joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4437e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x53ed90]
imul eax, eax
cdq
mov ecx, 0x16
idiv ecx
push ebx
push esi
push edi
lea ebx, [ecx - 0x12]
cmp edx, 2
jne 0x443844
mov eax, dword [str.Tl5hIws]
mov dword [ebp - 0x58], eax
mov eax, dword [0x51fdbc]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443821
xor ecx, ecx
sub eax, edx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004abd49
push eax
call fcn.004acddb
add esp, 8
cmp byte [0x53fb3f], 0
jne 0x44391b
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0x1a
mov dword [ebp - 0x48], 0x4e0003
mov dword [ebp - 0x44], 0x70015
mov dword [ebp - 0x40], 0x1e0007
mov dword [ebp - 0x3c], 0xd0006
mov dword [ebp - 0x38], 0x42000a
mov dword [ebp - 0x34], 0xd000f
mov dword [ebp - 0x30], 0x1a001c
mov dword [ebp - 0x2c], 0x4b0019
mov dword [ebp - 0x28], 0x1e0005
mov dword [ebp - 0x24], 0xe0001
mov dword [ebp - 0x20], 0x18000a
mov dword [ebp - 0x1c], 0x50001c
mov dword [ebp - 0x18], 0xc000b
mov dword [ebp - 0x14], 0x4000c
mov dword [ebp - 0x10], 0x5e
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x50]
add eax, 3
mov word [eax*2 + 0x53b8ea], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x54]
mov word [eax*2 + 0x53b8ec], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x52]
mov word [eax*2 + 0x53b8ee], cx
cmp eax, 0x21
jl 0x4438d0
mov byte [0x53fb3f], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x53b8f0
pop ebx
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x443940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb25], 0
jne 0x4439b1
mov dword [ebp - 0x1c], 0x170012
mov dword [ebp - 0x18], 0x1c001a
mov dword [ebp - 0x14], 0x10018
mov dword [ebp - 0x10], 0x42001c
mov dword [ebp - 0xc], 0x180016
mov dword [ebp - 8], 0x1d
xor eax, eax
jmp 0x443990
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x1c]
inc eax
mov word [eax*2 + 0x53b9f6], cx
cmp eax, 0xb
jl 0x443990
mov byte [0x53fb25], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b9f8
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x4439d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x53ed90]
mov ecx, eax
imul ecx, eax
imul ecx, eax
and ecx, 0x8000000f
jns 0x4439fa
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 4
jne 0x443a29
push esi
mov eax, 0xff
mov esi, 0x6b
lea ebx, [ebx]
test esi, esi
je 0x443a21
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x443a10
add eax, esi
mov dword [0x53ed90], eax
pop esi
cmp byte [0x53fb3a], 0
jne 0x443ae3
mov dword [ebp - 0x24], 0x2002b
mov dword [ebp - 0x20], 0x1000d
mov dword [ebp - 0x1c], 0x1c0021
mov dword [ebp - 0x18], 0x1001d
mov dword [ebp - 0x14], 0x190016
mov dword [ebp - 0x10], 0x43001c
mov dword [ebp - 0xc], 0x17000e
mov dword [ebp - 8], 0x1b
xor eax, eax
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x53bb52], cx
movzx ecx, byte [eax + 0x53b35c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x53bb54], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x53bb56], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x53bb58], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x53bb5a], cx
cmp eax, 0xf
jl 0x443a70
mov byte [0x53fb3a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bb5c
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x443bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x53ed90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 8
jne 0x443bf1
push 4
call fcn.004ace0a
mov ecx, dword [0x53ed90]
add esp, 4
mov dword [eax], ecx
cmp byte [0x53fb4f], 0
jne 0x443ca1
push ebx
push esi
push edi
pop edi
pop esi
mov dword [ebp - 0x44], 0x27
mov dword [ebp - 0x40], 0xe000d
mov dword [ebp - 0x3c], 0xb0005
mov dword [ebp - 0x38], 0xd0026
mov dword [ebp - 0x34], 0x6001c
mov dword [ebp - 0x30], 0x60007
mov dword [ebp - 0x2c], 0x120001
mov dword [ebp - 0x28], 0x56005a
mov dword [ebp - 0x24], 0x7003d
mov dword [ebp - 0x20], 0x1b000c
mov dword [ebp - 0x1c], 0x40006
mov dword [ebp - 0x18], 0x190001
mov dword [ebp - 0x14], 0xd004f
mov dword [ebp - 0x10], 0x19000e
mov dword [ebp - 0xc], 0x7000e
