx
je 0x42b9a1
cmp esi, ebx
je 0x42b9a1
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0042b040
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x42b94d
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00469da0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x42b972
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00469da0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x42b9a3
xor eax, eax
pop edi
pop ebx
ret
Function at 0x42cc3c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d5c], 1
jne 0x42ccc1
or dword [0x4c6d5c], 1
mov dword [0x4c5b0c], 0xf1f4fcdb
mov dword [0x4c5b10], 0xe9bdf9f8
mov dword [0x4c5b14], 0xeffebdf2
mov dword [0x4c5b18], 0xf8e9fcf8
mov dword [0x4c5b1c], 0xfce8f1bd
mov dword [0x4c5b20], 0xfce9eebd
mov dword [0x4c5b24], 0xb5bdf8e9
mov dword [0x4c5b28], 0xf6eff2ea
mov dword [0x4c5b2c], 0xe9bdeff8
mov dword [0x4c5b30], 0xfcf8eff5
mov dword [0x4c5b34], 0xbda7b4f9
mov byte [0x4c5b38], 0x9d
xor eax, eax
mov cl, byte [eax + 0x4c5b0c]
xor cl, 0x9d
mov byte [eax + 0x4c5bd4], cl
inc eax
cmp eax, 0x2d
jb 0x42ccc3
mov eax, 0x4c5bd4
ret

Function at 0x42ccde
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d4c], 1
jne 0x42cd45
or dword [0x4c6d4c], 1
mov dword [0x4c5b48], 0xf8bdf2d3
mov dword [0x4c5b4c], 0xeff2efef
mov dword [0x4c5b50], 0xeef8f0bd
mov dword [0x4c5b54], 0xf8fafcee
mov dword [0x4c5b58], 0xe9f8efbd
mov dword [0x4c5b5c], 0xf8f3efe8
mov dword [0x4c5b60], 0xe4ffbdf9
mov dword [0x4c5b64], 0xfff2f7bd
mov byte [0x4c5b68], 0x9d
xor eax, eax
mov cl, byte [eax + 0x4c5b48]
xor cl, 0x9d
mov byte [eax + 0x4c5c10], cl
inc eax
cmp eax, 0x21
jb 0x42cd47
mov eax, 0x4c5c10
ret

Function at 0x42cd62
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d40], 1
jne 0x42cdcb
or dword [0x4c6d40], 1
mov dword [0x4c5b94], 0xbdfce8d1
mov dword [0x4c5b98], 0xf2efeff8
mov dword [0x4c5b9c], 0xe8efbdef
mov dword [0x4c5ba0], 0xf3f4f3f3
mov dword [0x4c5ba4], 0xeff8bdfa
mov dword [0x4c5ba8], 0xbdeff2ef
mov dword [0x4c5bac], 0xf9f3fcf5
mov dword [0x4c5bb0], 0xa7eff8f1
mov word [0x4c5bb4], 0x9dbd
xor eax, eax
mov cl, byte [eax + 0x4c5b94]
xor cl, 0x9d
mov byte [eax + 0x4c5c5c], cl
inc eax
cmp eax, 0x22
jb 0x42cdcd
mov eax, 0x4c5c5c
ret

Function at 0x42cde8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d3c], 1
jne 0x42ce3a
or dword [0x4c6d3c], 1
mov dword [0x4c5bb8], 0xd1fce8f1
mov dword [0x4c5bbc], 0xfcf2f1c2
mov dword [0x4c5bc0], 0xefe9eef9
mov dword [0x4c5bc4], 0xbdfaf3f4
mov dword [0x4c5bc8], 0xf1f4fcfb
mov word [0x4c5bcc], 0xf9f8
mov byte [0x4c5bce], 0x9d
xor eax, eax
mov cl, byte [eax + 0x4c5bb8]
xor cl, 0x9d
mov byte [eax + 0x4c5c80], cl
inc eax
cmp eax, 0x17
jb 0x42ce3c
mov eax, 0x4c5c80
ret
Function at 0x42dbd8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48da79
call fcn.0048cac8
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x495134]
test eax, eax
jne 0x42dc20
call fcn.0042dd79
mov ecx, dword [ebp + 8]
push eax
call fcn.00406a4b
mov eax, dword [ebp + 8]
jmp 0x42dd6a
test byte [0x4c6d30], 1
jne 0x42dc41
or dword [0x4c6d30], 1
mov dword [0x4c5cbc], 0x80aaada9
mov byte [0x4c5cc0], 0xa0
xor eax, eax
mov cl, byte [eax + 0x4c5cbc]
xor cl, 0xa0
mov byte [eax + 0x4c63fc], cl
inc eax
cmp eax, 5
jb 0x42dc43
push 0xf
mov esi, 0x4c63fc
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x42dc6e
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00404de4
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00404bff
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.004322b6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404c20
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00404c20
push dword [ebp - 0x10]
call dword [0x4950e8]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0042e0c4
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0042dde2
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00406a88
add esp, 0xc
push 0x4b039c
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0040ef26
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0040c8ee
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00404c20
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00404c20
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00404c20
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00404bb5
push ebx
push 1
mov ecx, esi
call fcn.00404c20
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42dd79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d34], 1
jne 0x42ddc5
or dword [0x4c6d34], 1
mov dword [0x4c5ca4], 0xc5d2cef5
mov dword [0x4c5ca8], 0xcec7cfc3
mov dword [0x4c5cac], 0xc4c5dac9
mov dword [0x4c5cb0], 0xd2d2c580
mov dword [0x4c5cb4], 0xc380d2cf
mov dword [0x4c5cb8], 0xa0c5c4cf
xor eax, eax
mov cl, byte [eax + 0x4c5ca4]
xor cl, 0xa0
mov byte [eax + 0x4c63e4], cl
inc eax
cmp eax, 0x18
jb 0x42ddc7
mov eax, 0x4c63e4
ret

