joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424380
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7e20], 1
jne 0x4243e7
or dword [0x4c7e20], 1
mov dword [0x4c5e98], 0x6d626c69
mov dword [0x4c5e9c], 0x60767071
mov dword [0x4c5ea0], 0x71646177
mov dword [0x4c5ea4], 0x60765a64
mov dword [0x4c5ea8], 0x64735a71
mov dword [0x4c5eac], 0x6b646c77
mov dword [0x4c5eb0], 0x706b5a71
mov dword [0x4c5eb4], 0x77606768
mov byte [0x4c5eb8], 5
xor eax, eax
mov cl, byte [eax + 0x4c5e98]
xor cl, 5
mov byte [eax + 0x4c6070], cl
inc eax
cmp eax, 0x21
jb 0x4243e9
mov eax, 0x4c6070
ret

Function at 0x424404
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7e1c], 1
jne 0x42446d
or dword [0x4c7e1c], 1
mov dword [0x4c5ebc], 0x6d626c69
mov dword [0x4c5ec0], 0x60767071
mov dword [0x4c5ec4], 0x71646177
mov dword [0x4c5ec8], 0x60765a64
mov dword [0x4c5ecc], 0x64735a71
mov dword [0x4c5ed0], 0x6b646c77
mov dword [0x4c5ed4], 0x6a675a71
mov dword [0x4c5ed8], 0x6460696a
mov word [0x4c5edc], 0x56b
xor eax, eax
mov cl, byte [eax + 0x4c5ebc]
xor cl, 5
mov byte [eax + 0x4c6094], cl
inc eax
cmp eax, 0x22
jb 0x42446f
mov eax, 0x4c6094
ret

Function at 0x42448a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7e18], 1
jne 0x4244f0
or dword [0x4c7e18], 1
mov dword [0x4c5ee0], 0x6d626c69
mov dword [0x4c5ee4], 0x60767071
mov dword [0x4c5ee8], 0x71646177
mov dword [0x4c5eec], 0x60765a64
mov dword [0x4c5ef0], 0x64735a71
mov dword [0x4c5ef4], 0x6b646c77
mov dword [0x4c5ef8], 0x706b5a71
mov word [0x4c5efc], 0x6969
mov byte [0x4c5efe], 5
xor eax, eax
mov cl, byte [eax + 0x4c5ee0]
xor cl, 5
mov byte [eax + 0x4c60b8], cl
inc eax
cmp eax, 0x1f
jb 0x4244f2
mov eax, 0x4c60b8
ret

Function at 0x424782
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48db0b
call fcn.0048cc68
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x4960a8]
test byte [0x4c7df8], 1
mov edi, eax
jne 0x4247cf
or dword [0x4c7df8], 1
mov dword [0x4c6154], 0x6067607e
mov dword [0x4c6158], 0x277d6c67
mov dword [0x4c615c], 0x965656d
xor ecx, ecx
mov al, byte [ecx + 0x4c6154]
xor al, 9
mov byte [ecx + 0x4c640c], al
inc ecx
cmp ecx, 0xc
jb 0x4247d1
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x4c640c
call dword [0x4960dc]
push eax
push 0x1b00
call dword [0x496134]
test eax, eax
jne 0x42481d
call fcn.00424893
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040ed3a
pop ecx
pop ecx
jmp 0x424882
test byte [0x4c7df0], 1
jne 0x42483d
or dword [0x4c7df0], 1
mov word [0x4c617c], 0x2933
mov byte [0x4c617e], 9
xor eax, eax
mov cl, byte [eax + 0x4c617c]
xor cl, 9
mov byte [eax + 0x4c6434], cl
inc eax
cmp eax, 3
jb 0x42483f
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x4c6434
push eax
call fcn.0040ed3a
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0040f0ed
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404dee
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x424893
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7df4], 1
jne 0x4248e8
or dword [0x4c7df4], 1
mov dword [0x4c6160], 0x684f2129
mov dword [0x4c6164], 0x6d6c6560
mov dword [0x4c6168], 0x29667d29
mov dword [0x4c616c], 0x647b666f
mov dword [0x4c6170], 0x6c297d68
mov dword [0x4c6174], 0x7b667b7b
mov word [0x4c6178], 0x920
xor eax, eax
mov cl, byte [eax + 0x4c6160]
xor cl, 9
mov byte [eax + 0x4c6418], cl
inc eax
cmp eax, 0x1a
jb 0x4248ea
mov eax, 0x4c6418
ret

