joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436960
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
call fcn.0041c670
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436999
jmp 0x436b0a
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4369d5
jmp 0x436b04
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00431880
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x436a09
jmp 0x436af5
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040c820
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00428f10
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x51
mov byte [edi + 1], 0xaf
mov byte [edi + 2], 0xad
mov byte [edi + 3], 0xa9
mov byte [edi + 4], 0xb6
mov byte [edi + 5], 0xd6
mov byte [edi + 6], 0xc9
mov byte [edi + 7], 0xdb
mov byte [edi + 8], 0xc8
mov byte [edi + 9], 0x11
mov byte [edi + 0xa], 0xde
mov byte [edi + 0xb], 0xd9
mov byte [edi + 0xc], 0xdc
mov byte [edi + 0xd], 0x6f
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x436a79
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x11
jae 0x436ac7
movzx edx, byte [edi + eax]
mov dword [ebp - 0x24], edi
mov edi, 0x44
sub edi, eax
or edi, edx
xor edi, 0xffffffff
mov ebx, 0x44
sub ebx, eax
mov esi, 0x44
sub esi, eax
and ebx, esi
mov ecx, dword [ebp + 8]
and ebx, edx
or ebx, edi
mov edi, dword [ebp - 0x24]
add bl, 0x59
mov byte [edi + eax], bl
add eax, 1
jmp 0x436a8a
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x18]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.0040d170
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.0040c830
add esp, 4
jmp 0x436af5
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c990
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
xor edx, edx
nop
nop
nop
cmp word [eax + edx], 0
lea edx, [edx + 2]
jne 0x43c9a0
mov dword [esp + 4], eax
lea eax, [edx - 2]
mov dword [esp], eax
mov dword [esp + 8], 0xcecec87f
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov esi, 0x823952
nop
nop
nop
movzx ebx, byte [esp + esi - 0x82394a]
mov ebp, esi
and ebp, ebx
mov eax, ebp
and eax, 0x5d
mov ecx, ebp
and ecx, 2
mov edi, ebp
or edi, 0xfffffffd
inc edi
imul edi, eax
or ebp, 2
imul ebp, ecx
add edi, ebx
sub edi, ebp
add edi, esi
mov eax, edi
and eax, 0x62
xor edi, 0x62
lea eax, [edi + eax*2]
add al, 4
mov byte [esp + esi - 0x82394a], al
inc esi
cmp esi, 0x823959
jne 0x43c9d0
cmp edx, 2
je 0x43ca42
mov esi, dword [esp + 8]
mov ecx, dword [esp]
mov eax, ecx
sar eax, 1
mov edi, esi
not edi
test cl, 2
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
jne 0x43ca4b
mov dword [esp], eax
mov ecx, dword [esp + 0x30]
jmp 0x43ca7b
mov eax, dword [esp + 0x30]
jmp 0x43cae8
dec eax
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 4], ecx
xor eax, dword [esp + 0x30]
mov ecx, eax
and ecx, edi
mov ebx, eax
not ebx
and ebx, esi
imul ebx, ecx
mov ecx, eax
and ecx, esi
or eax, esi
imul eax, ecx
add eax, ebx
mov ecx, eax
cmp edx, 4
mov ebp, dword [esp + 4]
mov ebx, dword [esp]
mov esi, dword [esp + 0x10]
je 0x43cae8
xor edx, edx
mov eax, ecx
mov dword [esp], ebx
mov edi, dword [esp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ebp + edx*2]
xor ebx, eax
mov eax, ebx
and eax, edi
mov ecx, ebx
not ecx
and ecx, esi
imul ecx, eax
mov eax, ebx
and eax, esi
or ebx, esi
imul ebx, eax
add ebx, ecx
movzx eax, word [ebp + edx*2 + 2]
xor eax, ebx
mov ecx, eax
and ecx, edi
mov ebx, eax
not ebx
and ebx, esi
imul ebx, ecx
mov ecx, eax
and ecx, esi
or eax, esi
imul eax, ecx
add eax, ebx
mov ebx, dword [esp]
add edx, 2
cmp ebx, edx
jne 0x43caa0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d860
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.004464f0
add esp, 0x14
test eax, eax
js 0x43d99f
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004468c0
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43d8fa
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43d8c4
mov eax, 0xffffffff
jmp 0x43d8cb
lea eax, [eax*2 + 2]
push eax
call fcn.0040c820
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.00446e50
add esp, 0x14
test eax, eax
js 0x43d8ef
mov eax, esi
jmp 0x43d8fa
push esi
call fcn.0040c830
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x700f0e0d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov edx, 0xd8ea02bd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x2715fd47]
xor ebx, edx
