joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017d9
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78
test byte [0x4a4be4], 1
push esi
push edi
mov ecx, 0x8328
jne 0x401813
or dword [0x4a4be4], 1
lea eax, [ecx + 0x37]
mov word [0x49ea38], ax
add eax, 0xffffffeb
mov word [0x49ea3a], ax
mov eax, ecx
mov word [0x49ea3c], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x49ea38]
add eax, 2
mov word [eax + 0x49f0c2], dx
cmp eax, 6
jb 0x401817
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x40183a
mov eax, dword [eax]
push 0x49f0c4
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00449647
add esp, 0xc
test eax, eax
jne 0x401905
push dword [esp + 8]
push dword [ebp + 8]
push ebx
call fcn.004024de
push dword [esp + 8]
call fcn.0040190d
push eax
call fcn.00449ba1
push dword [esp + 0x10]
call fcn.0044a12c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.0044cca0
add esp, 0xc
mov dword [esp + 0x38], edi
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4018f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0042836c
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x4018d7
mov eax, dword [eax]
push eax
call fcn.0040194d
push eax
call fcn.00449e70
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x24]
call fcn.00403c75
jmp 0x401905
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0xc]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40190d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4be0], 1
jne 0x401930
or dword [0x4a4be0], 1
mov dword [0x49ea40], 0x666d2225
mov word [0x49ea44], 0x286c
xor eax, eax
mov cl, byte [eax + 0x49ea40]
xor cl, 0x28
mov byte [eax + 0x49f0cc], cl
inc eax
cmp eax, 6
jb 0x401932
mov eax, 0x49f0cc
ret

Function at 0x40194d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4bdc], 1
jne 0x4019d2
or dword [0x4a4bdc], 1
mov dword [0x49ea48], 0x4441496e
mov dword [0x49ea4c], 0x5c084c4d
mov dword [0x49ea50], 0x5a4b0847
mov dword [0x49ea54], 0x4d5c494d
mov dword [0x49ea58], 0x495a4b08
mov dword [0x49ea5c], 0x5a08405b
mov dword [0x49ea60], 0x5a47584d
mov dword [0x49ea64], 0x85a4d5c
mov dword [0x49ea68], 0x4b475a58
mov dword [0x49ea6c], 0x125b5b4d
mov dword [0x49ea70], 0x225b0d08
mov byte [0x49ea74], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ea48]
xor cl, 0x28
mov byte [eax + 0x49f0d4], cl
inc eax
cmp eax, 0x2d
jb 0x4019d4
mov eax, 0x49f0d4
ret
Function at 0x402a0d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b80], 1
jne 0x402a42
or dword [0x4a4b80], 1
mov dword [0x49ecd4], 0x5d4c4765
mov dword [0x49ecd8], 0x8124d44
mov dword [0x49ecdc], 0x22255b0d
mov byte [0x49ece0], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ecd4]
xor cl, 0x28
mov byte [eax + 0x49f360], cl
inc eax
cmp eax, 0xd
jb 0x402a44
mov eax, 0x49f360
ret

Function at 0x402a5f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b7c], 1
jne 0x402a9e
or dword [0x4a4b7c], 1
mov dword [0x49ece4], 0x4d5a407c
mov dword [0x49ece8], 0x8124c49
mov dword [0x49ecec], 0x500d5018
mov dword [0x49ecf0], 0x22252225
mov byte [0x49ecf4], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ece4]
xor cl, 0x28
mov byte [eax + 0x49f370], cl
inc eax
cmp eax, 0x11
jb 0x402aa0
mov eax, 0x49f370
ret

Function at 0x402abb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b78], 1
jne 0x402af9
or dword [0x4a4b78], 1
mov dword [0x49ecf8], 0x4d4b506d
mov dword [0x49ecfc], 0x47415c58
mov dword [0x49ed00], 0x4c0d0846
mov word [0x49ed04], 0x2225
mov byte [0x49ed06], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ecf8]
xor cl, 0x28
mov byte [eax + 0x49f384], cl
inc eax
cmp eax, 0xf
jb 0x402afb
mov eax, 0x49f384
ret