Function at 0x424a53
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dec], 1
jne 0x424a9c
or dword [0x4c7dec], 1
mov dword [0x4c6180], 0x4167605e
mov dword [0x4c6184], 0x46797d7d
mov dword [0x4c6188], 0x21676c79
mov dword [0x4c618c], 0x686f2920
mov dword [0x4c6190], 0x6d6c6560
mov byte [0x4c6194], 9
xor eax, eax
mov cl, byte [eax + 0x4c6180]
xor cl, 9
mov byte [eax + 0x4c6438], cl
inc eax
cmp eax, 0x15
jb 0x424a9e
mov eax, 0x4c6438
ret

Function at 0x424d63
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7de8], 1
jne 0x424db6
or dword [0x4c7de8], 1
mov dword [0x4c6198], 0x4167605e
mov dword [0x4c619c], 0x4a797d7d
mov dword [0x4c61a0], 0x626a687b
mov dword [0x4c61a4], 0x21657b5c
mov dword [0x4c61a8], 0x686f2920
mov dword [0x4c61ac], 0x6d6c6560
mov byte [0x4c61b0], 9
xor eax, eax
mov cl, byte [eax + 0x4c6198]
xor cl, 9
mov byte [eax + 0x4c6450], cl
inc eax
cmp eax, 0x19
jb 0x424db8
mov eax, 0x4c6450
ret

Function at 0x424dd3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7de4], 1
jne 0x424e1f
or dword [0x4c7de4], 1
mov dword [0x4c61b4], 0x4167605e
mov dword [0x4c61b8], 0x4a797d7d
mov dword [0x4c61bc], 0x6c676766
mov dword [0x4c61c0], 0x20217d6a
mov dword [0x4c61c4], 0x60686f29
mov dword [0x4c61c8], 0x96d6c65
xor eax, eax
mov cl, byte [eax + 0x4c61b4]
xor cl, 9
mov byte [eax + 0x4c646c], cl
inc eax
cmp eax, 0x18
jb 0x424e21
mov eax, 0x4c646c
ret