mov dword [ebp - 8], 0xe
xor eax, eax
pop ebx
jmp 0x443c80
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x44]
inc eax
mov word [eax*2 + 0x53b6d6], cx
cmp eax, 0x1f
jl 0x443c80
mov byte [0x53fb4f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b6d8
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x443cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb5c], 0
jne 0x443da3
xor eax, eax
mov dword [ebp - 0x30], 0x33
mov dword [ebp - 0x2c], 0x1b0001
mov dword [ebp - 0x28], 0x3e0014
mov dword [ebp - 0x24], 0xd0000
mov dword [ebp - 0x20], 0xf0010
mov dword [ebp - 0x1c], 0x10001c
mov dword [ebp - 0x18], 0x70020
mov dword [ebp - 0x14], 0xb0004
mov dword [ebp - 0x10], 0x10001c
mov dword [ebp - 0xc], 0x4b0057
mov word [ebp - 8], ax
lea esp, [esp]
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x30]
add eax, 5
mov word [eax*2 + 0x53bd32], cx
movzx ecx, byte [eax + 0x53b35c]
xor cx, word [ebp + eax*2 - 0x38]
mov word [eax*2 + 0x53bd34], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x53bd36], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x34]
mov word [eax*2 + 0x53bd38], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x32]
mov word [eax*2 + 0x53bd3a], cx
cmp eax, 0x14
jl 0x443d30
mov byte [0x53fb5c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bd3c
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x443dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb54], 0
jne 0x443ed4
xor eax, eax
mov dword [ebp - 0x28], 0x170012
mov dword [ebp - 0x24], 0x1c001a
mov dword [ebp - 0x20], 0x10018
mov dword [ebp - 0x1c], 0x58001c
mov dword [ebp - 0x18], 0x5a0053
mov dword [ebp - 0x14], 0x530041
mov dword [ebp - 0x10], 0x520043
mov dword [ebp - 0xc], 0x540047
mov word [ebp - 8], ax
jmp 0x443e20
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x53b9cc], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x53b9ce], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x53b9d0], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x53b9d2], cx
cmp eax, 0x10
jl 0x443e20
push esi
mov esi, dword [0x53ed90]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 6
jne 0x443ecc
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004abd49
push eax
call fcn.004acddb
add esp, 8
mov byte [0x53fb54], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b9d4
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x443ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d8ec
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb40], 0
jne 0x444053
mov ecx, dword [0x53ed90]
mov dword [ebp - 0x24], 0x1f000d
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x13
idiv ecx
mov dword [ebp - 0x20], 0x80009
mov dword [ebp - 0x1c], 0x4e0014
mov dword [ebp - 0x18], 0x3001c
mov dword [ebp - 0x14], 0xf001e
mov dword [ebp - 0x10], 0x10004f
mov dword [ebp - 0xc], 0xe0008
mov dword [ebp - 8], 0xf
cmp edx, 0xa
jne 0x443fdc
push esi
push edi
xor eax, eax
push 0x1d8c6
push eax
mov word [ebp - 0x1d8ec], ax
lea eax, [ebp - 0x1d8ea]
push eax
call fcn.004b1a50
add esp, 0xc
xor edi, edi
xor esi, esi
lea esp, [esp]
xor eax, eax
test edi, edi
je 0x443fba
test eax, eax
je 0x443fba
lea ecx, [esi + eax]
lea edx, [ebp - 0x1d8ec]
lea edx, [edx + ecx*2]
lea ecx, [esi + eax]
mov cx, word [ebp + ecx*2 - 0x1dad8]
inc cx
add cx, word [edx - 2]
mov word [edx], cx
inc eax
cmp eax, 0xf6
jl 0x443f92
add esi, 0xf6
inc edi
cmp esi, 0xec64
jl 0x443f90
movsx eax, word [ebp - 0x26]
pop edi
mov dword [0x53ed90], eax
pop esi
xor ecx, ecx
mov edi, edi
movzx eax, byte [ecx + 0x53b360]
xor ax, word [ebp + ecx*2 - 0x24]
add ecx, 5
mov word [ecx*2 + 0x53b852], ax
movzx eax, byte [ecx + 0x53b35c]
xor ax, word [ebp + ecx*2 - 0x2c]
mov word [ecx*2 + 0x53b854], ax
movzx eax, byte [ecx + 0x53b35d]
xor ax, word [ebp + ecx*2 - 0x2a]
mov word [ecx*2 + 0x53b856], ax
movzx eax, byte [ecx + 0x53b35e]
xor ax, word [ebp + ecx*2 - 0x28]
mov word [ecx*2 + 0x53b858], ax
movzx eax, byte [ecx + 0x53b35f]
xor ax, word [ebp + ecx*2 - 0x26]
mov word [ecx*2 + 0x53b85a], ax
cmp ecx, 0xf
jl 0x443fe0
mov byte [0x53fb40], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b85c