mov esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0x4e
mov byte [esp + edx + 0x2715fd47], bl
inc edx
cmp edx, 0xd8ea02c4
jne 0x43d920
mov edx, dword [0x452b74]
test edx, edx
je 0x43d98e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x452b78]
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43d970
inc edi
cmp edx, edi
jne 0x43d960
jmp 0x43d98e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d98e
push ecx
push 1
push edx
push dword [0x452b7c]
mov esi, eax
call fcn.00442710
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43d9a1
lea eax, [esp + 4]
push eax
call fcn.00445d00
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x43f6a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push eax
mov eax, dword [esp + 0x10]
mov dword [esp], 0x292a2bd4
mov ecx, 0x47
mov edx, 0x18
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x11
mov ebx, ecx
and ebx, 0x4e
or ebx, esi
xor bl, byte [esp + ecx - 0x47]
xor bl, 0x11
add bl, 0x9d
mov byte [esp + ecx - 0x47], bl
inc ecx
dec edx
cmp ecx, 0x4b
jne 0x43f6c0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x45ab98]
mov ecx, dword [0x45086c]
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x43f780
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xb1d405bd
nop
movzx ecx, byte [esp + eax + 0x4e2bfa43]
lea edx, [eax + 0x2715fd00]
mov esi, eax
and esi, ecx
or edx, ecx
lea ecx, [esi + esi]
not ecx
add ecx, esi
and ecx, edx
mov edx, ecx
not edx
and edx, 0xb5
and ecx, 0x4a
sub ecx, edx
add cl, 4
mov byte [esp + eax + 0x4e2bfa43], cl
inc eax
cmp eax, 0xb1d405c4
jne 0x43f7b0
mov eax, dword [esp]
mov esi, dword [0x452b74]
test esi, esi
je 0x43f844
xor ecx, ecx
mov edx, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43f820
inc ecx
cmp esi, ecx
jne 0x43f810
jmp 0x43f844
mov edx, dword [edx + ecx*8 + 4]
cmp edx, eax
je 0x43f844
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push edx
push dword [0x452b7c]
call fcn.00442710
add esp, 0x1c
mov dword [esp + 0x10], eax
mov dword [esp], 0x31fefff8
mov word [esp + 4], 0
mov eax, esp
mov ecx, 0x2a
nop
nop
nop
movzx esi, byte [eax]
not esi
mov edx, ecx
or edx, esi
lea ebp, [edx + edx]
not ebp
add ebp, edx
lea edx, [ecx - 0x2402be00]
and edx, esi
or edx, ebp
mov esi, edx
not esi
mov ebp, esi
and ebp, 0xd4
and esi, 2
mov edi, esi
xor edi, 2
imul edi, ebp
or ebp, 2
imul ebp, esi
xor edx, 0x29
add edx, ebp
add edx, edi
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x24
jne 0x43f860
mov edi, dword [esp + 0x10]
cmp edi, dword [esp]
jne 0x43f9d5
push dword [esp + 8]
call fcn.0043f6a0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0xb1d405bd
nop
nop
movzx ecx, byte [esp + edx + 0x4e2bfa43]
lea esi, [edx + 0x2715fd00]
mov edi, edx
and edi, ecx
or esi, ecx
lea ecx, [edi + edi]
not ecx
add ecx, edi
and ecx, esi
mov esi, ecx
not esi
and esi, 0xb5
and ecx, 0x4a
sub ecx, esi
add cl, 4
mov byte [esp + edx + 0x4e2bfa43], cl
inc edx
cmp edx, 0xb1d405c4
jne 0x43f8e0
mov edi, dword [esp]
mov ecx, dword [0x452b74]
test ecx, ecx
je 0x43f975
xor edx, edx
mov esi, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x43f950
inc edx
cmp ecx, edx
jne 0x43f940
jmp 0x43f975
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, edi
je 0x43f975
push 0
push ebp
push eax
push 5
push 4
push ecx
push dword [0x452b7c]
mov esi, eax
call fcn.00442710
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43f9cc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43f9a5
add edi, 2
cmp si, bp
je 0x43f990
cmp si, bp
je 0x43f9b7
mov esi, dword [ecx]
test esi, esi
jne 0x43f980
mov edi, 0xc0000225
jmp 0x43f9cc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043f710
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43fc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43fd40
mov eax, dword [ecx]
test eax, eax
je 0x43fd40
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x700f0e0d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0xb1d405bd
nop
nop
nop
movzx esi, byte [esp + eax + 0x4e2bfa47]
lea edi, [eax + 0x2715fd00]
mov edx, eax
and edx, esi
or edi, esi
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, edi
mov edx, ebx
not edx
and edx, 0xb5
and ebx, 0x4a
sub ebx, edx
add bl, 4
mov byte [esp + eax + 0x4e2bfa47], bl
inc eax
cmp eax, 0xb1d405c4
jne 0x43fcd0
mov eax, dword [esp + 4]
mov ebx, dword [0x452b74]
test ebx, ebx
je 0x43fda3
xor edi, edi