Function at 0x425778
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7de0], 1
jne 0x425851
or dword [0x4c7de0], 1
mov dword [0x4c61d0], 0x7c786c5b
mov dword [0x4c61d4], 0x297d7a6c
mov dword [0x4c61d8], 0x29657b7c
mov dword [0x4c61dc], 0x6d6c7a7c
mov dword [0x4c61e0], 0x6d296829
mov dword [0x4c61e4], 0x6c6f6f60
mov dword [0x4c61e8], 0x7d676c7b
mov dword [0x4c61ec], 0x616a7a29
mov dword [0x4c61f0], 0x296c646c
mov dword [0x4c61f4], 0x6768617d
mov dword [0x4c61f8], 0x6c617d29
mov dword [0x4c61fc], 0x67666a29
mov dword [0x4c6200], 0x7d6a6c67
mov dword [0x4c6204], 0x29676660
mov dword [0x4c6208], 0x297a687e
mov dword [0x4c620c], 0x7d606760
mov dword [0x4c6210], 0x60656860
mov dword [0x4c6214], 0x296d6c73
mov dword [0x4c6218], 0x617d607e
mov byte [0x4c621c], 9
xor eax, eax
mov cl, byte [eax + 0x4c61d0]
xor cl, 9
mov byte [eax + 0x4c6488], cl
inc eax
cmp eax, 0x4d
jb 0x425853
mov eax, 0x4c6488
ret
Function at 0x42586e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7ddc], 1
jne 0x42594a
or dword [0x4c7ddc], 1
mov dword [0x4c6220], 0x7c786c5b
mov dword [0x4c6224], 0x297d7a6c
mov dword [0x4c6228], 0x29657b7c
mov dword [0x4c622c], 0x6d6c7a7c
mov dword [0x4c6230], 0x6d296829
mov dword [0x4c6234], 0x6c6f6f60
mov dword [0x4c6238], 0x7d676c7b
mov dword [0x4c623c], 0x7a666129
mov dword [0x4c6240], 0x6867297d
mov dword [0x4c6244], 0x7d296c64
mov dword [0x4c6248], 0x29676861
mov dword [0x4c624c], 0x296c617d
mov dword [0x4c6250], 0x6767666a
mov dword [0x4c6254], 0x607d6a6c
mov dword [0x4c6258], 0x7e296766
mov dword [0x4c625c], 0x60297a68
mov dword [0x4c6260], 0x607d6067
mov dword [0x4c6264], 0x73606568
mov dword [0x4c6268], 0x7e296d6c
mov dword [0x4c626c], 0x9617d60
xor eax, eax
mov cl, byte [eax + 0x4c6220]
xor cl, 9
mov byte [eax + 0x4c64d8], cl
inc eax
cmp eax, 0x50
jb 0x42594c
mov eax, 0x4c64d8
ret

Function at 0x425967
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dd8], 1
jne 0x425a3f
or dword [0x4c7dd8], 1
mov dword [0x4c6270], 0x7c786c5b
mov dword [0x4c6274], 0x297d7a6c
mov dword [0x4c6278], 0x29657b7c
mov dword [0x4c627c], 0x6d6c7a7c
mov dword [0x4c6280], 0x6d296829
mov dword [0x4c6284], 0x6c6f6f60
mov dword [0x4c6288], 0x7d676c7b
mov dword [0x4c628c], 0x7b667929
mov dword [0x4c6290], 0x617d297d
mov dword [0x4c6294], 0x7d296768
mov dword [0x4c6298], 0x6a296c61
mov dword [0x4c629c], 0x6c676766
mov dword [0x4c62a0], 0x66607d6a
mov dword [0x4c62a4], 0x687e2967
mov dword [0x4c62a8], 0x6760297a
mov dword [0x4c62ac], 0x68607d60
mov dword [0x4c62b0], 0x6c736065
mov dword [0x4c62b4], 0x607e296d
mov word [0x4c62b8], 0x617d
mov byte [0x4c62ba], 9
xor eax, eax
mov cl, byte [eax + 0x4c6270]
xor cl, 9
mov byte [eax + 0x4c6528], cl
inc eax
cmp eax, 0x4b
jb 0x425a41
mov eax, 0x4c6528
ret

Function at 0x425a5c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dd4], 1
jne 0x425ab2
or dword [0x4c7dd4], 1
mov dword [0x4c62bc], 0x4167605e
mov dword [0x4c62c0], 0x46797d7d
mov dword [0x4c62c4], 0x5b676c79
mov dword [0x4c62c8], 0x6c7c786c
mov dword [0x4c62cc], 0x20217d7a
mov dword [0x4c62d0], 0x60686f29
mov dword [0x4c62d4], 0x96d6c65
xor eax, eax
mov cl, byte [eax + 0x4c62bc]
xor cl, 9
mov byte [eax + 0x4c6574], cl
inc eax
cmp eax, 0x1c
jb 0x425ab4
mov eax, 0x4c6574
ret
Function at 0x425acf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dd0], 1
jne 0x425b9e
or dword [0x4c7dd0], 1
mov dword [0x4c62d8], 0x4167605e
mov dword [0x4c62dc], 0x5a797d7d
mov dword [0x4c62e0], 0x79467d6c
mov dword [0x4c62e4], 0x6766607d
mov dword [0x4c62e8], 0x47405e21
mov dword [0x4c62ec], 0x595d5d41
mov dword [0x4c62f0], 0x5d594656
mov dword [0x4c62f4], 0x56474640
mov dword [0x4c62f8], 0x5c4a4c5a
mov dword [0x4c62fc], 0x505d405b
mov dword [0x4c6300], 0x48454f56
mov dword [0x4c6304], 0x29205a4e
mov dword [0x4c6308], 0x7b296766
mov dword [0x4c630c], 0x6c7c786c
mov dword [0x4c6310], 0x61297d7a
mov dword [0x4c6314], 0x656d6768
mov dword [0x4c6318], 0x686f296c
mov dword [0x4c631c], 0x6d6c6560
mov byte [0x4c6320], 9
xor eax, eax
mov cl, byte [eax + 0x4c62d8]
xor cl, 9
mov byte [eax + 0x4c6590], cl
inc eax
cmp eax, 0x49
jb 0x425ba0
mov eax, 0x4c6590
ret