Function at 0x402b16
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b74], 1
jne 0x402b54
or dword [0x4a4b74], 1
mov dword [0x49ed08], 0x494b4764
mov dword [0x49ed0c], 0x4647415c
mov dword [0x49ed10], 0x580d0812
mov word [0x49ed14], 0x2225
mov byte [0x49ed16], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ed08]
xor cl, 0x28
mov byte [eax + 0x49f394], cl
inc eax
cmp eax, 0xf
jb 0x402b56
mov eax, 0x49f394
ret

Function at 0x402b71
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4b70], 1
jne 0x402bb4
or dword [0x4a4b70], 1
mov dword [0x49ed18], 0x4d58517c
mov dword [0x49ed1c], 0x5b0d0812
mov dword [0x49ed20], 0x50180008
mov dword [0x49ed24], 0x2501500d
mov word [0x49ed28], 0x2822
mov cl, byte [eax + 0x49ed18]
xor cl, 0x28
mov byte [eax + 0x49f3a4], cl
inc eax
cmp eax, 0x12
jb 0x402bb4
mov eax, 0x49f3a4
ret

Function at 0x402bcf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b6c], 1
jne 0x402c57
or dword [0x4a4b6c], 1
mov dword [0x49ed2c], 0x495c4d6c
mov dword [0x49ed30], 0x125b4441
mov dword [0x49ed34], 0x415a7c08
mov dword [0x49ed38], 0x5c084c4d
mov dword [0x49ed3c], 0x4d5a0847
mov dword [0x49ed40], 0x4e084c49
mov dword [0x49ed44], 0x845475a
mov dword [0x49ed48], 0x47454d45
mov dword [0x49ed4c], 0x4908515a
mov dword [0x49ed50], 0x4d5a4c4c
mov dword [0x49ed54], 0xd085b5b
mov dword [0x49ed58], 0x28222558
xor eax, eax
mov cl, byte [eax + 0x49ed2c]
xor cl, 0x28
mov byte [eax + 0x49f3b8], cl
inc eax
cmp eax, 0x30
jb 0x402c59
mov eax, 0x49f3b8
ret
Function at 0x402c74
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b68], 1
jne 0x402d06
or dword [0x4a4b68], 1
mov dword [0x49ed5c], 0x495c4d6c
mov dword [0x49ed60], 0x125b4441
mov dword [0x49ed64], 0x415a7c08
mov dword [0x49ed68], 0x5c084c4d
mov dword [0x49ed6c], 0x5a5f0847
mov dword [0x49ed70], 0x84d5c41
mov dword [0x49ed74], 0x4508475c
mov dword [0x49ed78], 0x5a47454d
mov dword [0x49ed7c], 0x4c490851
mov dword [0x49ed80], 0x5b4d5a4c
mov dword [0x49ed84], 0x580d085b
mov word [0x49ed88], 0x2225
mov byte [0x49ed8a], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ed5c]
xor cl, 0x28
mov byte [eax + 0x49f3e8], cl
inc eax
cmp eax, 0x2f
jb 0x402d08
mov eax, 0x49f3e8
ret

Function at 0x402d23
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b64], 1
jne 0x402db6
or dword [0x4a4b64], 1
mov dword [0x49ed8c], 0x495c4d6c
mov dword [0x49ed90], 0x125b4441
mov dword [0x49ed94], 0x415a7c08
mov dword [0x49ed98], 0x5c084c4d
mov dword [0x49ed9c], 0x504d0847
mov dword [0x49eda0], 0x5c5d4b4d
mov dword [0x49eda4], 0x4d45084d
mov dword [0x49eda8], 0x515a4745
mov dword [0x49edac], 0x85c4908
mov dword [0x49edb0], 0x5a4c4c49
mov dword [0x49edb4], 0x85b5b4d
mov dword [0x49edb8], 0x2225580d
mov byte [0x49edbc], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ed8c]
xor cl, 0x28
mov byte [eax + 0x49f418], cl
inc eax
cmp eax, 0x31
jb 0x402db8
mov eax, 0x49f418
ret

Function at 0x402dd3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b60], 1
jne 0x402e0a
or dword [0x4a4b60], 1
mov dword [0x49edc0], 0x4f49446e
mov dword [0x49edc4], 0x1808125b
mov dword [0x49edc8], 0x25500d50
mov word [0x49edcc], 0x2822
xor eax, eax
mov cl, byte [eax + 0x49edc0]
xor cl, 0x28
mov byte [eax + 0x49f44c], cl
inc eax
cmp eax, 0xe
jb 0x402e0c
mov eax, 0x49f44c
ret

Function at 0x402e27
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b5c], 1
jne 0x402e5e
or dword [0x4a4b5c], 1
mov dword [0x49edd0], 0x495a4978
mov dword [0x49edd4], 0x4d5c4d45
mov dword [0x49edd8], 0x25125b5a
mov word [0x49eddc], 0x2822
xor eax, eax
mov cl, byte [eax + 0x49edd0]
xor cl, 0x28
mov byte [eax + 0x49f45c], cl
inc eax
cmp eax, 0xe
jb 0x402e60
mov eax, 0x49f45c
ret

Function at 0x402e7b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b58], 1
jne 0x402ec4
or dword [0x4a4b58], 1
mov dword [0x49ede0], 0x5a497821
mov dword [0x49ede4], 0x5c4d4549
mov dword [0x49ede8], 0xd735a4d
mov dword [0x49edec], 0x812754c
mov dword [0x49edf0], 0x2225580d
mov byte [0x49edf4], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ede0]
xor cl, 0x28
mov byte [eax + 0x49f46c], cl
inc eax
cmp eax, 0x15
jb 0x402ec6
mov eax, 0x49f46c
ret

Function at 0x402ee1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b54], 1
jne 0x402f19
or dword [0x4a4b54], 1
mov dword [0x49edf8], 0x8606d7b
mov dword [0x49edfc], 0x44494669
mov dword [0x49ee00], 0x5b415b51
mov dword [0x49ee04], 0x28222512
xor eax, eax
mov cl, byte [eax + 0x49edf8]
xor cl, 0x28
mov byte [eax + 0x49f484], cl
inc eax
cmp eax, 0x10
jb 0x402f1b
mov eax, 0x49f484
ret
Function at 0x402f36
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b50], 1
jne 0x402f7e
or dword [0x4a4b50], 1
mov dword [0x49ee08], 0x424a6721
mov dword [0x49ee0c], 0x85c4b4d
mov dword [0x49ee10], 0x4d58515c
mov dword [0x49ee14], 0x5b0d0812
mov word [0x49ee18], 0x2225
mov byte [0x49ee1a], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ee08]
xor cl, 0x28
mov byte [eax + 0x49f494], cl
inc eax
cmp eax, 0x13
jb 0x402f80
mov eax, 0x49f494
ret

Function at 0x403023
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b48], 1
jne 0x403046
or dword [0x4a4b48], 1
mov dword [0x49ee40], 0x4c5c5b68
mov word [0x49ee44], 0x2868
xor eax, eax
mov cl, byte [eax + 0x49ee40]
xor cl, 0x28
mov byte [eax + 0x49f4cc], cl
inc eax
cmp eax, 6
jb 0x403048
mov eax, 0x49f4cc
ret

Function at 0x403063
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b44], 1
jne 0x40309a
or dword [0x4a4b44], 1
mov dword [0x49ee48], 0x5c465d5a
mov dword [0x49ee4c], 0x774d4541
mov dword [0x49ee50], 0x475a5a4d
mov word [0x49ee54], 0x285a
xor eax, eax
mov cl, byte [eax + 0x49ee48]
xor cl, 0x28
mov byte [eax + 0x49f4d4], cl
inc eax
cmp eax, 0xe
jb 0x40309c
mov eax, 0x49f4d4
ret

Function at 0x4030b7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b40], 1
jne 0x4030e5
or dword [0x4a4b40], 1
mov dword [0x49ee58], 0x4f46495a
mov dword [0x49ee5c], 0x5a4d774d
mov dword [0x49ee60], 0x285a475a
xor eax, eax
mov cl, byte [eax + 0x49ee58]
xor cl, 0x28
mov byte [eax + 0x49f4e4], cl
inc eax
cmp eax, 0xc
jb 0x4030e7
mov eax, 0x49f4e4
ret

