joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408fab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c28], 1
jne 0x408fce
or dword [0x4c2c28], 1
mov dword [0x4bdf54], 0x70787b38
mov word [0x4bdf58], 0x1738
xor eax, eax
mov cl, byte [eax + 0x4bdf54]
xor cl, 0x17
mov byte [eax + 0x4be54c], cl
inc eax
cmp eax, 6
jb 0x408fd0
mov eax, 0x4be54c
ret

Function at 0x408fee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c24], 1
jne 0x409069
or dword [0x4c2c24], 1
mov dword [0x4bdf5c], 0x6763637f
mov dword [0x4bdf60], 0x7638382d
mov dword [0x4bdf64], 0x6e7b7679
mov dword [0x4bdf68], 0x64747e63
mov dword [0x4bdf6c], 0x63727039
mov dword [0x4bdf70], 0x79607873
mov dword [0x4bdf74], 0x63647263
mov dword [0x4bdf78], 0x7a787439
mov dword [0x4bdf7c], 0x38256138
mov dword [0x4bdf80], 0x3870787b
mov byte [0x4bdf84], 0x17
xor eax, eax
mov cl, byte [eax + 0x4bdf5c]
xor cl, 0x17
mov byte [eax + 0x4be554], cl
inc eax
cmp eax, 0x29
jb 0x40906b
mov eax, 0x4be554
ret

Function at 0x409086
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c20], 1
jne 0x4090b1
or dword [0x4c2c20], 1
mov dword [0x4bdf88], 0x64312a74
mov dword [0x4bdf8c], 0x2a63312a
mov byte [0x4bdf90], 0x17
xor eax, eax
mov cl, byte [eax + 0x4bdf88]
xor cl, 0x17
mov byte [eax + 0x4be580], cl
inc eax
cmp eax, 9
jb 0x4090b3
mov eax, 0x4be580
ret

Function at 0x4090ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c10], 1
jne 0x409156
or dword [0x4c2c10], 1
mov dword [0x4bdfa4], 0x63797854
mov dword [0x4bdfa8], 0x3a637972
mov dword [0x4bdfac], 0x72676e43
mov dword [0x4bdfb0], 0x6776372d
mov dword [0x4bdfb4], 0x747e7b67
mov dword [0x4bdfb8], 0x787e6376
mov dword [0x4bdfbc], 0x3a6f3879
mov dword [0x4bdfc0], 0x3a606060
mov dword [0x4bdfc4], 0x7a657871
mov dword [0x4bdfc8], 0x7b65623a
mov dword [0x4bdfcc], 0x78747972
mov dword [0x4bdfd0], 0x17737273
xor eax, eax
mov cl, byte [eax + 0x4bdfa4]
xor cl, 0x17
mov byte [eax + 0x4be59c], cl
inc eax
cmp eax, 0x30
jb 0x409158
mov eax, 0x4be59c
ret

Function at 0x409173
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c0c], 1
jne 0x40919e
or dword [0x4c2c0c], 1
mov dword [0x4bdfd4], 0x43445847
mov dword [0x4bdfd8], 0x37786337
mov byte [0x4bdfdc], 0x17
xor eax, eax
mov cl, byte [eax + 0x4bdfd4]
xor cl, 0x17
mov byte [eax + 0x4be5cc], cl
inc eax
cmp eax, 9
jb 0x4091a0
mov eax, 0x4be5cc
ret