Function at 0x425bbb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dcc], 1
jne 0x425c89
or dword [0x4c7dcc], 1
mov dword [0x4c6328], 0x4167605e
mov dword [0x4c632c], 0x5a797d7d
mov dword [0x4c6330], 0x79467d6c
mov dword [0x4c6334], 0x6766607d
mov dword [0x4c6338], 0x47405e21
mov dword [0x4c633c], 0x595d5d41
mov dword [0x4c6340], 0x5d594656
mov dword [0x4c6344], 0x56474640
mov dword [0x4c6348], 0x4d474c5a
mov dword [0x4c634c], 0x44405d56
mov dword [0x4c6350], 0x5d5c464c
mov dword [0x4c6354], 0x67662920
mov dword [0x4c6358], 0x786c7b29
mov dword [0x4c635c], 0x7d7a6c7c
mov dword [0x4c6360], 0x67686129
mov dword [0x4c6364], 0x296c656d
mov dword [0x4c6368], 0x6560686f
mov word [0x4c636c], 0x6d6c
mov byte [0x4c636e], 9
xor eax, eax
mov cl, byte [eax + 0x4c6328]
xor cl, 9
mov byte [eax + 0x4c65e0], cl
inc eax
cmp eax, 0x47
jb 0x425c8b
mov eax, 0x4c65e0
ret

Function at 0x425ca6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dc8], 1
jne 0x425d0f
or dword [0x4c7dc8], 1
mov dword [0x4c6370], 0x4167605e
mov dword [0x4c6374], 0x48797d7d
mov dword [0x4c6378], 0x6c5b6d6d
mov dword [0x4c637c], 0x7a6c7c78
mov dword [0x4c6380], 0x686c417d
mov dword [0x4c6384], 0x7a7b6c6d
mov dword [0x4c6388], 0x6f292021
mov dword [0x4c638c], 0x6c656068
mov word [0x4c6390], 0x96d
xor eax, eax
mov cl, byte [eax + 0x4c6370]
xor cl, 9
mov byte [eax + 0x4c6628], cl
inc eax
cmp eax, 0x22
jb 0x425d11
mov eax, 0x4c6628
ret