Function at 0x403102
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b3c], 1
jne 0x403140
or dword [0x4a4b3c], 1
mov dword [0x49ee64], 0x5a4d5e47
mov dword [0x49ee68], 0x5f47444e
mov dword [0x49ee6c], 0x5a5a4d77
mov word [0x49ee70], 0x5a47
mov byte [0x49ee72], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ee64]
xor cl, 0x28
mov byte [eax + 0x49f4f0], cl
inc eax
cmp eax, 0xf
jb 0x403142
mov eax, 0x49f4f0
ret

Function at 0x40315d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b38], 1
jne 0x403195
or dword [0x4a4b38], 1
mov dword [0x49ee74], 0x4d4c465d
mov dword [0x49ee78], 0x47444e5a
mov dword [0x49ee7c], 0x5a4d775f
mov dword [0x49ee80], 0x285a475a
xor eax, eax
mov cl, byte [eax + 0x49ee74]
xor cl, 0x28
mov byte [eax + 0x49f500], cl
inc eax
cmp eax, 0x10
jb 0x403197
mov eax, 0x49f500
ret

Function at 0x4031b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b34], 1
jne 0x4031e0
or dword [0x4a4b34], 1
mov dword [0x49ee84], 0x414f4744
mov dword [0x49ee88], 0x5a4d774b
mov dword [0x49ee8c], 0x285a475a
xor eax, eax
mov cl, byte [eax + 0x49ee84]
xor cl, 0x28
mov byte [eax + 0x49f510], cl
inc eax
cmp eax, 0xc
jb 0x4031e2
mov eax, 0x49f510
ret

Function at 0x4031fd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b30], 1
jne 0x403232
or dword [0x4a4b30], 1
mov dword [0x49ee90], 0x4945474c
mov dword [0x49ee94], 0x4d774641
mov dword [0x49ee98], 0x5a475a5a
mov byte [0x49ee9c], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ee90]
xor cl, 0x28
mov byte [eax + 0x49f51c], cl
inc eax
cmp eax, 0xd
jb 0x403234
mov eax, 0x49f51c
ret
Function at 0x40324f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b2c], 1
jne 0x40328e
or dword [0x4a4b2c], 1
mov dword [0x49eea0], 0x495e4641
mov dword [0x49eea4], 0x774c4144
mov dword [0x49eea8], 0x5d4f5a49
mov dword [0x49eeac], 0x5c464d45
mov byte [0x49eeb0], 0x28
xor eax, eax
mov cl, byte [eax + 0x49eea0]
xor cl, 0x28
mov byte [eax + 0x49f52c], cl
inc eax
cmp eax, 0x11
jb 0x403290
mov eax, 0x49f52c
ret

Function at 0x4032ab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b28], 1
jne 0x4032e0
or dword [0x4a4b28], 1
mov dword [0x49eeb4], 0x4f464d44
mov dword [0x49eeb8], 0x4d77405c
mov dword [0x49eebc], 0x5a475a5a
mov byte [0x49eec0], 0x28
xor eax, eax
mov cl, byte [eax + 0x49eeb4]
xor cl, 0x28
mov byte [eax + 0x49f540], cl
inc eax
cmp eax, 0xd
jb 0x4032e2
mov eax, 0x49f540
ret

Function at 0x4032fd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b24], 1
jne 0x403332
or dword [0x4a4b24], 1
mov dword [0x49eec4], 0x775c5d47
mov dword [0x49eec8], 0x5a774e47
mov dword [0x49eecc], 0x4d4f4649
mov byte [0x49eed0], 0x28
xor eax, eax
mov cl, byte [eax + 0x49eec4]
xor cl, 0x28
mov byte [eax + 0x49f550], cl
inc eax
cmp eax, 0xd
jb 0x403334
mov eax, 0x49f550
ret