Function at 0x4091bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c08], 1
jne 0x409204
or dword [0x4c2c08], 1
mov dword [0x4bdfe0], 0x7e767137
mov dword [0x4bdfe4], 0x3773727b
mov dword [0x4bdfe8], 0x7f637e60
mov dword [0x4bdfec], 0x76636437
mov dword [0x4bdff0], 0x37646263
mov byte [0x4bdff4], 0x17
xor eax, eax
mov cl, byte [eax + 0x4bdfe0]
xor cl, 0x17
mov byte [eax + 0x4be5d8], cl
inc eax
cmp eax, 0x15
jb 0x409206
mov eax, 0x4be5d8
ret
Function at 0x40923b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48b1da
call fcn.00489c38
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x4093ec
cmp dword [ebp + 0x10], ebx
je 0x4093ec
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0040a586
push eax
push 0x4acb70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.0040547e
push 0x4acb6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004054b4
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.00404e28
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00404e28
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x409347
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0040a586
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0040a5a8
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4092fb
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0040e060
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.00404e28
inc bl
jne 0x4093b3
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.00404e28
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x4092c2
test byte [0x4c2c00], 1
jne 0x409374
or dword [0x4c2c00], 1
mov dword [0x4be004], 0x37637859
mov dword [0x4be008], 0x79627871
mov word [0x4be00c], 0x1773
xor eax, eax
mov cl, byte [eax + 0x4be004]
xor cl, 0x17
mov byte [eax + 0x4be5fc], cl
inc eax
cmp eax, 0xa
jb 0x409376
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x4be5fc
call fcn.00463965
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x4aec28
lea eax, [ebp - 0x44]
push eax
call fcn.0046d875
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0040a5a8
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.00404e28
push 1
lea esi, [ebp - 0x2c]
call fcn.00404e28
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.00409411
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.00463965
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x4aec28
lea eax, [ebp - 0x38]
jmp 0x4093ad

Function at 0x409411
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c04], 1
jne 0x40943e
or dword [0x4c2c04], 1
mov dword [0x4bdff8], 0x37637859
mov dword [0x4bdffc], 0x79627871
mov word [0x4be000], 0x1773
xor eax, eax
mov cl, byte [eax + 0x4bdff8]
xor cl, 0x17
mov byte [eax + 0x4be5f0], cl
inc eax
cmp eax, 0xa
jb 0x409440
mov eax, 0x4be5f0
ret
Function at 0x409bf5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bfc], 1
mov ecx, 0x8317
jne 0x409c7f
or dword [0x4c2bfc], 1
lea eax, [ecx + 0x5d]
mov word [0x4be010], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0x4be012], dx
lea edx, [ecx + 0x5f]
mov word [0x4be014], dx
add edx, 0xffffffee
mov word [0x4be016], dx
lea edx, [ecx + 0x68]
mov word [0x4be018], dx
add edx, 0xffffffc9
mov word [0x4be01a], dx
mov edx, eax
mov word [0x4be01c], dx
lea edx, [ecx + 0x5b]
lea eax, [ecx + 0x4c]
mov word [0x4be01e], dx
mov word [0x4be026], ax
add edx, 0xfffffff5
mov eax, ecx
mov word [0x4be020], dx
mov dword [0x4be022], 0x83658378
mov word [0x4be028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4be010]
add eax, 2
mov word [eax + 0x4be606], dx
cmp eax, 0x1a
jb 0x409c81
mov eax, 0x4be608
ret

Function at 0x409c9f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bf8], 1
jne 0x409cca
or dword [0x4c2bf8], 1
mov dword [0x4be02c], 0x7965727c
mov dword [0x4be030], 0x25247b72
mov byte [0x4be034], 0x17
xor eax, eax
mov cl, byte [eax + 0x4be02c]
xor cl, 0x17
mov byte [eax + 0x4be624], cl
inc eax
cmp eax, 9
jb 0x409ccc
mov eax, 0x4be624
ret

Function at 0x409ce7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bf4], 1
jne 0x409d50
or dword [0x4c2bf4], 1
mov dword [0x4be038], 0x47637244
mov dword [0x4be03c], 0x72747865
mov dword [0x4be040], 0x64426464
mov dword [0x4be044], 0x785a6572
mov dword [0x4be048], 0x6f527273
mov dword [0x4be04c], 0x63677274
mov dword [0x4be050], 0x4779787e
mov dword [0x4be054], 0x747e7b78
mov word [0x4be058], 0x176e
xor eax, eax
mov cl, byte [eax + 0x4be038]
xor cl, 0x17
mov byte [eax + 0x4be630], cl
inc eax
cmp eax, 0x22
jb 0x409d52
mov eax, 0x4be630
ret

Function at 0x409d6d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bf0], 1
jne 0x409dd6
or dword [0x4c2bf0], 1
mov dword [0x4be05c], 0x47637250
mov dword [0x4be060], 0x72747865
mov dword [0x4be064], 0x64426464
mov dword [0x4be068], 0x785a6572
mov dword [0x4be06c], 0x6f527273
mov dword [0x4be070], 0x63677274
mov dword [0x4be074], 0x4779787e
mov dword [0x4be078], 0x747e7b78
mov word [0x4be07c], 0x176e
xor eax, eax
mov cl, byte [eax + 0x4be05c]
xor cl, 0x17
mov byte [eax + 0x4be654], cl
inc eax
cmp eax, 0x22
jb 0x409dd8
mov eax, 0x4be654
ret