Function at 0x425d2c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dc4], 1
jne 0x425d7f
or dword [0x4c7dc4], 1
mov dword [0x4c6394], 0x797d7d41
mov dword [0x4c6398], 0x6d676c5a
mov dword [0x4c639c], 0x7c786c5b
mov dword [0x4c63a0], 0x217d7a6c
mov dword [0x4c63a4], 0x686f2920
mov dword [0x4c63a8], 0x6d6c6560
mov byte [0x4c63ac], 9
xor eax, eax
mov cl, byte [eax + 0x4c6394]
xor cl, 9
mov byte [eax + 0x4c664c], cl
inc eax
cmp eax, 0x19
jb 0x425d81
mov eax, 0x4c664c
ret
Function at 0x425d9c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7dc0], 1
jne 0x425dee
or dword [0x4c7dc0], 1
mov dword [0x4c63b0], 0x797d7d41
mov dword [0x4c63b4], 0x7b6c7c58
mov dword [0x4c63b8], 0x6f674070
mov dword [0x4c63bc], 0x29202166
mov dword [0x4c63c0], 0x6560686f
mov word [0x4c63c4], 0x6d6c
mov byte [0x4c63c6], 9
xor eax, eax
mov cl, byte [eax + 0x4c63b0]
xor cl, 9
mov byte [eax + 0x4c6668], cl
inc eax
cmp eax, 0x17
jb 0x425df0
mov eax, 0x4c6668
ret
Function at 0x4265d5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7db8], 1
jne 0x426645
or dword [0x4c7db8], 1
mov dword [0x4c63cc], 0x4167605e
mov dword [0x4c63d0], 0x58797d7d
mov dword [0x4c63d4], 0x707b6c7c
mov dword [0x4c63d8], 0x687d684d
mov dword [0x4c63dc], 0x60687f48
mov dword [0x4c63e0], 0x656b6865
mov dword [0x4c63e4], 0x2920216c
mov dword [0x4c63e8], 0x6560686f
mov word [0x4c63ec], 0x6d6c
mov byte [0x4c63ee], 9
xor eax, eax
mov cl, byte [eax + 0x4c63cc]
xor cl, 9
mov byte [eax + 0x4c6684], cl
inc eax
cmp eax, 0x23
jb 0x426647
mov eax, 0x4c6684
ret

Function at 0x426662
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7db4], 1
jne 0x4266b7
or dword [0x4c7db4], 1
mov dword [0x4c63f0], 0x6c7d6740
mov dword [0x4c63f4], 0x7d6c677b
mov dword [0x4c63f8], 0x6d686c5b
mov dword [0x4c63fc], 0x6c65604f
mov dword [0x4c6400], 0x6f292021
mov dword [0x4c6404], 0x6c656068
mov word [0x4c6408], 0x96d
xor eax, eax
mov cl, byte [eax + 0x4c63f0]
xor cl, 9
mov byte [eax + 0x4c66a8], cl
inc eax
cmp eax, 0x1a
jb 0x4266b9
mov eax, 0x4c66a8
ret

Function at 0x42746e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d98], 1
jne 0x4274f5
or dword [0x4c7d98], 1
mov dword [0x4c66e0], 0x7e2b654a
mov dword [0x4c66e4], 0x686e7965
mov dword [0x4c66e8], 0x62656c64
mov dword [0x4c66ec], 0x2b6f6e71
mov dword [0x4c66f0], 0x6e60647f
mov dword [0x4c66f4], 0x6a7c2b65
mov dword [0x4c66f8], 0x646d2b78
mov dword [0x4c66fc], 0x2b6f657e
mov dword [0x4c6700], 0x682b7f6a
mov dword [0x4c6704], 0x6a796a63
mov dword [0x4c6708], 0x796e7f68
mov word [0x4c670c], 0xb2b
xor eax, eax
mov cl, byte [eax + 0x4c66e0]
xor cl, 0xb
mov byte [eax + 0x4c6830], cl
inc eax
cmp eax, 0x2e
jb 0x4274f7
mov eax, 0x4c6830
ret
Function at 0x42793b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d94], 1
jne 0x427997
or dword [0x4c7d94], 1
mov dword [0x4c6710], 0x78786246
mov dword [0x4c6714], 0x2b6c6562
mov dword [0x4c6718], 0x6e672b6a
mov dword [0x4c671c], 0x7b2b7f6d
mov dword [0x4c6720], 0x656e796a
mov dword [0x4c6724], 0x786e637f
mov word [0x4c6728], 0x7862
mov byte [0x4c672a], 0xb
xor eax, eax
mov cl, byte [eax + 0x4c6710]
xor cl, 0xb
mov byte [eax + 0x4c6860], cl
inc eax
cmp eax, 0x1b
jb 0x427999
mov eax, 0x4c6860
ret

