joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ecc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48ac94
call fcn.00489c78
sub esp, 0x64
test byte [0x4c2c5c], 1
jne 0x407ef9
or dword [0x4c2c5c], 1
mov word [0x4bde04], 0xe38b
mov byte [0x4bde06], 0xae
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x4bde04]
xor cl, 0xae
mov byte [eax + 0x4be3fc], cl
inc eax
cmp eax, 3
jb 0x407f00
mov esi, 0x4be3fc
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407f2c
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00404ceb
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0040d0c8
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00404d81
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x407f73
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.0044f74b
pop ecx
pop ecx
cmp eax, ebx
je 0x407fc4
cmp eax, 3
jne 0x407fb1
call fcn.004080cb
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00463995
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x4aec28
lea eax, [ebp - 0x1c]
push eax
call fcn.0046d8b5
cmp eax, 4
jne 0x407fbd
call fcn.0040817e
jmp 0x407f8d
call fcn.00408231
jmp 0x407f8d
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.00451181
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x40807b
push ebx
call fcn.004082b5
push eax
push 0xffffffffffffffff
push esi
call fcn.0044fee2
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00404d60
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x408033
call fcn.004082fc
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040d139
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.00405c65
jmp 0x407fa3
cmp edi, 4
jne 0x408052
call fcn.0040835b
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040d139
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x408026
cmp edi, 6
jne 0x408071
call fcn.004083c0
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0040d139
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x408026
call fcn.00408444
jmp 0x407f8d
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.0045053d
pop ecx
pop ecx
test eax, eax
je 0x40809c
push ebx
push edi
push esi
call fcn.00450701
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.00450337
sub edi, eax
push edi
push esi
call fcn.0045034d
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00404d81
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4080cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c58], 1
jne 0x408161
or dword [0x4c2c58], 1
mov dword [0x4bde08], 0xc2c7cfe8
mov dword [0x4bde0c], 0xda8ecacb
mov dword [0x4bde10], 0xd8cb8ec1
mov dword [0x4bde14], 0xcfdbc2cf
mov dword [0x4bde18], 0xcc8ecbda
mov dword [0x4bde1c], 0xdddac1c1
mov dword [0x4bde20], 0xdecfdcda
mov dword [0x4bde24], 0xcfdcc88e
mov dword [0x4bde28], 0xc0cbc3c9
mov dword [0x4bde2c], 0xdd8e82da
mov dword [0x4bde30], 0xcfdac0d7
mov dword [0x4bde34], 0xdccb8ed6
mov dword [0x4bde38], 0xaedcc1dc
xor eax, eax
mov cl, byte [eax + 0x4bde08]
xor cl, 0xae
mov byte [eax + 0x4be400], cl
inc eax
cmp eax, 0x34
jb 0x408163
mov eax, 0x4be400
ret

Function at 0x40817e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c54], 1
jne 0x408214
or dword [0x4c2c54], 1
mov dword [0x4bde3c], 0xc2c7cfe8
mov dword [0x4bde40], 0xda8ecacb
mov dword [0x4bde44], 0xd8cb8ec1
mov dword [0x4bde48], 0xcfdbc2cf
mov dword [0x4bde4c], 0xcc8ecbda
mov dword [0x4bde50], 0xdddac1c1
mov dword [0x4bde54], 0xdecfdcda
mov dword [0x4bde58], 0xcfdcc88e
mov dword [0x4bde5c], 0xc0cbc3c9
mov dword [0x4bde60], 0xc38e82da
mov dword [0x4bde64], 0xdcc1c3cb
mov dword [0x4bde68], 0xdccb8ed7
mov dword [0x4bde6c], 0xaedcc1dc
xor eax, eax
mov cl, byte [eax + 0x4bde3c]
xor cl, 0xae
mov byte [eax + 0x4be434], cl
inc eax
cmp eax, 0x34
jb 0x408216
mov eax, 0x4be434
ret

Function at 0x408231
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c50], 1
jne 0x408298
or dword [0x4c2c50], 1
mov dword [0x4bde70], 0xc0c5c0fb
mov dword [0x4bde74], 0x8ec0d9c1
mov dword [0x4bde78], 0xc1dcdccb
mov dword [0x4bde7c], 0xc0c78edc
mov dword [0x4bde80], 0xcfdbc28e
mov dword [0x4bde84], 0xc1c2f1e2
mov dword [0x4bde88], 0xdaddcacf
mov dword [0x4bde8c], 0xc9c0c7dc
mov byte [0x4bde90], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bde70]
xor cl, 0xae
mov byte [eax + 0x4be468], cl
inc eax
cmp eax, 0x21
jb 0x40829a
mov eax, 0x4be468
ret