Function at 0x409df3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bec], 1
jne 0x409e49
or dword [0x4c2bec], 1
mov dword [0x4be080], 0x37727b58
mov dword [0x4be084], 0x637e797e
mov dword [0x4be088], 0x7e7b767e
mov dword [0x4be08c], 0x7e63766d
mov dword [0x4be090], 0x71377978
mov dword [0x4be094], 0x727b7e76
mov dword [0x4be098], 0x17372d73
xor eax, eax
mov cl, byte [eax + 0x4be080]
xor cl, 0x17
mov byte [eax + 0x4be678], cl
inc eax
cmp eax, 0x1c
jb 0x409e4b
mov eax, 0x4be678
ret
Function at 0x409e66
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2be8], 1
mov ecx, 0x8317
jne 0x409e95
or dword [0x4c2be8], 1
lea eax, [ecx + 0x5f]
mov word [0x4be09c], ax
add eax, 0xffffffaf
mov word [0x4be09e], ax
mov eax, ecx
mov word [0x4be0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4be09c]
add eax, 2
mov word [eax + 0x4be692], dx
cmp eax, 6
jb 0x409e97
mov eax, 0x4be694
ret

Function at 0x409eb5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2be0], 1
jne 0x409f25
or dword [0x4c2be0], 1
mov dword [0x4be0ac], 0x7b7e7651
mov dword [0x4be0b0], 0x63377372
mov dword [0x4be0b4], 0x797e3778
mov dword [0x4be0b8], 0x767e637e
mov dword [0x4be0bc], 0x726d7e7b
mov dword [0x4be0c0], 0x61797237
mov dword [0x4be0c4], 0x7978657e
mov dword [0x4be0c8], 0x6379727a
mov word [0x4be0cc], 0x372d
mov byte [0x4be0ce], 0x17
xor eax, eax
mov cl, byte [eax + 0x4be0ac]
xor cl, 0x17
mov byte [eax + 0x4be6a4], cl
inc eax
cmp eax, 0x23
jb 0x409f27
mov eax, 0x4be6a4
ret

Function at 0x409f42
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bd8], 1
jne 0x409f8d
or dword [0x4c2bd8], 1
mov dword [0x4be0d8], 0x767f7942
mov dword [0x4be0dc], 0x727b7379
mov dword [0x4be0e0], 0x6f723773
mov dword [0x4be0e4], 0x63677274
mov dword [0x4be0e8], 0x2d79787e
mov word [0x4be0ec], 0x1737
xor eax, eax
mov cl, byte [eax + 0x4be0d8]
xor cl, 0x17
mov byte [eax + 0x4be6d0], cl
inc eax
cmp eax, 0x16
jb 0x409f8f
mov eax, 0x4be6d0
ret

Function at 0x409faa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bd4], 1
jne 0x409ffd
or dword [0x4c2bd4], 1
mov dword [0x4be0f0], 0x767f7942
mov dword [0x4be0f4], 0x727b7379
mov dword [0x4be0f8], 0x6f723773
mov dword [0x4be0fc], 0x63677274
mov dword [0x4be100], 0x2d79787e
mov dword [0x4be104], 0x1d643237
mov byte [0x4be108], 0x17
xor eax, eax
mov cl, byte [eax + 0x4be0f0]
xor cl, 0x17
mov byte [eax + 0x4be6e8], cl
inc eax
cmp eax, 0x19
jb 0x409fff
mov eax, 0x4be6e8
ret