Function at 0x4279b4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d90], 1
jne 0x427a1d
or dword [0x4c7d90], 1
mov dword [0x4c672c], 0x2b7f6445
mov dword [0x4c6730], 0x7e64656e
mov dword [0x4c6734], 0x642b636c
mov dword [0x4c6738], 0x6a796e7b
mov dword [0x4c673c], 0x2b786f65
mov dword [0x4c6740], 0x6e2b6562
mov dword [0x4c6744], 0x6e797b73
mov dword [0x4c6748], 0x64627878
mov word [0x4c674c], 0xb65
xor eax, eax
mov cl, byte [eax + 0x4c672c]
xor cl, 0xb
mov byte [eax + 0x4c687c], cl
inc eax
cmp eax, 0x22
jb 0x427a1f
mov eax, 0x4c687c
ret

Function at 0x427a3a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d8c], 1
jne 0x427a9a
or dword [0x4c7d8c], 1
mov dword [0x4c6750], 0x2b64645f
mov dword [0x4c6754], 0x72656a66
mov dword [0x4c6758], 0x6e7b642b
mov dword [0x4c675c], 0x6f656a79
mov dword [0x4c6760], 0x65622b78
mov dword [0x4c6764], 0x7b736e2b
mov dword [0x4c6768], 0x78786e79
mov dword [0x4c676c], 0xb656462
xor eax, eax
mov cl, byte [eax + 0x4c6750]
xor cl, 0xb
mov byte [eax + 0x4c68a0], cl
inc eax
cmp eax, 0x20
jb 0x427a9c
mov eax, 0x4c68a0
ret

Function at 0x427ab7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d88], 1
jne 0x427b0d
or dword [0x4c7d88], 1
mov dword [0x4c6770], 0x78786246
mov dword [0x4c6774], 0x2b6c6562
mov dword [0x4c6778], 0x62792b6a
mov dword [0x4c677c], 0x2b7f636c
mov dword [0x4c6780], 0x6e796a7b
mov dword [0x4c6784], 0x6e637f65
mov dword [0x4c6788], 0xb786278
xor eax, eax
mov cl, byte [eax + 0x4c6770]
xor cl, 0xb
mov byte [eax + 0x4c68c0], cl
inc eax
cmp eax, 0x1c
jb 0x427b0f
mov eax, 0x4c68c0
ret

Function at 0x427b2a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d84], 1
jne 0x427b9b
or dword [0x4c7d84], 1
mov dword [0x4c678c], 0x796a655e
mov dword [0x4c6790], 0x7b642b72
mov dword [0x4c6794], 0x7f6a796e
mov dword [0x4c6798], 0x662b7964
mov dword [0x4c679c], 0x2b7f787e
mov dword [0x4c67a0], 0x6e7d6a63
mov dword [0x4c67a4], 0x6e65642b
mov dword [0x4c67a8], 0x6e7b642b
mov dword [0x4c67ac], 0x6f656a79
mov byte [0x4c67b0], 0xb
xor eax, eax
mov cl, byte [eax + 0x4c678c]
xor cl, 0xb
mov byte [eax + 0x4c68dc], cl
inc eax
cmp eax, 0x25
jb 0x427b9d
mov eax, 0x4c68dc
ret
Function at 0x427bb8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d80], 1
jne 0x427c32
or dword [0x4c7d80], 1
mov dword [0x4c67b4], 0x6a656249
mov dword [0x4c67b8], 0x642b7279
mov dword [0x4c67bc], 0x6a796e7b
mov dword [0x4c67c0], 0x2b79647f
mov dword [0x4c67c4], 0x7f787e66
mov dword [0x4c67c8], 0x7d6a632b
mov dword [0x4c67cc], 0x7c7f2b6e
mov dword [0x4c67d0], 0x7b642b64
mov dword [0x4c67d4], 0x656a796e
mov word [0x4c67d8], 0x786f
mov byte [0x4c67da], 0xb
xor eax, eax
mov cl, byte [eax + 0x4c67b4]
xor cl, 0xb
mov byte [eax + 0x4c6904], cl
inc eax
cmp eax, 0x27
jb 0x427c34
mov eax, 0x4c6904
ret