Function at 0x40334f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b20], 1
jne 0x40337c
or dword [0x4a4b20], 1
mov dword [0x49eed4], 0x4d4b504d
mov dword [0x49eed8], 0x47415c58
mov word [0x49eedc], 0x2846
xor eax, eax
mov cl, byte [eax + 0x49eed4]
xor cl, 0x28
mov byte [eax + 0x49f560], cl
inc eax
cmp eax, 0xa
jb 0x40337e
mov eax, 0x49f560
ret

Function at 0x403399
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4b1c], 1
jne 0x4033fa
or dword [0x4a4b1c], 1
mov dword [0x49eee0], 0x4c5c5b21
mov dword [0x49eee4], 0x504d1212
mov dword [0x49eee8], 0x5c584d4b
mov dword [0x49eeec], 0x12464741
mov dword [0x49eef0], 0x49405f12
mov dword [0x49eef4], 0x1201005c
mov dword [0x49eef8], 0x255b0d08
mov word [0x49eefc], 0x2822
mov cl, byte [eax + 0x49eee0]
xor cl, 0x28
mov byte [eax + 0x49f56c], cl
inc eax
cmp eax, 0x1e
jb 0x4033fa
mov eax, 0x49f56c
ret

Function at 0x4034a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b14], 1
jne 0x4034da
or dword [0x4a4b14], 1
mov dword [0x49ef28], 0x45474b77
mov dword [0x49ef2c], 0x5a5a4d77
mov word [0x49ef30], 0x5a47
mov byte [0x49ef32], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ef28]
xor cl, 0x28
mov byte [eax + 0x49f5b4], cl
inc eax
cmp eax, 0xb
jb 0x4034dc
mov eax, 0x49f5b4
ret

Function at 0x4034f7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4b10], 1
jne 0x403562
or dword [0x4a4b10], 1
mov dword [0x49ef34], 0x474b7721
mov dword [0x49ef38], 0x5a4d7745
mov dword [0x49ef3c], 0x125a475a
mov dword [0x49ef40], 0x5a5a6d12
mov dword [0x49ef44], 0x4d655a47
mov dword [0x49ef48], 0x4f495b5b
mov dword [0x49ef4c], 0x1201004d
mov dword [0x49ef50], 0x255b0d08
mov word [0x49ef54], 0x2822
mov cl, byte [eax + 0x49ef34]
xor cl, 0x28
mov byte [eax + 0x49f5c0], cl
inc eax
cmp eax, 0x22
jb 0x403562
mov eax, 0x49f5c0
ret
Function at 0x403618
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b08], 1
jne 0x403693
or dword [0x4a4b08], 1
mov dword [0x49ef84], 0x4b495c7b
mov dword [0x49ef88], 0x5d4c0843
mov dword [0x49ef8c], 0x4d085845
mov dword [0x49ef90], 0x5a475a5a
mov dword [0x49ef94], 0x476b0812
mov dword [0x49ef98], 0x504d5c46
mov dword [0x49ef9c], 0x4b4d7a5c
mov dword [0x49efa0], 0x84c5a47
mov dword [0x49efa4], 0x85b495f
mov dword [0x49efa8], 0x44445d46
mov byte [0x49efac], 0x28
xor eax, eax
mov cl, byte [eax + 0x49ef84]
xor cl, 0x28
mov byte [eax + 0x49f610], cl
inc eax
cmp eax, 0x29
jb 0x403695
mov eax, 0x49f610
ret

Function at 0x4036b0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b04], 1
jne 0x40372a
or dword [0x4a4b04], 1
mov dword [0x49efb0], 0x4b495c7b
mov dword [0x49efb4], 0x5d4c0843
mov dword [0x49efb8], 0x4d085845
mov dword [0x49efbc], 0x5a475a5a
mov dword [0x49efc0], 0x517b0812
mov dword [0x49efc4], 0x41466145
mov dword [0x49efc8], 0x4449415c
mov dword [0x49efcc], 0x84d5241
mov dword [0x49efd0], 0x4441494e
mov word [0x49efd4], 0x4c4d
mov byte [0x49efd6], 0x28
xor eax, eax
mov cl, byte [eax + 0x49efb0]
xor cl, 0x28
mov byte [eax + 0x49f63c], cl
inc eax
cmp eax, 0x27
jb 0x40372c
mov eax, 0x49f63c
ret