Function at 0x4082b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c4c], 1
jne 0x4082df
or dword [0x4c2c4c], 1
mov dword [0x4bde94], 0xc0c1c092
mov word [0x4bde98], 0x90cb
mov byte [0x4bde9a], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bde94]
xor cl, 0xae
mov byte [eax + 0x4be48c], cl
inc eax
cmp eax, 7
jb 0x4082e1
mov eax, 0x4be48c
ret

Function at 0x4082fc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c48], 1
jne 0x40833e
or dword [0x4c2c48], 1
mov dword [0x4bde9c], 0x8ecfdbe2
mov dword [0x4bdea0], 0xdac0dbdc
mov dword [0x4bdea4], 0x8ecbc3c7
mov dword [0x4bdea8], 0xc1dcdccb
mov dword [0x4bdeac], 0xae8e94dc
xor eax, eax
mov cl, byte [eax + 0x4bde9c]
xor cl, 0xae
mov byte [eax + 0x4be494], cl
inc eax
cmp eax, 0x14
jb 0x408340
mov eax, 0x4be494
ret
Function at 0x40835b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c44], 1
jne 0x4083a3
or dword [0x4c2c44], 1
mov dword [0x4bdeb0], 0x8ecfdbe2
mov dword [0x4bdeb4], 0xc1c3cbc3
mov dword [0x4bdeb8], 0xcb8ed7dc
mov dword [0x4bdebc], 0xdcc1dcdc
mov word [0x4bdec0], 0x8e94
mov byte [0x4bdec2], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdeb0]
xor cl, 0xae
mov byte [eax + 0x4be4a8], cl
inc eax
cmp eax, 0x13
jb 0x4083a5
mov eax, 0x4be4a8
ret

Function at 0x4083c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c40], 1
jne 0x408427
or dword [0x4c2c40], 1
mov dword [0x4bdec4], 0x8ecfdbe2
mov dword [0x4bdec8], 0xc1dcdccb
mov dword [0x4bdecc], 0xc0c78edc
mov dword [0x4bded0], 0xcbcac7dd
mov dword [0x4bded4], 0xdcdccb8e
mov dword [0x4bded8], 0xc68edcc1
mov dword [0x4bdedc], 0xc2cac0cf
mov dword [0x4bdee0], 0x8e94dccb
mov byte [0x4bdee4], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdec4]
xor cl, 0xae
mov byte [eax + 0x4be4bc], cl
inc eax
cmp eax, 0x21
jb 0x408429
mov eax, 0x4be4bc
ret

Function at 0x408444
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c3c], 1
jne 0x4084a0
or dword [0x4c2c3c], 1
mov dword [0x4bdee8], 0xc0c5c0fb
mov dword [0x4bdeec], 0x8ec0d9c1
mov dword [0x4bdef0], 0xc1dcdccb
mov dword [0x4bdef4], 0xc0c78edc
mov dword [0x4bdef8], 0xcfdbc28e
mov dword [0x4bdefc], 0xcfcddef1
mov word [0x4bdf00], 0xc2c2
mov byte [0x4bdf02], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdee8]
xor cl, 0xae
mov byte [eax + 0x4be4e0], cl
inc eax
cmp eax, 0x1b
jb 0x4084a2
mov eax, 0x4be4e0
ret

Function at 0x4086de
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c38], 1
jne 0x408727
or dword [0x4c2c38], 1
mov dword [0x4bdf04], 0xcbddcfec
mov dword [0x4bdf08], 0xca8e9a98
mov dword [0x4bdf0c], 0xcac1cdcb
mov dword [0x4bdf10], 0xcfc88ecb
mov dword [0x4bdf14], 0xcacbc2c7
mov byte [0x4bdf18], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdf04]
xor cl, 0xae
mov byte [eax + 0x4be4fc], cl
inc eax
cmp eax, 0x15
jb 0x408729
mov eax, 0x4be4fc
ret
Function at 0x408744
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48c993
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0042c77f
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0042ab79
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.00404ebf
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.0040acb3
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x4087d1
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0042f786
add esp, 0x10
test al, al
jne 0x408816
call fcn.0040888d
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00463995
push 0x4aec28
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.0046d8b5
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.0040acb3
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x408856
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x408835
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.0040a121
lea esi, [esp + 0x20]
call fcn.00404c88
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00404d81
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40888d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c34], 1
jne 0x4088d6
or dword [0x4c2c34], 1
mov dword [0x4bdf1c], 0xcbddcfec
mov dword [0x4bdf20], 0xca8e9a98
mov dword [0x4bdf24], 0xcac1cdcb
mov dword [0x4bdf28], 0xcfc88ecb
mov dword [0x4bdf2c], 0xcacbc2c7
mov byte [0x4bdf30], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdf1c]
xor cl, 0xae
mov byte [eax + 0x4be514], cl
inc eax
cmp eax, 0x15
jb 0x4088d8
mov eax, 0x4be514
ret

Function at 0x408fca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c30], 1
jne 0x40901f
or dword [0x4c2c30], 1
mov dword [0x4bdf34], 0xc2dbc1ed
mov dword [0x4bdf38], 0xc1c08eca
mov dword [0x4bdf3c], 0xdec18eda
mov dword [0x4bdf40], 0xcd8ec0cb
mov dword [0x4bdf44], 0xc6ddcfdc
mov dword [0x4bdf48], 0xc3dbca8e
mov word [0x4bdf4c], 0xaede
xor eax, eax
mov cl, byte [eax + 0x4bdf34]
xor cl, 0xae
mov byte [eax + 0x4be52c], cl
inc eax
cmp eax, 0x1a
jb 0x409021
mov eax, 0x4be52c
ret
Function at 0x40903c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c28], 1
jne 0x40905f
or dword [0x4c2c28], 1
mov dword [0x4bdf54], 0xc9c1c281
mov word [0x4bdf58], 0xae81
xor eax, eax
mov cl, byte [eax + 0x4bdf54]
xor cl, 0xae
mov byte [eax + 0x4be54c], cl
inc eax
cmp eax, 6
jb 0x409061
mov eax, 0x4be54c
ret

Function at 0x40907c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c24], 1
jne 0x4090f7
or dword [0x4c2c24], 1
mov dword [0x4bdf5c], 0xdedadac6
mov dword [0x4bdf60], 0xcf818194
mov dword [0x4bdf64], 0xd7c2cfc0
mov dword [0x4bdf68], 0xddcdc7da
mov dword [0x4bdf6c], 0xdacbc980
mov dword [0x4bdf70], 0xc0d9c1ca
mov dword [0x4bdf74], 0xdaddcbda
mov dword [0x4bdf78], 0xc3c1cd80
mov dword [0x4bdf7c], 0x819cd881
mov dword [0x4bdf80], 0x81c9c1c2
mov byte [0x4bdf84], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdf5c]
xor cl, 0xae
mov byte [eax + 0x4be554], cl
inc eax
cmp eax, 0x29
jb 0x4090f9
mov eax, 0x4be554
ret

Function at 0x409114
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c20], 1
jne 0x40913f
or dword [0x4c2c20], 1
mov dword [0x4bdf88], 0xdd8893cd
mov dword [0x4bdf8c], 0x93da8893
mov byte [0x4bdf90], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdf88]
xor cl, 0xae
mov byte [eax + 0x4be580], cl
inc eax
cmp eax, 9
jb 0x409141
mov eax, 0x4be580
ret

Function at 0x40915c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c10], 1
jne 0x4091e4
or dword [0x4c2c10], 1
mov dword [0x4bdfa4], 0xdac0c1ed
mov dword [0x4bdfa8], 0x83dac0cb
mov dword [0x4bdfac], 0xcbded7fa
mov dword [0x4bdfb0], 0xdecf8e94
mov dword [0x4bdfb4], 0xcdc7c2de
mov dword [0x4bdfb8], 0xc1c7dacf
mov dword [0x4bdfbc], 0x83d681c0
mov dword [0x4bdfc0], 0x83d9d9d9
mov dword [0x4bdfc4], 0xc3dcc1c8
mov dword [0x4bdfc8], 0xc2dcdb83
mov dword [0x4bdfcc], 0xc1cdc0cb
mov dword [0x4bdfd0], 0xaecacbca
xor eax, eax
mov cl, byte [eax + 0x4bdfa4]
xor cl, 0xae
mov byte [eax + 0x4be59c], cl
inc eax
cmp eax, 0x30
jb 0x4091e6
mov eax, 0x4be59c
ret

Function at 0x409201
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c0c], 1
jne 0x40922c
or dword [0x4c2c0c], 1
mov dword [0x4bdfd4], 0xfafde1fe
mov dword [0x4bdfd8], 0x8ec1da8e
mov byte [0x4bdfdc], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdfd4]
xor cl, 0xae
mov byte [eax + 0x4be5cc], cl
inc eax
cmp eax, 9
jb 0x40922e
mov eax, 0x4be5cc
ret

Function at 0x409249
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c08], 1
jne 0x409292
or dword [0x4c2c08], 1
mov dword [0x4bdfe0], 0xc7cfc88e
mov dword [0x4bdfe4], 0x8ecacbc2
mov dword [0x4bdfe8], 0xc6dac7d9
mov dword [0x4bdfec], 0xcfdadd8e
mov dword [0x4bdff0], 0x8edddbda
mov byte [0x4bdff4], 0xae
xor eax, eax
mov cl, byte [eax + 0x4bdfe0]
xor cl, 0xae
mov byte [eax + 0x4be5d8], cl
inc eax
cmp eax, 0x15
jb 0x409294
mov eax, 0x4be5d8
ret
Function at 0x4092c9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48b208
call fcn.00489c78
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x40947a
cmp dword [ebp + 0x10], ebx
je 0x40947a
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0040a614
push eax
push 0x4acb80
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.00405515
push 0x4acb7c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040554b
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.00404ebf
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00404ebf
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x4093d5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0040a614
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0040a636
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x409389
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0040e0ee
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.00404ebf
inc bl
jne 0x409441
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.00404ebf
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x409350
test byte [0x4c2c00], 1
jne 0x409402
or dword [0x4c2c00], 1
mov dword [0x4be004], 0x8edac1e0
mov dword [0x4be008], 0xc0dbc1c8
mov word [0x4be00c], 0xaeca
xor eax, eax
mov cl, byte [eax + 0x4be004]
xor cl, 0xae
mov byte [eax + 0x4be5fc], cl
inc eax
cmp eax, 0xa
jb 0x409404
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x4be5fc
call fcn.00463995
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x4aec28
lea eax, [ebp - 0x44]
push eax
call fcn.0046d8b5
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0040a636
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.00404ebf
push 1
lea esi, [ebp - 0x2c]
call fcn.00404ebf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.0040949f
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.00463995
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x4aec28
lea eax, [ebp - 0x38]
jmp 0x40943b

Function at 0x40949f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2c04], 1
jne 0x4094cc
or dword [0x4c2c04], 1
mov dword [0x4bdff8], 0x8edac1e0
mov dword [0x4bdffc], 0xc0dbc1c8
mov word [0x4be000], 0xaeca
xor eax, eax
mov cl, byte [eax + 0x4bdff8]
xor cl, 0xae
mov byte [eax + 0x4be5f0], cl
inc eax
cmp eax, 0xa
jb 0x4094ce
mov eax, 0x4be5f0
ret
Function at 0x409c83
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bfc], 1
mov ecx, 0xddae
jne 0x409d0d
or dword [0x4c2bfc], 1
lea eax, [ecx + 0x1f]
mov word [0x4be010], ax
add eax, 0xf
mov edx, eax
mov word [0x4be012], dx
lea edx, [ecx + 0x21]
mov word [0x4be014], dx
add edx, 0xe
mov word [0x4be016], dx
lea edx, [ecx + 0x18]
mov word [0x4be018], dx
add edx, 0x2b
mov word [0x4be01a], dx
mov edx, eax
mov word [0x4be01c], dx
lea edx, [ecx + 0x1d]
lea eax, [ecx + 0x2c]
mov word [0x4be01e], dx
mov word [0x4be026], ax
add edx, 0x13
mov eax, ecx
mov word [0x4be020], dx
mov dword [0x4be022], 0xdddcddc1
mov word [0x4be028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4be010]
add eax, 2
mov word [eax + 0x4be606], dx
cmp eax, 0x1a
jb 0x409d0f
mov eax, 0x4be608
ret

Function at 0x409d2d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bf8], 1
jne 0x409d58
or dword [0x4c2bf8], 1
mov dword [0x4be02c], 0xc0dccbc5
mov dword [0x4be030], 0x9c9dc2cb
mov byte [0x4be034], 0xae
xor eax, eax
mov cl, byte [eax + 0x4be02c]
xor cl, 0xae
mov byte [eax + 0x4be624], cl
inc eax
cmp eax, 9
jb 0x409d5a
mov eax, 0x4be624
ret

Function at 0x409d75
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bf4], 1
jne 0x409dde
or dword [0x4c2bf4], 1
mov dword [0x4be038], 0xfedacbfd
mov dword [0x4be03c], 0xcbcdc1dc
mov dword [0x4be040], 0xddfbdddd
mov dword [0x4be044], 0xc1e3dccb
mov dword [0x4be048], 0xd6ebcbca
mov dword [0x4be04c], 0xdadecbcd
mov dword [0x4be050], 0xfec0c1c7
mov dword [0x4be054], 0xcdc7c2c1
mov word [0x4be058], 0xaed7
xor eax, eax
mov cl, byte [eax + 0x4be038]
xor cl, 0xae
mov byte [eax + 0x4be630], cl
inc eax
cmp eax, 0x22
jb 0x409de0
mov eax, 0x4be630
ret

Function at 0x409dfb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bf0], 1
jne 0x409e64
or dword [0x4c2bf0], 1
mov dword [0x4be05c], 0xfedacbe9
mov dword [0x4be060], 0xcbcdc1dc
mov dword [0x4be064], 0xddfbdddd
mov dword [0x4be068], 0xc1e3dccb
mov dword [0x4be06c], 0xd6ebcbca
mov dword [0x4be070], 0xdadecbcd
mov dword [0x4be074], 0xfec0c1c7
mov dword [0x4be078], 0xcdc7c2c1
mov word [0x4be07c], 0xaed7
xor eax, eax
mov cl, byte [eax + 0x4be05c]
xor cl, 0xae
mov byte [eax + 0x4be654], cl
inc eax
cmp eax, 0x22
jb 0x409e66
mov eax, 0x4be654
ret

Function at 0x409e81
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bec], 1
jne 0x409ed7
or dword [0x4c2bec], 1
mov dword [0x4be080], 0x8ecbc2e1
mov dword [0x4be084], 0xdac7c0c7
mov dword [0x4be088], 0xc7c2cfc7
mov dword [0x4be08c], 0xc7dacfd4
mov dword [0x4be090], 0xc88ec0c1
mov dword [0x4be094], 0xcbc2c7cf
mov dword [0x4be098], 0xae8e94ca
xor eax, eax
mov cl, byte [eax + 0x4be080]
xor cl, 0xae
mov byte [eax + 0x4be678], cl
inc eax
cmp eax, 0x1c
jb 0x409ed9
mov eax, 0x4be678
ret
Function at 0x409ef4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2be8], 1
mov ecx, 0xddae
jne 0x409f23
or dword [0x4c2be8], 1
lea eax, [ecx + 0x21]
mov word [0x4be09c], ax
add eax, 0xffffffcd
mov word [0x4be09e], ax
mov eax, ecx
mov word [0x4be0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4be09c]
add eax, 2
mov word [eax + 0x4be692], dx
cmp eax, 6
jb 0x409f25
mov eax, 0x4be694
ret

Function at 0x409f43
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2be0], 1
jne 0x409fb3
or dword [0x4c2be0], 1
mov dword [0x4be0ac], 0xc2c7cfe8
mov dword [0x4be0b0], 0xda8ecacb
mov dword [0x4be0b4], 0xc0c78ec1
mov dword [0x4be0b8], 0xcfc7dac7
mov dword [0x4be0bc], 0xcbd4c7c2
mov dword [0x4be0c0], 0xd8c0cb8e
mov dword [0x4be0c4], 0xc0c1dcc7
mov dword [0x4be0c8], 0xdac0cbc3
mov word [0x4be0cc], 0x8e94
mov byte [0x4be0ce], 0xae
xor eax, eax
mov cl, byte [eax + 0x4be0ac]
xor cl, 0xae
mov byte [eax + 0x4be6a4], cl
inc eax
cmp eax, 0x23
jb 0x409fb5
mov eax, 0x4be6a4
ret