Function at 0x427c4f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d7c], 1
jne 0x427cb8
or dword [0x4c7d7c], 1
mov dword [0x4c67dc], 0x6a656249
mov dword [0x4c67e0], 0x642b7279
mov dword [0x4c67e4], 0x6a796e7b
mov dword [0x4c67e8], 0x2b79647f
mov dword [0x4c67ec], 0x2b7f6465
mov dword [0x4c67f0], 0x677b6662
mov dword [0x4c67f4], 0x656e666e
mov dword [0x4c67f8], 0x316f6e7f
mov word [0x4c67fc], 0xb2b
xor eax, eax
mov cl, byte [eax + 0x4c67dc]
xor cl, 0xb
mov byte [eax + 0x4c692c], cl
inc eax
cmp eax, 0x22
jb 0x427cba
mov eax, 0x4c692c
ret

Function at 0x428c39
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d6c], 1
mov edx, 0xd20e
jne 0x428ccb
or dword [0x4c7d6c], 1
lea ecx, [edx + 0x1d]
push esi
mov eax, ecx
mov word [0x4c698c], ax
add eax, 0x32
mov esi, eax
mov word [0x4c698e], si
lea eax, [edx + 0x4c]
mov word [0x4c6994], ax
add eax, 0xfffffff1
mov esi, eax
mov word [0x4c6996], si
lea esi, [edx + 0x35]
mov word [0x4c6998], si
add esi, 7
mov word [0x4c699a], si
lea esi, [edx + 0x4e]
mov word [0x4c699c], si
add esi, 0xffffffeb
mov eax, edx
mov word [0x4c699e], si
mov dword [0x4c6990], 0xd25dd257
mov dword [0x4c69a0], 0xd24bd258
mov word [0x4c69a4], cx
mov word [0x4c69a6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4c698c]
add eax, 2
mov word [eax + 0x4c6a46], cx
cmp eax, 0x1c
jb 0x428ccd
mov eax, 0x4c6a48
ret