Function at 0x40a01a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bd0], 1
jne 0x40a052
or dword [0x4c2bd0], 1
mov dword [0x4be10c], 0x75626344
mov dword [0x4be110], 0x7e6f7237
mov dword [0x4be114], 0x323f3763
mov dword [0x4be118], 0x171d3e73
xor eax, eax
mov cl, byte [eax + 0x4be10c]
xor cl, 0x17
mov byte [eax + 0x4be704], cl
inc eax
cmp eax, 0x10
jb 0x40a054
mov eax, 0x4be704
ret
Function at 0x40ba56
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x48a9ed
call fcn.00489c38
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40bb3a
cmp byte [edi + 0x49], bl
je 0x40bb3a
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40ba8d
xor al, al
jmp 0x40bb3c
push esi
lea esi, [ebp - 0x2c]
call fcn.0040b54f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40badd
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x40bae2
dec eax
je 0x40bae6
dec eax
dec eax
je 0x40bb36
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404cea
mov al, bl
pop esi
jmp 0x40bb3c
mov edx, dword [ebp - 0x2c]
jmp 0x40baa7
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40baf2
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x40bb18
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40bb05
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0046573e
add esp, 0x10
cmp esi, eax
jne 0x40baca
cmp byte [edi + 0x49], 0
je 0x40bb36
test esi, esi
jne 0x40ba99
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0040b628
jmp 0x40ba99
mov bl, 1
jmp 0x40bacc
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410386
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bcc], 1
jne 0x4103fa
or dword [0x4c2bcc], 1
mov dword [0x4be724], 0x746d775b
mov dword [0x4be728], 0x7776387c
mov dword [0x4be72c], 0x7d7f386c
mov dword [0x4be730], 0x717c386c
mov dword [0x4be734], 0x7c71686b
mov dword [0x4be738], 0x387e7738
mov dword [0x4be73c], 0x706c7d75
mov dword [0x4be740], 0x3f387c77
mov dword [0x4be744], 0x7474797b
mov dword [0x4be748], 0x1838223f
xor eax, eax
mov cl, byte [eax + 0x4be724]
xor cl, 0x18
mov byte [eax + 0x4be868], cl
inc eax
cmp eax, 0x28
jb 0x4103fc
mov eax, 0x4be868
ret

Function at 0x410417
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bc8], 1
jne 0x41047e
or dword [0x4c2bc8], 1
mov dword [0x4be74c], 0x7471795e
mov dword [0x4be750], 0x6c387c7d
mov dword [0x4be754], 0x76713877
mov dword [0x4be758], 0x7d73776e
mov dword [0x4be75c], 0x6c7d7538
mov dword [0x4be760], 0x387c7770
mov dword [0x4be764], 0x74797b3f
mov dword [0x4be768], 0x38223f74
mov byte [0x4be76c], 0x18
xor eax, eax
mov cl, byte [eax + 0x4be74c]
xor cl, 0x18
mov byte [eax + 0x4be890], cl
inc eax
cmp eax, 0x21
jb 0x410480
mov eax, 0x4be890
ret
Function at 0x41049b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bc4], 1
jne 0x4104fb
or dword [0x4c2bc4], 1
mov dword [0x4be770], 0x776a4812
mov dword [0x4be774], 0x747a797a
mov dword [0x4be778], 0x6d7c3861
mov dword [0x4be77c], 0x776c387d
mov dword [0x4be780], 0x6a7b6b38
mov dword [0x4be784], 0x386c6871
mov dword [0x4be788], 0x776a6a7d
mov dword [0x4be78c], 0x1838226a
xor eax, eax
mov cl, byte [eax + 0x4be770]
xor cl, 0x18
mov byte [eax + 0x4be8b4], cl
inc eax
cmp eax, 0x20
jb 0x4104fd
mov eax, 0x4be8b4
ret