Function at 0x409fd0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bd8], 1
jne 0x40a01b
or dword [0x4c2bd8], 1
mov dword [0x4be0d8], 0xcfc6c0fb
mov dword [0x4be0dc], 0xcbc2cac0
mov dword [0x4be0e0], 0xd6cb8eca
mov dword [0x4be0e4], 0xdadecbcd
mov dword [0x4be0e8], 0x94c0c1c7
mov word [0x4be0ec], 0xae8e
xor eax, eax
mov cl, byte [eax + 0x4be0d8]
xor cl, 0xae
mov byte [eax + 0x4be6d0], cl
inc eax
cmp eax, 0x16
jb 0x40a01d
mov eax, 0x4be6d0
ret

Function at 0x40a038
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bd4], 1
jne 0x40a08b
or dword [0x4c2bd4], 1
mov dword [0x4be0f0], 0xcfc6c0fb
mov dword [0x4be0f4], 0xcbc2cac0
mov dword [0x4be0f8], 0xd6cb8eca
mov dword [0x4be0fc], 0xdadecbcd
mov dword [0x4be100], 0x94c0c1c7
mov dword [0x4be104], 0xa4dd8b8e
mov byte [0x4be108], 0xae
xor eax, eax
mov cl, byte [eax + 0x4be0f0]
xor cl, 0xae
mov byte [eax + 0x4be6e8], cl
inc eax
cmp eax, 0x19
jb 0x40a08d
mov eax, 0x4be6e8
ret

Function at 0x40a0a8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bd0], 1
jne 0x40a0e0
or dword [0x4c2bd0], 1
mov dword [0x4be10c], 0xccdbdafd
mov dword [0x4be110], 0xc7d6cb8e
mov dword [0x4be114], 0x8b868eda
mov dword [0x4be118], 0xaea487ca
xor eax, eax
mov cl, byte [eax + 0x4be10c]
xor cl, 0xae
mov byte [eax + 0x4be704], cl
inc eax
cmp eax, 0x10
jb 0x40a0e2
mov eax, 0x4be704
ret
Function at 0x40bae4
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x48af3d
call fcn.00489c78
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40bbc8
cmp byte [edi + 0x49], bl
je 0x40bbc8
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40bb1b
xor al, al
jmp 0x40bbca
push esi
lea esi, [ebp - 0x2c]
call fcn.0040b5dd
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40bb6b
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x40bb70
dec eax
je 0x40bb74
dec eax
dec eax
je 0x40bbc4
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404d81
mov al, bl
pop esi
jmp 0x40bbca
mov edx, dword [ebp - 0x2c]
jmp 0x40bb35
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40bb80
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x40bba6
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40bb93
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0046576e
add esp, 0x10
cmp esi, eax
jne 0x40bb58
cmp byte [edi + 0x49], 0
je 0x40bbc4
test esi, esi
jne 0x40bb27
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0040b6b6
jmp 0x40bb27
mov bl, 1
jmp 0x40bb5a
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410413
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bcc], 1
jne 0x410487
or dword [0x4c2bcc], 1
mov dword [0x4be724], 0xdcc5dff3
mov dword [0x4be728], 0xdfde90d4
mov dword [0x4be72c], 0xd5d790c4
mov dword [0x4be730], 0xd9d490c4
mov dword [0x4be734], 0xd4d9c0c3
mov dword [0x4be738], 0x90d6df90
mov dword [0x4be73c], 0xd8c4d5dd
mov dword [0x4be740], 0x9790d4df
mov dword [0x4be744], 0xdcdcd1d3
mov dword [0x4be748], 0xb0908a97
xor eax, eax
mov cl, byte [eax + 0x4be724]
xor cl, 0xb0
mov byte [eax + 0x4be868], cl
inc eax
cmp eax, 0x28
jb 0x410489
mov eax, 0x4be868
ret

Function at 0x4104a4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c2bc8], 1
jne 0x41050b
or dword [0x4c2bc8], 1
mov dword [0x4be74c], 0xdcd9d1f6
mov dword [0x4be750], 0xc490d4d5
mov dword [0x4be754], 0xded990df
mov dword [0x4be758], 0xd5dbdfc6
mov dword [0x4be75c], 0xc4d5dd90
mov dword [0x4be760], 0x90d4dfd8
mov dword [0x4be764], 0xdcd1d397
mov dword [0x4be768], 0x908a97dc
mov byte [0x4be76c], 0xb0
xor eax, eax
mov cl, byte [eax + 0x4be74c]
xor cl, 0xb0
mov byte [eax + 0x4be890], cl
inc eax
cmp eax, 0x21
jb 0x41050d
mov eax, 0x4be890
ret