mov esi, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0x2dedf0b8
je 0x43fd7f
inc edi
cmp ebx, edi
jne 0x43fd30
jmp 0x43fda3
mov dword [esp + 4], 0xa96a6b6c
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x67
xor cl, byte [esp + eax + 4]
add cl, 0xfd
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne 0x43fd60
mov eax, dword [esp + 4]
jmp 0x43fea5
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43fda3
push dword [ebp + 8]
push dword [esp + 0x10]
push 2
push esi
push dword [0x452b7c]
mov esi, ecx
call fcn.00442710
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43fe98
cmp eax, 0xc000010a
jne 0x43fe98
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x700f0e0d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0xb1d405bd
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x4e2bfa47]
lea edi, [eax + 0x2715fd00]
mov edx, eax
and edx, esi
or edi, esi
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, edi
mov edx, ebx
not edx
and edx, 0xb5
and ebx, 0x4a
sub ebx, edx
add bl, 4
mov byte [esp + eax + 0x4e2bfa47], bl
inc eax
cmp eax, 0xb1d405c4
jne 0x43fe00
mov eax, dword [esp + 4]
mov esi, dword [0x452b74]
test esi, esi
je 0x43fe98
xor edi, edi
mov ebx, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4e66b5a3
je 0x43fe70
inc edi
cmp esi, edi
jne 0x43fe60
jmp 0x43fe98
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43fe98
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 3
push esi
push dword [0x452b7c]
mov esi, ecx
call fcn.00442710
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43fea5
mov esi, eax
call fcn.0043fbc0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x442630
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x450ca4]

Function at 0x4434d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 0xc], 0xd9dab597
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov ecx, 0x1fcda94f
mov edx, 0xe03256b0
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1fcda943]
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
or esi, ecx
and esi, edi
mov edi, esi
xor edi, 0xb
mov ebx, esi
or ebx, 0x74
and ebx, edi
xor esi, 0x74
lea ebx, [esi + ebx*2]
inc bl
mov byte [esp + ecx - 0x1fcda943], bl
inc ecx
dec edx
cmp ecx, 0x1fcda956
jne 0x443500
xor ecx, ecx
cmp dword [esp + 0xc], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x451184]
Function at 0x444490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, 0xffffffff
cmp byte [ecx + eax + 1], 0
lea eax, [eax + 1]
jne 0x4444a0
mov dword [esp], 0x969698f7
mov word [esp + 4], 0
mov edx, eax
neg edx
mov dword [esp + 8], edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi]
mov ebp, esi
and ebp, 4
mov edi, esi
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ebp
or ebp, 2
imul ebp, edi
mov edi, esi
xor edi, 0x77c21b66
add edi, edx
add edi, ebp
lea ebp, [ebx + ebx]
not ebp
add ebp, ebx
and ebp, edi
not ebx
or ebx, edi
lea edx, [ebx + ebx]
not edx
add edx, ebx
or edx, ebp
add dl, 2
mov byte [esp + esi], dl
inc esi
cmp esi, 6
jne 0x4444d0
test eax, eax
je 0x44455d
mov edi, dword [esp]
mov ebx, edi
not ebx
mov ebp, dword [esp + 8]
mov esi, dword [esp + 0x24]
nop
nop
nop
movsx eax, byte [ecx]
mov edx, esi
and edx, eax
add edx, edx
sub eax, edx
add eax, esi
mov edx, eax
or edx, edi
mov esi, eax
and esi, edi
imul esi, edx
mov edx, eax
not edx
and edx, edi
and eax, ebx
imul eax, edx
add eax, esi
inc ecx
mov esi, eax
inc ebp
jne 0x444530
jmp 0x444561
mov eax, dword [esp + 0x24]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4454d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
push eax
push eax
mov eax, esp
mov ecx, dword [ebp + 8]
movzx esi, word [ecx]
mov dword [ebp - 0x18], 0xf0ee7d5
mov word [ebp - 0x14], 0
xor edx, edx
mov bl, 0xbd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov bh, byte [ebp + edx - 0x18]
xor bh, bl
mov cl, 0xb5
sub cl, bh
mov byte [ebp + edx - 0x18], cl
inc edx
dec bl
cmp edx, 6
jne case.default.0x445520
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
setne dl
jmp dword [edx*4 + 0x4516f4]
Function at 0x445ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x445ef0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x445f0b
mov eax, 0xffffffff
jmp 0x445f0e
add eax, 0xa
push eax
call fcn.0040c820
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x445f51
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445f40