Function at 0x403747
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4b00], 1
jne 0x4037ad
or dword [0x4a4b00], 1
mov dword [0x49efd8], 0x41435b14
mov dword [0x49efdc], 0x4c4d5858
mov dword [0x49efe0], 0x495a4e08
mov dword [0x49efe4], 0x8044d45
mov dword [0x49efe8], 0x5f086b78
mov dword [0x49efec], 0x46085b49
mov dword [0x49eff0], 0x1644445d
mov word [0x49eff4], 0x2225
mov byte [0x49eff6], 0x28
xor eax, eax
mov cl, byte [eax + 0x49efd8]
xor cl, 0x28
mov byte [eax + 0x49f664], cl
inc eax
cmp eax, 0x1f
jb 0x4037af
mov eax, 0x49f664
ret

Function at 0x4037ca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4afc], 1
jne 0x40385d
or dword [0x4a4afc], 1
mov dword [0x49eff8], 0x41435b14
mov dword [0x49effc], 0x4c4d5858
mov dword [0x49f000], 0x495a4e08
mov dword [0x49f004], 0x8044d45
mov dword [0x49f008], 0x5f086b78
mov dword [0x49f00c], 0x5b085b49
mov dword [0x49f010], 0x84d4549
mov dword [0x49f014], 0x5a085b49
mov dword [0x49f018], 0x5a5d5c4d
mov dword [0x49f01c], 0x4c490846
mov dword [0x49f020], 0x5b4d5a4c
mov dword [0x49f024], 0x2225165b
mov byte [0x49f028], 0x28
xor eax, eax
mov cl, byte [eax + 0x49eff8]
xor cl, 0x28
mov byte [eax + 0x49f684], cl
inc eax
cmp eax, 0x31
jb 0x40385f
mov eax, 0x49f684
ret
Function at 0x40387a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16cc
call fcn.0045c7e0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], eax
test byte [0x4a4af8], bl
jne 0x4038c2
or dword [0x4a4af8], ebx
mov dword [0x49f02c], 0x4c474514
mov dword [0x49f030], 0x174d445d
mov dword [0x49f034], 0x28161717
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x49f02c]
xor cl, 0x28
mov byte [eax + 0x49f6b8], cl
inc eax
cmp eax, 0xc
jb 0x4038c6
mov dword [ebp - 8], 0x49f6b8
test byte [0x4a4af4], bl
jne 0x40390e
or dword [0x4a4af4], ebx
mov dword [0x49f038], 0x45515b14
mov dword [0x49f03c], 0x1744474a
mov dword [0x49f040], 0x28161717
xor eax, eax
mov cl, byte [eax + 0x49f038]
xor cl, 0x28
mov byte [eax + 0x49f6c4], cl
inc eax
cmp eax, 0xc
jb 0x403910
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c8]
push edi
push eax
mov dword [ebp - 0x1c], 0x49f6c4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0044cca0
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c8], esi
mov esi, eax
lea eax, [ebp - 0x6c8]
push eax
push edx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x24], edx
call dword [sym.imp.dbghelp.dll_SymGetModuleInfo64]
test eax, eax
je 0x403976
lea eax, [ebp - 0x6a4]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c8]
push edi
push eax
call fcn.0044cca0
add esp, 0xc
lea eax, [ebp - 0x16c8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x16c8], 0x58
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1678], 0x7d0
call dword [sym.imp.dbghelp.dll_SymFromAddr]
lea ecx, [ebp - 0x1674]
test eax, eax
jne 0x4039c4
mov ecx, dword [ebp - 0x1c]
test byte [0x4a4af0], bl
jne 0x4039f9
or dword [0x4a4af0], ebx
mov dword [0x49f044], 0xd08580d
mov dword [0x49f048], 0x5b0d095b
mov dword [0x49f04c], 0xd501803
mov word [0x49f050], 0x2850
xor eax, eax
mov dl, byte [eax + 0x49f044]
xor dl, 0x28
mov byte [eax + 0x49f6d0], dl
inc eax
cmp eax, 0xe
jb 0x4039fb
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x49f6d0
push dword [ebp + 0xc]
call fcn.00449f2d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x40], 0x18
push esi
push dword [ebp - 4]
call dword [sym.imp.dbghelp.dll_SymGetLineFromAddr64]
test eax, eax
je 0x403a74
push dword [ebp - 0xc]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call fcn.00403abf
push eax
push dword [ebp + 0xc]
call fcn.00449f2d
add esp, 0x14
test byte [0x4a4ae8], bl
jne 0x403a92
or dword [0x4a4ae8], ebx
mov word [0x49f064], 0x2225
mov byte [0x49f066], 0x28
xor eax, eax
mov cl, byte [eax + 0x49f064]
xor cl, 0x28
mov byte [eax + 0x49f6f0], cl
inc eax
cmp eax, 3
jb 0x403a94
push dword [ebp + 0xc]
push 0x49f6f0
call fcn.00449ba1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403abf
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4a4aec], 1
jne 0x403af9
or dword [0x4a4aec], 1
mov dword [0x49f054], 0x5b0d0008
mov dword [0x49f058], 0x84c0d12
mov dword [0x49f05c], 0x50180803
mov dword [0x49f060], 0x2801500d
mov cl, byte [eax + 0x49f054]
xor cl, 0x28
mov byte [eax + 0x49f6e0], cl
inc eax
cmp eax, 0x10
jb 0x403af9
mov eax, 0x49f6e0
ret

Function at 0x404d5b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4adc], 1
jne 0x404db0
or dword [0x4a4adc], 1
mov dword [0x49f714], 0x6d7b6861
mov dword [0x49f718], 0x6c7b687e
mov dword [0x49f71c], 0x796a6875
mov dword [0x49f720], 0x7a6d7560
mov dword [0x49f724], 0x7f757d6d
mov dword [0x49f728], 0x7671666b
mov word [0x49f72c], 0x2976
xor eax, eax
mov cl, byte [eax + 0x49f714]
xor cl, 0x29
mov byte [eax + 0x49f914], cl
inc eax
cmp eax, 0x1a
jb 0x404db2
mov eax, 0x49f914
ret

Function at 0x404ec1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ad8], 1
jne 0x404eeb
or dword [0x4a4ad8], 1
mov dword [0x49f730], 0x487e647f
mov word [0x49f734], 0x4c5b
mov byte [0x49f736], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f730]
xor cl, 0x29
mov byte [eax + 0x49f930], cl
inc eax
cmp eax, 7
jb 0x404eed
mov eax, 0x49f930
ret

Function at 0x404f08
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ad4], 1
jne 0x404f35
or dword [0x4a4ad4], 1
mov dword [0x49f738], 0x5d5b407f
mov dword [0x49f73c], 0x7945485c
mov word [0x49f740], 0x296a
xor eax, eax
mov cl, byte [eax + 0x49f738]
xor cl, 0x29
mov byte [eax + 0x49f938], cl
inc eax
cmp eax, 0xa
jb 0x404f37
mov eax, 0x49f938
ret

Function at 0x404f52
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4ad0], 1
jne 0x404f86
or dword [0x4a4ad0], 1
mov dword [0x49f744], 0x5d5b407f
mov dword [0x49f748], 0x6b45485c
mov word [0x49f74c], 0x5146
mov byte [0x49f74e], 0x29
xor eax, eax
mov cl, byte [eax + 0x49f744]
xor cl, 0x29
mov byte [eax + 0x49f944], cl
inc eax
cmp eax, 0xb
jb 0x404f88
mov eax, 0x49f944
ret

Function at 0x404fa3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4acc], 1
jne 0x404fc7
or dword [0x4a4acc], 1
mov dword [0x49f750], 0x4c474c6e
mov dword [0x49f754], 0x294a405b
xor eax, eax
mov cl, byte [eax + 0x49f750]
xor cl, 0x29
mov byte [eax + 0x49f950], cl
inc eax
cmp eax, 8
jb 0x404fc9
mov eax, 0x49f950
ret