Function at 0x42dde2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d2c], 1
jne 0x42de20
or dword [0x4c6d2c], 1
mov dword [0x4c5cc4], 0xd2c58880
mov dword [0x4c5cc8], 0x80d2cfd2
mov dword [0x4c5ccc], 0xc5c4cfc3
mov word [0x4c5cd0], 0x809a
mov byte [0x4c5cd2], 0xa0
xor eax, eax
mov cl, byte [eax + 0x4c5cc4]
xor cl, 0xa0
mov byte [eax + 0x4c6404], cl
inc eax
cmp eax, 0xf
jb 0x42de22
mov eax, 0x4c6404
ret
Function at 0x42e0c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x4c6d28], 1
jne 0x42e0ef
or dword [0x4c6d28], 1
mov dword [0x4c5cd4], 0xc4cccc85
mov byte [0x4c5cd8], 0xa0
xor eax, eax
mov cl, byte [eax + 0x4c5cd4]
xor cl, 0xa0
mov byte [eax + 0x4c6414], cl
inc eax
cmp eax, 5
jb 0x42e0f1
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x4c6414
push eax
call fcn.0043230f
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404bff
mov eax, esi
leave
ret

Function at 0x42e293
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d24], 1
jne 0x42e2ef
or dword [0x4c6d24], 1
mov dword [0x4c5cdc], 0xedd4c5e7
mov dword [0x4c5ce0], 0xccd5c4cf
mov dword [0x4c5ce4], 0xccc9e6c5
mov dword [0x4c5ce8], 0xcdc1eec5
mov dword [0x4c5cec], 0xc1c680c5
mov dword [0x4c5cf0], 0xc4c5ccc9
mov word [0x4c5cf4], 0x809a
mov byte [0x4c5cf6], 0xa0
xor eax, eax
mov cl, byte [eax + 0x4c5cdc]
xor cl, 0xa0
mov byte [eax + 0x4c641c], cl
inc eax
cmp eax, 0x1b
jb 0x42e2f1
mov eax, 0x4c641c
ret

Function at 0x42e30c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d20], 1
jne 0x42e369
or dword [0x4c6d20], 1
mov dword [0x4c5cf8], 0xe3d4c5f3
mov dword [0x4c5cfc], 0xc5d2d2d5
mov dword [0x4c5d00], 0xc9e4d4ce
mov dword [0x4c5d04], 0xd4c3c5d2
mov dword [0x4c5d08], 0x80d9d2cf
mov dword [0x4c5d0c], 0xccc9c1c6
mov dword [0x4c5d10], 0x809ac4c5
mov byte [0x4c5d14], 0xa0
xor eax, eax
mov cl, byte [eax + 0x4c5cf8]
xor cl, 0xa0
mov byte [eax + 0x4c6438], cl
inc eax
cmp eax, 0x1d
jb 0x42e36b
mov eax, 0x4c6438
ret