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor ecx, ecx
mov edx, ecx
add dl, 0x27
xor dl, byte [esp + ecx]
add dl, 0x3d
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x445fb0
mov esi, dword [esp]
mov ecx, dword [0x452b74]
test ecx, ecx
je 0x446021
xor edx, edx
mov ebx, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x445ff0
inc edx
cmp ecx, edx
jne 0x445fe0
jmp 0x446021
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x446021
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x452b7c]
mov edi, eax
call fcn.00442710
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c830
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x446060
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44607b
mov eax, 0xffffffff
jmp 0x44607e
add eax, 0xa
push eax
call fcn.0040c820
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4460c1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4460b0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xe8ebeae5
mov byte [esp + 0x24], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x27
xor dl, byte [esp + ecx + 0x20]
add dl, 0x3d
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 5
jne 0x446120
mov esi, dword [esp + 0x20]
mov ecx, dword [0x452b74]
test ecx, ecx
je 0x446189
xor edx, edx
mov ebx, dword [0x452b78]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x446160
inc edx
cmp ecx, edx
jne 0x446150
jmp 0x446189
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x446189
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x452b7c]
mov ebx, eax
call fcn.00442710
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040c830
add esp, 4
test edi, edi
je 0x44619c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4461b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
mov ecx, eax
add cl, 0x27
xor cl, byte [esp + eax]
add cl, 0x3d
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x4461d0
mov eax, dword [esp]
mov edx, dword [0x452b74]
test edx, edx
je 0x446238
xor ebx, ebx
mov ecx, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x446210
inc ebx
cmp edx, ebx
jne 0x446200
jmp 0x446238
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x446238
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push edx
push dword [0x452b7c]
call fcn.00442710
add esp, 0x20
test edi, edi
je 0x446242
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x44624e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446260
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x27
xor bl, byte [esp + eax]
add bl, 0x3d
mov byte [esp + eax], bl
inc eax
cmp eax, 5
jne 0x446290
mov eax, dword [esp]
mov ebx, dword [0x452b74]
test ebx, ebx
je 0x4462fe
xor ebp, ebp
mov edi, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x4462d0
inc ebp
cmp ebx, ebp
jne 0x4462c0
jmp 0x4462fe
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4462fe
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x452b7c]
call fcn.00442710
add esp, 0x30
cmp eax, 0x103
jne 0x446389
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x27
xor cl, byte [esp + eax]
add cl, 0x3d
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x446320
mov eax, dword [esp]
mov ecx, dword [0x452b74]
test ecx, ecx
je 0x446381
xor edx, edx
mov edi, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x446360
inc edx
cmp ecx, edx
jne 0x446350
jmp 0x446381
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x446381
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x452b7c]
call fcn.00442710
add esp, 0x18
test eax, eax
js 0x446389
mov eax, dword [esp + 8]
test esi, esi
je 0x44639c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44639a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4464f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x446510
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x27
xor cl, byte [esp + eax]
add cl, 0x3d
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x446590
mov eax, dword [esp]
mov edi, dword [0x452b74]
test edi, edi
je 0x4465f5
xor ebx, ebx
mov ebp, dword [0x452b78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x4465d1
inc ebx
cmp edi, ebx
jne 0x4465c0
jmp 0x4465f5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x4465f5
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push edi
push dword [0x452b7c]
call fcn.00442710
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret