joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3be0], 1
jne 0x407265
or dword [0x4c3be0], 1
mov dword [0x4beaa0], 0x31343c1b
mov dword [0x4beaa4], 0x297d3938
mov dword [0x4beaa8], 0x2b387d32
mov dword [0x4beaac], 0x3c28313c
mov dword [0x4beab0], 0x3f7d3829
mov dword [0x4beab4], 0x2e293232
mov dword [0x4beab8], 0x2d3c2f29
mov dword [0x4beabc], 0x3c2f3b7d
mov dword [0x4beac0], 0x3338303a
mov dword [0x4beac4], 0x2e7d7129
mov dword [0x4beac8], 0x3c293324
mov dword [0x4beacc], 0x2f387d25
mov dword [0x4bead0], 0x5d2f322f
xor eax, eax
mov cl, byte [eax + 0x4beaa0]
xor cl, 0x5d
mov byte [eax + 0x4bf088], cl
inc eax
cmp eax, 0x34
jb 0x407267
mov eax, 0x4bf088
ret

Function at 0x407282
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bdc], 1
jne 0x407318
or dword [0x4c3bdc], 1
mov dword [0x4bead4], 0x31343c1b
mov dword [0x4bead8], 0x297d3938
mov dword [0x4beadc], 0x2b387d32
mov dword [0x4beae0], 0x3c28313c
mov dword [0x4beae4], 0x3f7d3829
mov dword [0x4beae8], 0x2e293232
mov dword [0x4beaec], 0x2d3c2f29
mov dword [0x4beaf0], 0x3c2f3b7d
mov dword [0x4beaf4], 0x3338303a
mov dword [0x4beaf8], 0x307d7129
mov dword [0x4beafc], 0x2f323038
mov dword [0x4beb00], 0x2f387d24
mov dword [0x4beb04], 0x5d2f322f
xor eax, eax
mov cl, byte [eax + 0x4bead4]
xor cl, 0x5d
mov byte [eax + 0x4bf0bc], cl
inc eax
cmp eax, 0x34
jb 0x40731a
mov eax, 0x4bf0bc
ret

Function at 0x407335
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bd8], 1
jne 0x40739c
or dword [0x4c3bd8], 1
mov dword [0x4beb08], 0x33363308
mov dword [0x4beb0c], 0x7d332a32
mov dword [0x4beb10], 0x322f2f38
mov dword [0x4beb14], 0x33347d2f
mov dword [0x4beb18], 0x3c28317d
mov dword [0x4beb1c], 0x32310211
mov dword [0x4beb20], 0x292e393c
mov dword [0x4beb24], 0x3a33342f
mov byte [0x4beb28], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4beb08]
xor cl, 0x5d
mov byte [eax + 0x4bf0f0], cl
inc eax
cmp eax, 0x21
jb 0x40739e
mov eax, 0x4bf0f0
ret

Function at 0x4073b9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bd4], 1
jne 0x4073e3
or dword [0x4c3bd4], 1
mov dword [0x4beb2c], 0x33323361
mov word [0x4beb30], 0x6338
mov byte [0x4beb32], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4beb2c]
xor cl, 0x5d
mov byte [eax + 0x4bf114], cl
inc eax
cmp eax, 7
jb 0x4073e5
mov eax, 0x4bf114
ret

Function at 0x407400
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bd0], 1
jne 0x407442
or dword [0x4c3bd0], 1
mov dword [0x4beb34], 0x7d3c2811
mov dword [0x4beb38], 0x2933282f
mov dword [0x4beb3c], 0x7d383034
mov dword [0x4beb40], 0x322f2f38
mov dword [0x4beb44], 0x5d7d672f
xor eax, eax
mov cl, byte [eax + 0x4beb34]
xor cl, 0x5d
mov byte [eax + 0x4bf11c], cl
inc eax
cmp eax, 0x14
jb 0x407444
mov eax, 0x4bf11c
ret
Function at 0x40745f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bcc], 1
jne 0x4074a7
or dword [0x4c3bcc], 1
mov dword [0x4beb48], 0x7d3c2811
mov dword [0x4beb4c], 0x32303830
mov dword [0x4beb50], 0x387d242f
mov dword [0x4beb54], 0x2f322f2f
mov word [0x4beb58], 0x7d67
mov byte [0x4beb5a], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4beb48]
xor cl, 0x5d
mov byte [eax + 0x4bf130], cl
inc eax
cmp eax, 0x13
jb 0x4074a9
mov eax, 0x4bf130
ret