Function at 0x42e47d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d1c], 1
jne 0x42e4da
or dword [0x4c6d1c], 1
mov dword [0x4c5d18], 0xe3d4c5e7
mov dword [0x4c5d1c], 0xc5d2d2d5
mov dword [0x4c5d20], 0xc9e4d4ce
mov dword [0x4c5d24], 0xd4c3c5d2
mov dword [0x4c5d28], 0x80d9d2cf
mov dword [0x4c5d2c], 0xccc9c1c6
mov dword [0x4c5d30], 0x809ac4c5
mov byte [0x4c5d34], 0xa0
xor eax, eax
mov cl, byte [eax + 0x4c5d18]
xor cl, 0xa0
mov byte [eax + 0x4c6458], cl
inc eax
cmp eax, 0x1d
jb 0x42e4dc
mov eax, 0x4c6458
ret
Function at 0x42e695
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d18], 1
jne 0x42e804
mov eax, 0x85fc
mov ecx, eax
mov word [0x4c5d38], cx
mov word [0x4c5d3a], cx
add ecx, 0xfffffff7
mov word [0x4c5d3c], cx
lea ecx, [eax - 0x28]
mov word [0x4c5d3e], cx
add ecx, 0xfffffffe
lea edx, [eax - 0x33]
mov word [0x4c5d40], cx
push ebx
mov ecx, edx
mov word [0x4c5d42], cx
add ecx, 5
push esi
mov esi, ecx
lea ecx, [eax - 0x36]
mov word [0x4c5d44], si
lea esi, [eax - 0x35]
mov word [0x4c5d46], si
mov word [0x4c5d54], cx
add esi, 8
add edx, 3
mov ecx, esi
push edi
lea edi, [eax - 0x37]
mov word [0x4c5d56], cx
mov ecx, eax
mov word [0x4c5d4c], dx
mov edx, edi
mov word [0x4c5d58], cx
mov word [0x4c5d5a], cx
add ecx, 0xffffff94
mov word [0x4c5d4e], dx
mov edx, ecx
or dword [0x4c6d18], 1
mov word [0x4c5d5c], dx
lea edx, [eax - 0x68]
mov ebx, edx
mov word [0x4c5d5e], bx
mov ebx, ecx
mov word [0x4c5d60], bx
lea ebx, [eax - 0x63]
mov word [0x4c5d6e], ax
mov word [0x4c5d62], bx
mov ebx, ecx
mov ecx, eax
add eax, 0xfffffff4
mov word [0x4c5d70], ax
lea eax, [ecx - 0x38]
mov word [0x4c5d76], ax
add eax, 0x11
mov word [0x4c5d78], ax
lea eax, [ecx - 0x39]
mov word [0x4c5d7a], ax
add eax, 0x11
mov word [0x4c5d7c], ax
lea eax, [ecx - 0xe]
mov word [0x4c5d7e], ax
add eax, 0xffffffd3
pop edi
mov word [0x4c5d80], ax
lea eax, [ecx - 0x5c]
pop esi
mov word [0x4c5d64], bx
mov dword [0x4c5d48], 0x85c985e6
mov dword [0x4c5d50], 0x85ce85e9
mov word [0x4c5d66], dx
mov dword [0x4c5d68], 0x859085e2
mov word [0x4c5d6c], cx
mov dword [0x4c5d72], 0x85cf85d2
mov dword [0x4c5d82], 0x85c585cd
mov word [0x4c5d86], ax
pop ebx
xor eax, eax
mov ecx, 0x85a0
xor cx, word [eax + 0x4c5d38]
add eax, 2
mov word [eax + 0x4c6476], cx
cmp eax, 0x50
jb 0x42e806
mov eax, 0x4c6478
ret

Function at 0x42e827
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d14], 1
jne 0x42e87c
or dword [0x4c6d14], 1
mov dword [0x4c5d88], 0xd680cfee
mov dword [0x4c5d8c], 0xc9d3d2c5
mov dword [0x4c5d90], 0xc980cecf
mov dword [0x4c5d94], 0x80cfc6ce
mov dword [0x4c5d98], 0xc9c1d6c1
mov dword [0x4c5d9c], 0xccc2c1cc
mov word [0x4c5da0], 0xa0c5
xor eax, eax
mov cl, byte [eax + 0x4c5d88]
xor cl, 0xa0
mov byte [eax + 0x4c64c8], cl
inc eax
cmp eax, 0x1a
jb 0x42e87e
mov eax, 0x4c64c8
ret

Function at 0x42ea6b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c6d10], 1
jne 0x42eac0
or dword [0x4c6d10], 1
mov dword [0x4c5da4], 0xd680cfee
mov dword [0x4c5da8], 0xc9d3d2c5
mov dword [0x4c5dac], 0xc980cecf
mov dword [0x4c5db0], 0x80cfc6ce
mov dword [0x4c5db4], 0xc9c1d6c1
mov dword [0x4c5db8], 0xccc2c1cc
mov word [0x4c5dbc], 0xa0c5
xor eax, eax
mov cl, byte [eax + 0x4c5da4]
xor cl, 0xa0
mov byte [eax + 0x4c64e4], cl
inc eax
cmp eax, 0x1a
jb 0x42eac2
mov eax, 0x4c64e4
ret