Function at 0x410ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x410c1d
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x4c2bc0], 1
jne 0x410b3a
or dword [0x4c2bc0], 1
mov eax, 0x836b
mov word [0x4be790], ax
add eax, 0x12
mov word [0x4be792], ax
mov eax, 0x8376
mov word [0x4be794], ax
add eax, 6
mov word [0x4be796], ax
mov eax, 0x8318
mov word [0x4be798], ax
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x4be790]
add eax, 2
mov word [eax + 0x4be8d2], cx
cmp eax, 0xa
jb 0x410b3c
mov eax, dword [ebx + edi]
mov ecx, 0x4be8d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410b83
test dx, dx
je 0x410b7f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410b83
add eax, esi
add ecx, esi
test dx, dx
jne 0x410b5f
xor eax, eax
jmp 0x410b88
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410b94
mov dword [edi], 0x385
jmp 0x410c0c
call fcn.00410c2d
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x410bc0
test dx, dx
je 0x410bbc
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x410bc0
add ecx, esi
add eax, esi
test dx, dx
jne 0x410b9c
xor eax, eax
jmp 0x410bc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410bd1
mov dword [edi], 0x386
jmp 0x410c0c
call fcn.00410d00
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x410bfd
test dx, dx
je 0x410bf9
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x410bfd
add ecx, esi
add eax, esi
test dx, dx
jne 0x410bd9
xor eax, eax
jmp 0x410c02
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410c26
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x410af7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x410c1f
Function at 0x410c2d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bbc], 1
jne 0x410cdd
or dword [0x4c2bbc], 1
mov eax, 0x8379
mov word [0x4be79c], ax
add eax, 3
mov ecx, eax
mov word [0x4be7a0], ax
mov eax, 0x835d
mov word [0x4be7a2], ax
add eax, 0x11
mov word [0x4be7a4], ax
mov eax, 0x837d
mov word [0x4be79e], cx
mov ecx, eax
lea edx, [eax - 7]
mov word [0x4be7a6], cx
mov ecx, edx
push edi
mov word [0x4be7a8], cx
add ecx, 0xfffffff6
mov edi, ecx
mov word [0x4be7aa], di
lea edi, [eax - 0x29]
mov word [0x4be7ac], di
add edi, 0x1d
mov ecx, eax
add eax, 0xffffffed
mov word [0x4be7ba], ax
lea eax, [ecx - 0x65]
mov word [0x4be7ae], di
mov dword [0x4be7b0], 0x836c836b
mov word [0x4be7b4], cx
mov dword [0x4be7b6], 0x837d8376
mov word [0x4be7bc], ax
pop edi
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x4be79c]
add eax, 2
mov word [eax + 0x4be8de], cx
cmp eax, 0x22
jb 0x410cdf
mov eax, 0x4be8e0
ret

Function at 0x410d00
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bb8], 1
mov ecx, 0x8318
jne 0x410d5a
or dword [0x4c2bb8], 1
lea eax, [ecx + 0x56]
mov word [0x4be7c0], ax
add eax, 0xf
mov word [0x4be7c2], ax
lea eax, [ecx + 0x52]
mov word [0x4be7c4], ax
inc eax
mov word [0x4be7c6], ax
lea eax, [ecx + 0x59]
mov word [0x4be7c8], ax
add eax, 6
mov word [0x4be7ca], ax
lea eax, [ecx + 0x5e]
mov word [0x4be7cc], ax
mov eax, ecx
mov word [0x4be7ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4be7c0]
add eax, 2
mov word [eax + 0x4be902], dx
cmp eax, 0x10
jb 0x410d5c
mov eax, 0x4be904
ret

Function at 0x411719
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bb4], 1
mov edx, 0x8318
jne 0x41177c
or dword [0x4c2bb4], 1
lea ecx, [edx + 0x65]
mov eax, ecx
mov word [0x4be7d0], ax
add eax, 0xffffffed
push esi
mov esi, eax
lea eax, [edx + 0x3c]
mov word [0x4be7da], ax
add eax, 0x1d
mov word [0x4be7dc], ax
mov eax, edx
mov word [0x4be7d2], si
mov word [0x4be7d4], si
mov dword [0x4be7d6], 0x836a8377
mov dword [0x4be7de], 0x837d8376
mov word [0x4be7e2], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4be7d0]
add eax, 2
mov word [eax + 0x4be912], cx
cmp eax, 0x14
jb 0x41177e
mov eax, 0x4be914
ret