Function at 0x428ceb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d68], 1
jne 0x428d4a
or dword [0x4c7d68], 1
mov dword [0x4c69a8], 0x587a6b49
mov dword [0x4c69ac], 0x637b6261
mov dword [0x4c69b0], 0x6860476b
mov dword [0x4c69b4], 0x6f637c61
mov dword [0x4c69b8], 0x6061677a
mov dword [0x4c69bc], 0x676f482e
mov dword [0x4c69c0], 0x346a6b62
mov word [0x4c69c4], 0xe2e
xor eax, eax
mov cl, byte [eax + 0x4c69a8]
xor cl, 0xe
mov byte [eax + 0x4c6a64], cl
inc eax
cmp eax, 0x1e
jb 0x428d4c
mov eax, 0x4c6a64
ret
Function at 0x428f29
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4c7d64], 1
jne 0x42914b
or dword [0x4c7d64], 1
push ebx
push esi
push edi
mov edi, 0xd246
mov eax, edi
mov word [0x4c69c8], ax
dec eax
mov word [0x4c69ca], ax
lea esi, [edi + 5]
mov eax, esi
mov word [0x4c69cc], ax
add eax, 0xc
mov word [0x4c69ce], ax
lea edx, [edi + 0xb]
mov eax, edx
mov word [0x4c69d0], ax
lea ecx, [edi - 4]
mov eax, ecx
mov word [0x4c69d2], ax
dec eax
mov word [0x4c69d4], ax
lea eax, [edi + 7]
mov word [0x4c69d6], ax
add eax, 2
mov ebx, eax
mov word [0x4c69d8], bx
mov word [0x4c69e0], ax
lea ebx, [edi - 3]
mov ecx, ebx
lea eax, [edi + 1]
mov word [0x4c69e6], ax
inc edx
mov eax, edx
mov word [0x4c69ec], ax
lea eax, [edi + 0x17]
mov word [0x4c69ee], ax
mov word [0x4c69de], cx
add ecx, 0x1e
mov eax, ecx
mov word [0x4c69f0], ax
lea eax, [edi + 0x22]
mov word [0x4c69f2], ax
add eax, 0x12
mov word [0x4c69f4], ax
lea eax, [edi + 0x33]
add edi, 0x29
mov word [0x4c69f6], ax
mov eax, edi
mov word [0x4c69f8], ax
lea eax, [esi + 0x31]
mov esi, eax
mov word [0x4c69fa], si
add esi, 0xffffffef
mov word [0x4c6a00], bx
mov word [0x4c69fc], si
mov esi, edx
mov word [0x4c69fe], si
lea esi, [ebx + 0x24]
mov ebx, esi
mov word [0x4c6a02], bx
add ebx, 6
mov word [0x4c6a04], bx
mov ebx, eax
mov word [0x4c6a06], bx
mov ebx, ecx
mov word [0x4c6a08], bx
lea ebx, [eax + 1]
mov word [0x4c6a0a], bx
mov ebx, ecx
mov word [0x4c6a0c], bx
lea ebx, [eax - 0x14]
mov word [0x4c6a0e], bx
add ebx, 0x12
mov word [0x4c6a10], bx
mov ebx, edx
mov word [0x4c6a12], bx
mov dword [0x4c69da], 0xd251d242
mov dword [0x4c69e2], 0xd246d24d
mov dword [0x4c69e8], 0xd24bd240
lea ebx, [eax - 0x2f]
mov word [0x4c6a14], bx
mov ebx, eax
mov word [0x4c6a16], bx
add ebx, 0xfffffffb
mov word [0x4c6a18], bx
lea ebx, [eax + 2]
mov eax, edi
mov word [0x4c6a24], ax
mov eax, ebx
mov word [0x4c6a26], ax
add eax, 0xffffffe8
mov ecx, eax
mov eax, esi
mov word [0x4c6a36], ax
add eax, 0xfffffff9
mov word [0x4c6a38], ax
lea eax, [esi + 4]
mov word [0x4c6a3a], ax
add eax, 0xffffffde
mov word [0x4c6a3c], ax
lea eax, [esi + 3]
pop edi
mov word [0x4c6a42], ax
add eax, 0xffffffa4
pop esi
mov word [0x4c6a1a], bx
mov dword [0x4c6a1c], 0xd261d27a
mov dword [0x4c6a20], 0xd27cd269
mov word [0x4c6a28], cx
mov dword [0x4c6a2a], 0xd252d277
mov dword [0x4c6a2e], 0xd26fd243
mov dword [0x4c6a32], 0xd266d26d
mov dword [0x4c6a3e], 0xd267d27b
mov word [0x4c6a44], ax
pop ebx
xor eax, eax
mov ecx, 0xd20e
xor cx, word [eax + 0x4c69c8]
add eax, 2
mov word [eax + 0x4c6a86], cx
cmp eax, 0x7e
jb 0x42914d
mov eax, 0x4c6a88
ret
Function at 0x429bef
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x429db1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x429df3
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x4afef8]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x4afef8]
inc edx
cmp dword [ebp + 8], 0
jne 0x429dbe
pop esi
not eax
pop ebp
ret

Function at 0x42ba3e
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x42ba63
cmp dword [ecx + 0x38], ebx
je 0x42ba63
cmp eax, dword [ecx + 0x10]
jae 0x42ba63
cmp dword [ecx + 0x14], 1
jne 0x42ba63
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x42ba65
xor edi, edi
cmp edi, ebx
je 0x42bb48
cmp esi, ebx
je 0x42bb48
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0042b1e7
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x42baf4
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00469f30
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x42bb19
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00469f30
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x42bb4a
xor eax, eax
pop edi
pop ebx
ret