Function at 0x4074c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bc8], 1
jne 0x40752b
or dword [0x4c3bc8], 1
mov dword [0x4beb5c], 0x7d3c2811
mov dword [0x4beb60], 0x322f2f38
mov dword [0x4beb64], 0x33347d2f
mov dword [0x4beb68], 0x3839342e
mov dword [0x4beb6c], 0x2f2f387d
mov dword [0x4beb70], 0x357d2f32
mov dword [0x4beb74], 0x3139333c
mov dword [0x4beb78], 0x7d672f38
mov byte [0x4beb7c], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4beb5c]
xor cl, 0x5d
mov byte [eax + 0x4bf144], cl
inc eax
cmp eax, 0x21
jb 0x40752d
mov eax, 0x4bf144
ret

Function at 0x407548
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bc4], 1
jne 0x4075a4
or dword [0x4c3bc4], 1
mov dword [0x4beb80], 0x33363308
mov dword [0x4beb84], 0x7d332a32
mov dword [0x4beb88], 0x322f2f38
mov dword [0x4beb8c], 0x33347d2f
mov dword [0x4beb90], 0x3c28317d
mov dword [0x4beb94], 0x3c3e2d02
mov word [0x4beb98], 0x3131
mov byte [0x4beb9a], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4beb80]
xor cl, 0x5d
mov byte [eax + 0x4bf168], cl
inc eax
cmp eax, 0x1b
jb 0x4075a6
mov eax, 0x4bf168
ret

Function at 0x4077e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bc0], 1
jne 0x40782b
or dword [0x4c3bc0], 1
mov dword [0x4beb9c], 0x382e3c1f
mov dword [0x4beba0], 0x397d696b
mov dword [0x4beba4], 0x39323e38
mov dword [0x4beba8], 0x3c3b7d38
mov dword [0x4bebac], 0x39383134
mov byte [0x4bebb0], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4beb9c]
xor cl, 0x5d
mov byte [eax + 0x4bf184], cl
inc eax
cmp eax, 0x15
jb 0x40782d
mov eax, 0x4bf184
ret
Function at 0x407848
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48cbad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0042d613
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0042b9fc
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.00404d4f
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.00409f4a
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x4078d5
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0042fbd1
add esp, 0x10
test al, al
jne 0x40791a
call fcn.00407991
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00464415
push 0x4afcc0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.0046e335
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.00409f4a
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x40795a
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x407939
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.0040937d
lea esi, [esp + 0x20]
call fcn.00409f31
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00404c1e
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407991
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bbc], 1
jne 0x4079da
or dword [0x4c3bbc], 1
mov dword [0x4bebb4], 0x382e3c1f
mov dword [0x4bebb8], 0x397d696b
mov dword [0x4bebbc], 0x39323e38
mov dword [0x4bebc0], 0x3c3b7d38
mov dword [0x4bebc4], 0x39383134
mov byte [0x4bebc8], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bebb4]
xor cl, 0x5d
mov byte [eax + 0x4bf19c], cl
inc eax
cmp eax, 0x15
jb 0x4079dc
mov eax, 0x4bf19c
ret

Function at 0x4080d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bb8], 1
jne 0x40812d
or dword [0x4c3bb8], 1
mov dword [0x4bebcc], 0x3128321e
mov dword [0x4bebd0], 0x32337d39
mov dword [0x4bebd4], 0x2d327d29
mov dword [0x4bebd8], 0x3e7d3338
mov dword [0x4bebdc], 0x352e3c2f
mov dword [0x4bebe0], 0x3028397d
mov word [0x4bebe4], 0x5d2d
xor eax, eax
mov cl, byte [eax + 0x4bebcc]
xor cl, 0x5d
mov byte [eax + 0x4bf1b4], cl
inc eax
cmp eax, 0x1a
jb 0x40812f
mov eax, 0x4bf1b4
ret
Function at 0x40814a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bb0], 1
jne 0x40816d
or dword [0x4c3bb0], 1
mov dword [0x4bebec], 0x3a323172
mov word [0x4bebf0], 0x5d72
xor eax, eax
mov cl, byte [eax + 0x4bebec]
xor cl, 0x5d
mov byte [eax + 0x4bf1d4], cl
inc eax
cmp eax, 6
jb 0x40816f
mov eax, 0x4bf1d4
ret

Function at 0x40818a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3bac], 1
jne 0x408205
or dword [0x4c3bac], 1
mov dword [0x4bebf4], 0x2d292935
mov dword [0x4bebf8], 0x3c727267
mov dword [0x4bebfc], 0x24313c33
mov dword [0x4bec00], 0x2e3e3429
mov dword [0x4bec04], 0x29383a73
mov dword [0x4bec08], 0x332a3239
mov dword [0x4bec0c], 0x292e3829
mov dword [0x4bec10], 0x30323e73
mov dword [0x4bec14], 0x726f2b72
mov dword [0x4bec18], 0x723a3231
mov byte [0x4bec1c], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bebf4]
xor cl, 0x5d
mov byte [eax + 0x4bf1dc], cl
inc eax
cmp eax, 0x29
jb 0x408207
mov eax, 0x4bf1dc
ret

Function at 0x408222
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3ba8], 1
jne 0x40824d
or dword [0x4c3ba8], 1
mov dword [0x4bec20], 0x2e7b603e
mov dword [0x4bec24], 0x60297b60
mov byte [0x4bec28], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bec20]
xor cl, 0x5d
mov byte [eax + 0x4bf208], cl
inc eax
cmp eax, 9
jb 0x40824f
mov eax, 0x4bf208
ret

Function at 0x40826a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b98], 1
jne 0x4082f2
or dword [0x4c3b98], 1
mov dword [0x4bec3c], 0x2933321e
mov dword [0x4bec40], 0x70293338
mov dword [0x4bec44], 0x382d2409
mov dword [0x4bec48], 0x2d3c7d67
mov dword [0x4bec4c], 0x3e34312d
mov dword [0x4bec50], 0x3234293c
mov dword [0x4bec54], 0x70257233
mov dword [0x4bec58], 0x702a2a2a
mov dword [0x4bec5c], 0x302f323b
mov dword [0x4bec60], 0x312f2870
mov dword [0x4bec64], 0x323e3338
mov dword [0x4bec68], 0x5d393839
xor eax, eax
mov cl, byte [eax + 0x4bec3c]
xor cl, 0x5d
mov byte [eax + 0x4bf224], cl
inc eax
cmp eax, 0x30
jb 0x4082f4
mov eax, 0x4bf224
ret

Function at 0x40830f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b94], 1
jne 0x40833a
or dword [0x4c3b94], 1
mov dword [0x4bec6c], 0x90e120d
mov dword [0x4bec70], 0x7d32297d
mov byte [0x4bec74], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bec6c]
xor cl, 0x5d
mov byte [eax + 0x4bf254], cl
inc eax
cmp eax, 9
jb 0x40833c
mov eax, 0x4bf254
ret

Function at 0x408357
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b90], 1
jne 0x4083a0
or dword [0x4c3b90], 1
mov dword [0x4bec78], 0x343c3b7d
mov dword [0x4bec7c], 0x7d393831
mov dword [0x4bec80], 0x3529342a
mov dword [0x4bec84], 0x3c292e7d
mov dword [0x4bec88], 0x7d2e2829
mov byte [0x4bec8c], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bec78]
xor cl, 0x5d
mov byte [eax + 0x4bf260], cl
inc eax
cmp eax, 0x15
jb 0x4083a2
mov eax, 0x4bf260
ret
Function at 0x408e72
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b8c], 1
mov ecx, 0x8d5d
jne 0x408efc
or dword [0x4c3b8c], 1
lea eax, [ecx - 0x1f]
mov word [0x4bec90], ax
add eax, 0xfffffff1
mov edx, eax
mov word [0x4bec92], dx
lea edx, [ecx - 0x21]
mov word [0x4bec94], dx
add edx, 0xfffffff2
mov word [0x4bec96], dx
lea edx, [ecx - 0x28]
mov word [0x4bec98], dx
add edx, 0xffffffcd
mov word [0x4bec9a], dx
mov edx, eax
mov word [0x4bec9c], dx
lea edx, [ecx - 0x25]
lea eax, [ecx - 0x34]
mov word [0x4bec9e], dx
mov word [0x4beca6], ax
add edx, 0xfffffff5
mov eax, ecx
mov word [0x4beca0], dx
mov dword [0x4beca2], 0x8d2f8d32
mov word [0x4beca8], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4bec90]
add eax, 2
mov word [eax + 0x4bf276], dx
cmp eax, 0x1a
jb 0x408efe
mov eax, 0x4bf278
ret

Function at 0x408f1c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b88], 1
jne 0x408f72
or dword [0x4c3b88], 1
mov dword [0x4becac], 0x7d383112
mov dword [0x4becb0], 0x29343334
mov dword [0x4becb4], 0x34313c34
mov dword [0x4becb8], 0x34293c27
mov dword [0x4becbc], 0x3b7d3332
mov dword [0x4becc0], 0x3831343c
mov dword [0x4becc4], 0x5d7d6739
xor eax, eax
mov cl, byte [eax + 0x4becac]
xor cl, 0x5d
mov byte [eax + 0x4bf294], cl
inc eax
cmp eax, 0x1c
jb 0x408f74
mov eax, 0x4bf294
ret

Function at 0x408f8f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b84], 1
jne 0x408fba
or dword [0x4c3b84], 1
mov dword [0x4becc8], 0x332f3836
mov dword [0x4beccc], 0x6f6e3138
mov byte [0x4becd0], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4becc8]
xor cl, 0x5d
mov byte [eax + 0x4bf2b0], cl
inc eax
cmp eax, 9
jb 0x408fbc
mov eax, 0x4bf2b0
ret

Function at 0x408fda
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b80], 1
jne 0x409043
or dword [0x4c3b80], 1
mov dword [0x4becd4], 0xd29380e
mov dword [0x4becd8], 0x383e322f
mov dword [0x4becdc], 0x2e082e2e
mov dword [0x4bece0], 0x32102f38
mov dword [0x4bece4], 0x25183839
mov dword [0x4bece8], 0x292d383e
mov dword [0x4becec], 0xd333234
mov dword [0x4becf0], 0x3e343132
mov word [0x4becf4], 0x5d24
xor eax, eax
mov cl, byte [eax + 0x4becd4]
xor cl, 0x5d
mov byte [eax + 0x4bf2bc], cl
inc eax
cmp eax, 0x22
jb 0x409045
mov eax, 0x4bf2bc
ret

Function at 0x409060
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b7c], 1
jne 0x4090c9
or dword [0x4c3b7c], 1
mov dword [0x4becf8], 0xd29381a
mov dword [0x4becfc], 0x383e322f
mov dword [0x4bed00], 0x2e082e2e
mov dword [0x4bed04], 0x32102f38
mov dword [0x4bed08], 0x25183839
mov dword [0x4bed0c], 0x292d383e
mov dword [0x4bed10], 0xd333234
mov dword [0x4bed14], 0x3e343132
mov word [0x4bed18], 0x5d24
xor eax, eax
mov cl, byte [eax + 0x4becf8]
xor cl, 0x5d
mov byte [eax + 0x4bf2e0], cl
inc eax
cmp eax, 0x22
jb 0x4090cb
mov eax, 0x4bf2e0
ret
Function at 0x4090e6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b78], 1
mov ecx, 0x8d5d
jne 0x409115
or dword [0x4c3b78], 1
lea eax, [ecx - 0x21]
mov word [0x4bed1c], ax
add eax, 0x33
mov word [0x4bed1e], ax
mov eax, ecx
mov word [0x4bed20], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4bed1c]
add eax, 2
mov word [eax + 0x4bf302], dx
cmp eax, 6
jb 0x409117
mov eax, 0x4bf304
ret

Function at 0x409135
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b70], 1
jne 0x4091a5
or dword [0x4c3b70], 1
mov dword [0x4bed2c], 0x31343c1b
mov dword [0x4bed30], 0x297d3938
mov dword [0x4bed34], 0x33347d32
mov dword [0x4bed38], 0x3c342934
mov dword [0x4bed3c], 0x38273431
mov dword [0x4bed40], 0x2b33387d
mov dword [0x4bed44], 0x33322f34
mov dword [0x4bed48], 0x29333830
mov word [0x4bed4c], 0x7d67
mov byte [0x4bed4e], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bed2c]
xor cl, 0x5d
mov byte [eax + 0x4bf314], cl
inc eax
cmp eax, 0x23
jb 0x4091a7
mov eax, 0x4bf314
ret

Function at 0x4091c2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b68], 1
mov ecx, 0x8d5d
jne 0x40920c
or dword [0x4c3b68], 1
lea eax, [ecx - 0x25]
mov word [0x4bed58], ax
add eax, 0xfffffffb
mov word [0x4bed5a], ax
lea eax, [ecx - 0x34]
mov word [0x4bed5c], ax
add eax, 6
mov word [0x4bed5e], ax
lea eax, [ecx - 0x39]
mov word [0x4bed60], ax
mov eax, ecx
mov word [0x4bed62], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4bed58]
add eax, 2
mov word [eax + 0x4bf33e], dx
cmp eax, 0xc
jb 0x40920e
mov eax, 0x4bf340
ret

Function at 0x40922c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b64], 1
jne 0x409277
or dword [0x4c3b64], 1
mov dword [0x4bed64], 0x3c353308
mov dword [0x4bed68], 0x38313933
mov dword [0x4bed6c], 0x25387d39
mov dword [0x4bed70], 0x292d383e
mov dword [0x4bed74], 0x67333234
mov word [0x4bed78], 0x5d7d
xor eax, eax
mov cl, byte [eax + 0x4bed64]
xor cl, 0x5d
mov byte [eax + 0x4bf34c], cl
inc eax
cmp eax, 0x16
jb 0x409279
mov eax, 0x4bf34c
ret

Function at 0x409294
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b60], 1
jne 0x4092e7
or dword [0x4c3b60], 1
mov dword [0x4bed7c], 0x3c353308
mov dword [0x4bed80], 0x38313933
mov dword [0x4bed84], 0x25387d39
mov dword [0x4bed88], 0x292d383e
mov dword [0x4bed8c], 0x67333234
mov dword [0x4bed90], 0x572e787d
mov byte [0x4bed94], 0x5d
xor eax, eax
mov cl, byte [eax + 0x4bed7c]
xor cl, 0x5d
mov byte [eax + 0x4bf364], cl
inc eax
cmp eax, 0x19
jb 0x4092e9
mov eax, 0x4bf364
ret

Function at 0x409304
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b5c], 1
jne 0x40933c
or dword [0x4c3b5c], 1
mov dword [0x4bed98], 0x3f28290e
mov dword [0x4bed9c], 0x3425387d
mov dword [0x4beda0], 0x78757d29
mov dword [0x4beda4], 0x5d577439
xor eax, eax
mov cl, byte [eax + 0x4bed98]
xor cl, 0x5d
mov byte [eax + 0x4bf380], cl
inc eax
cmp eax, 0x10
jb 0x40933e
mov eax, 0x4bf380
ret
Function at 0x40b00d
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x48b5a2
call fcn.0048a6f8
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40b0f2
cmp byte [edi + 0x49], bl
je 0x40b0f2
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40b044
xor al, al
jmp 0x40b0f4
push esi
lea esi, [ebp - 0x2c]
call fcn.0040aa76
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40b094
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x40b099
dec eax
je 0x40b09d
dec eax
dec eax
je 0x40b0ee
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404c1e
mov al, bl
pop esi
jmp 0x40b0f4
mov edx, dword [ebp - 0x2c]
jmp 0x40b05e
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40b0a9
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x40b0cf
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40b0bc
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0046632f
add esp, 0x10
cmp esi, eax
jne 0x40b081
cmp byte [edi + 0x49], 0
je 0x40b0ee
test esi, esi
jne 0x40b050
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.0040ab4f
jmp 0x40b050
mov bl, 1
jmp 0x40b083
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4101e5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b58], 1
jne 0x410259
or dword [0x4c3b58], 1
mov dword [0x4bf3a0], 0x9c859fb3
mov dword [0x4bf3a4], 0x9f9ed094
mov dword [0x4bf3a8], 0x9597d084
mov dword [0x4bf3ac], 0x9994d084
mov dword [0x4bf3b0], 0x94998083
mov dword [0x4bf3b4], 0xd0969fd0
mov dword [0x4bf3b8], 0x9884959d
mov dword [0x4bf3bc], 0xd7d0949f
mov dword [0x4bf3c0], 0x9c9c9193
mov dword [0x4bf3c4], 0xf0d0cad7
xor eax, eax
mov cl, byte [eax + 0x4bf3a0]
xor cl, 0xf0
mov byte [eax + 0x4bf4e4], cl
inc eax
cmp eax, 0x28
jb 0x41025b
mov eax, 0x4bf4e4
ret

Function at 0x410276
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b54], 1
jne 0x4102dd
or dword [0x4c3b54], 1
mov dword [0x4bf3c8], 0x9c9991b6
mov dword [0x4bf3cc], 0x84d09495
mov dword [0x4bf3d0], 0x9e99d09f
mov dword [0x4bf3d4], 0x959b9f86
mov dword [0x4bf3d8], 0x84959dd0
mov dword [0x4bf3dc], 0xd0949f98
mov dword [0x4bf3e0], 0x9c9193d7
mov dword [0x4bf3e4], 0xd0cad79c
mov byte [0x4bf3e8], 0xf0
xor eax, eax
mov cl, byte [eax + 0x4bf3c8]
xor cl, 0xf0
mov byte [eax + 0x4bf50c], cl
inc eax
cmp eax, 0x21
jb 0x4102df
mov eax, 0x4bf50c
ret
Function at 0x4102fa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b50], 1
jne 0x41035a
or dword [0x4c3b50], 1
mov dword [0x4bf3ec], 0x9f82a0fa
mov dword [0x4bf3f0], 0x9c929192
mov dword [0x4bf3f4], 0x8594d089
mov dword [0x4bf3f8], 0x9f84d095
mov dword [0x4bf3fc], 0x829383d0
mov dword [0x4bf400], 0xd0848099
mov dword [0x4bf404], 0x9f828295
mov dword [0x4bf408], 0xf0d0ca82
xor eax, eax
mov cl, byte [eax + 0x4bf3ec]
xor cl, 0xf0
mov byte [eax + 0x4bf530], cl
inc eax
cmp eax, 0x20
jb 0x41035c
mov eax, 0x4bf530
ret

Function at 0x410932
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x410a76
mov ebx, ecx
push 4
sub ebx, edi
pop esi
test byte [0x4c3b4c], 1
jne 0x410993
or dword [0x4c3b4c], 1
mov eax, 0x8983
mov word [0x4bf40c], ax
add eax, 0x12
mov word [0x4bf40e], ax
mov eax, 0x899e
mov word [0x4bf410], ax
add eax, 0xfffffff6
mov word [0x4bf412], ax
mov eax, 0x89f0
mov word [0x4bf414], ax
xor eax, eax
mov ecx, 0x89f0
xor cx, word [eax + 0x4bf40c]
add eax, 2
mov word [eax + 0x4bf54e], cx
cmp eax, 0xa
jb 0x410995
mov eax, dword [ebx + edi]
mov ecx, 0x4bf550
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4109dc
test dx, dx
je 0x4109d8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4109dc
add eax, esi
add ecx, esi
test dx, dx
jne 0x4109b8
xor eax, eax
jmp 0x4109e1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4109ed
mov dword [edi], 0x385
jmp 0x410a65
call fcn.00410a86
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x410a19
test dx, dx
je 0x410a15
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x410a19
add ecx, esi
add eax, esi
test dx, dx
jne 0x4109f5
xor eax, eax
jmp 0x410a1e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410a2a
mov dword [edi], 0x386
jmp 0x410a65
call fcn.00410b59
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x410a56
test dx, dx
je 0x410a52
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x410a56
add ecx, esi
add eax, esi
test dx, dx
jne 0x410a32
xor eax, eax
jmp 0x410a5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410a7f
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 8]
jb 0x410950
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, 0x80020006
jmp 0x410a78
Function at 0x410a86
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b48], 1
jne 0x410b36
or dword [0x4c3b48], 1
mov eax, 0x8991
mov word [0x4bf418], ax
add eax, 3
mov ecx, eax
mov word [0x4bf41c], ax
mov eax, 0x89b5
mov word [0x4bf41e], ax
add eax, 0xffffffd1
mov word [0x4bf420], ax
mov eax, 0x8995
mov word [0x4bf41a], cx
mov ecx, eax
lea edx, [eax + 9]
mov word [0x4bf422], cx
mov ecx, edx
push edi
mov word [0x4bf424], cx
add ecx, 0xffffffe6
mov edi, ecx
mov word [0x4bf426], di
lea edi, [eax + 0x27]
mov word [0x4bf428], di
add edi, 0xffffffdd
mov ecx, eax
add eax, 0xffffffed
mov word [0x4bf436], ax
lea eax, [ecx + 0x5b]
mov word [0x4bf42a], di
mov dword [0x4bf42c], 0x89848983
mov word [0x4bf430], cx
mov dword [0x4bf432], 0x8995899e
mov word [0x4bf438], ax
pop edi
xor eax, eax
mov ecx, 0x89f0
xor cx, word [eax + 0x4bf418]
add eax, 2
mov word [eax + 0x4bf55a], cx
cmp eax, 0x22
jb 0x410b38
mov eax, 0x4bf55c
ret

Function at 0x410b59
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b44], 1
mov ecx, 0x89f0
jne 0x410bb3
or dword [0x4c3b44], 1
lea eax, [ecx - 0x6a]
mov word [0x4bf43c], ax
add eax, 0xf
mov word [0x4bf43e], ax
lea eax, [ecx - 0x6e]
mov word [0x4bf440], ax
inc eax
mov word [0x4bf442], ax
lea eax, [ecx - 0x57]
mov word [0x4bf444], ax
add eax, 6
mov word [0x4bf446], ax
lea eax, [ecx - 0x52]
mov word [0x4bf448], ax
mov eax, ecx
mov word [0x4bf44a], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4bf43c]
add eax, 2
mov word [eax + 0x4bf57e], dx
cmp eax, 0x10
jb 0x410bb5
mov eax, 0x4bf580
ret

Function at 0x411571
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b40], 1
mov edx, 0x89f0
jne 0x4115d4
or dword [0x4c3b40], 1
lea ecx, [edx - 0x5b]
mov eax, ecx
mov word [0x4bf44c], ax
add eax, 0xffffffed
push esi
mov esi, eax
lea eax, [edx - 0x34]
mov word [0x4bf456], ax
add eax, 0xffffffdd
mov word [0x4bf458], ax
mov eax, edx
mov word [0x4bf44e], si
mov word [0x4bf450], si
mov dword [0x4bf452], 0x8982899f
mov dword [0x4bf45a], 0x8995899e
mov word [0x4bf45e], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4bf44c]
add eax, 2
mov word [eax + 0x4bf58e], cx
cmp eax, 0x14
jb 0x4115d6
mov eax, 0x4bf590
ret

Function at 0x4115f4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c3b3c], 1
jne 0x411690
or dword [0x4c3b3c], 1
mov edx, 0x8995
mov eax, edx
mov word [0x4bf460], ax
add eax, 0xffffffed
mov ecx, eax
mov word [0x4bf462], cx
mov word [0x4bf464], cx
lea ecx, [edx + 0xa]
mov word [0x4bf466], cx
mov ecx, eax
mov word [0x4bf468], cx
lea ecx, [edx + 0x1e]
mov word [0x4bf46a], cx
add ecx, 0xffffffe5
mov word [0x4bf46c], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x4bf46e], di
mov edi, eax
mov word [0x4bf472], cx
mov word [0x4bf47a], ax
add ecx, 2
lea eax, [edx + 0x5b]
mov word [0x4bf470], di
mov word [0x4bf474], cx
mov dword [0x4bf476], 0x89958984
mov word [0x4bf47c], ax
pop edi
xor eax, eax
mov ecx, 0x89f0
xor cx, word [eax + 0x4bf460]
add eax, 2
mov word [eax + 0x4bf5a2], cx
cmp eax, 0x1e
jb 0x411692
mov eax, 0x4bf5a4
ret