Function at 0x41179c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bb0], 1
jne 0x411838
or dword [0x4c2bb0], 1
mov edx, 0x837d
mov eax, edx
mov word [0x4be7e4], ax
add eax, 0xffffffed
mov ecx, eax
mov word [0x4be7e6], cx
mov word [0x4be7e8], cx
lea ecx, [edx - 6]
mov word [0x4be7ea], cx
mov ecx, eax
mov word [0x4be7ec], cx
lea ecx, [edx - 0x22]
mov word [0x4be7ee], cx
add ecx, 0x15
mov word [0x4be7f0], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x4be7f2], di
mov edi, eax
mov word [0x4be7f6], cx
mov word [0x4be7fe], ax
add ecx, 2
lea eax, [edx - 0x65]
mov word [0x4be7f4], di
mov word [0x4be7f8], cx
mov dword [0x4be7fa], 0x837d836c
mov word [0x4be800], ax
pop edi
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x4be7e4]
add eax, 2
mov word [eax + 0x4be926], cx
cmp eax, 0x1e
jb 0x41183a
mov eax, 0x4be928
ret
Function at 0x41185b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bac], 1
jne 0x4118bc
or dword [0x4c2bac], 1
mov edx, 0x837d
mov eax, edx
mov word [0x4be804], ax
add eax, 0xffffffed
mov ecx, eax
mov word [0x4be806], cx
mov word [0x4be808], cx
push edi
lea ecx, [edx - 6]
mov edi, ecx
mov word [0x4be80c], ax
lea eax, [edx - 0x65]
mov word [0x4be80a], di
mov dword [0x4be80e], 0x8377835b
mov dword [0x4be812], 0x837d837c
mov word [0x4be816], ax
pop edi
xor eax, eax
mov ecx, 0x8318
xor cx, word [eax + 0x4be804]
add eax, 2
mov word [eax + 0x4be946], cx
cmp eax, 0x14
jb 0x4118be
mov eax, 0x4be948
ret

Function at 0x4118df
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ba8], 1
mov edx, 0x8318
jne 0x41195c
or dword [0x4c2ba8], 1
lea ecx, [edx + 0x65]
mov eax, ecx
mov word [0x4be818], ax
add eax, 0xffffffed
push esi
mov esi, eax
lea eax, [edx + 0x3d]
mov word [0x4be822], ax
mov eax, ecx
mov word [0x4be824], ax
add eax, 0xffffffee
mov word [0x4be81a], si
mov word [0x4be81c], si
mov esi, eax
mov word [0x4be828], ax
lea eax, [edx + 0x61]
mov word [0x4be82a], ax
mov eax, edx
mov word [0x4be826], si
mov dword [0x4be81e], 0x836a8377
mov dword [0x4be82c], 0x837d837f
mov word [0x4be830], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4be818]
add eax, 2
mov word [eax + 0x4be95a], cx
cmp eax, 0x1a
jb 0x41195e
mov eax, 0x4be95c
ret

Function at 0x41197c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ba4], 1
mov ecx, 0x8318
jne 0x4119db
or dword [0x4c2ba4], 1
lea eax, [ecx + 0x65]
mov word [0x4be834], ax
add eax, 0xffffffed
mov edx, eax
mov word [0x4be836], dx
mov word [0x4be838], dx
lea edx, [ecx + 0x5f]
mov word [0x4be83a], dx
mov edx, eax
lea eax, [ecx + 0x5c]
mov word [0x4be842], ax
mov eax, ecx
mov word [0x4be83c], dx
mov dword [0x4be83e], 0x836a834d
mov word [0x4be844], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4be834]
add eax, 2
mov word [eax + 0x4be976], dx
cmp eax, 0x12
jb 0x4119dd
mov eax, 0x4be978
ret

Function at 0x412083
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2ba0], 1
jne 0x4120ad
or dword [0x4c2ba0], 1
mov dword [0x4be848], 0x746d7624
mov word [0x4be84c], 0x2674
mov byte [0x4be84e], 0x18
xor eax, eax
mov cl, byte [eax + 0x4be848]
xor cl, 0x18
mov byte [eax + 0x4be98c], cl
inc eax
cmp eax, 7
jb 0x4120af
mov eax, 0x4be98c
ret

Function at 0x4120ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2b9c], 1
jne 0x4120f4
or dword [0x4c2b9c], 1
mov dword [0x4be850], 0x746d7624
mov word [0x4be854], 0x2674
mov byte [0x4be856], 0x18
xor eax, eax
mov cl, byte [eax + 0x4be850]
xor cl, 0x18
mov byte [eax + 0x4be994], cl
inc eax
cmp eax, 7
jb 0x4120f6
mov eax, 0x4be994
ret

Function at 0x412111
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2b94], 1
jne 0x412135
or dword [0x4c2b94], 1
mov dword [0x4be85c], 0x777b4338
mov dword [0x4be860], 0x18257d7c
xor eax, eax
mov cl, byte [eax + 0x4be85c]
xor cl, 0x18
mov byte [eax + 0x4be9a0], cl
inc eax
cmp eax, 8
jb 0x412137
mov eax, 0x4be9a0
ret