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x444190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb3c], 0
jne 0x444297
push esi
push edi
xor eax, eax
pop edi
mov dword [ebp - 0x38], 0x130007
mov dword [ebp - 0x34], 0x1b0006
mov dword [ebp - 0x30], 0xf0051
mov dword [ebp - 0x2c], 0xe001e
mov dword [ebp - 0x28], 0x9001c
mov dword [ebp - 0x24], 0xc004f
mov dword [ebp - 0x20], 0x160018
mov dword [ebp - 0x1c], 0xb0049
mov dword [ebp - 0x18], 0x490008
mov dword [ebp - 0x14], 0xe0000
mov dword [ebp - 0x10], 0x30018
mov dword [ebp - 0xc], 0x14001c
mov word [ebp - 8], ax
pop esi
jmp 0x444210
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x53b534], cx
movzx ecx, byte [eax + 0x53b35b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x53b536], cx
movzx ecx, byte [eax + 0x53b35c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x53b538], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x53b53a], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x53b53c], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x53b53e], cx
cmp eax, 0x18
jl 0x444210
mov byte [0x53fb3c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b540
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x4442b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb52], 0
jne 0x444334
push esi
mov dword [ebp - 0x2c], 0x170036
mov dword [ebp - 0x28], 0xb0009
mov dword [ebp - 0x24], 0x1c0021
mov dword [ebp - 0x20], 0x1001d
mov dword [ebp - 0x1c], 0x190016
mov dword [ebp - 0x18], 0x2e001c
mov dword [ebp - 0x14], 0xf0008
mov dword [ebp - 0x10], 0x160006
mov dword [ebp - 0xc], 0x530017
mov dword [ebp - 8], 0x4d
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x2c]
inc eax
mov word [eax*2 + 0x53bb7a], cx
cmp eax, 0x13
jl 0x444313
mov byte [0x53fb52], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bb7c
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x444350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb48], 0
jne 0x444411
mov ecx, dword [0x53ed90]
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
mov dword [ebp - 0x34], 0x130007
mov dword [ebp - 0x30], 0x1b0006
mov dword [ebp - 0x2c], 0x20051
mov dword [ebp - 0x28], 0x3001d
mov dword [ebp - 0x24], 0x4a0017
mov dword [ebp - 0x20], 0x570059
mov dword [ebp - 0x1c], 0x4d
mov dword [ebp - 0x18], 0x100000
mov dword [ebp - 0x14], 0x4004e
mov dword [ebp - 0x10], 0xf0002
mov dword [ebp - 8], 0xb
cmp edx, 0x11
jne 0x4443e8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x34]
inc eax
mov word [eax*2 + 0x53bc36], cx
cmp eax, 0x17
jl 0x4443f0
mov byte [0x53fb48], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bc38
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x444430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb49], 0
jne 0x444510
push ebx
xor eax, eax
push esi
mov esi, 0xa
mov dword [ebp - 0x24], 0x1d000a
mov dword [ebp - 0x20], 0xe001e
mov dword [ebp - 0x1c], 0xb005c
mov dword [ebp - 0x18], 0x100000
mov dword [ebp - 0x14], 0x18001c
mov dword [ebp - 0x10], 0x40041
mov dword [ebp - 0xc], 0x40004
mov word [ebp - 8], ax
mov edi, edi
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 2
mov word [eax*2 + 0x53bb38], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x53bb3a], cx
cmp eax, 0xe
jl 0x444490
mov ebx, dword [0x53ed90]
mov eax, ebx
imul eax, ebx
cdq
mov ecx, 0xc
idiv ecx
cmp edx, esi
jne 0x4444ed
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov ebx, dword [0x53ed90]
mov eax, ebx
imul eax, ebx
cdq
idiv esi
mov byte [0x53fb49], 1
cmp edx, 3
jne 0x44450e
push edi
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0x17
jb 0x444506
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bb3c
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x444530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b8
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb26], 0
jne 0x444667
xor eax, eax
push esi
mov dword [ebp - 0x34], 0x170003
mov dword [ebp - 0x30], 0x22001c
mov dword [ebp - 0x2c], 0xa001e
mov dword [ebp - 0x28], 0xe0007
mov dword [ebp - 0x24], 0x220016
mov dword [ebp - 0x20], 0xd000e
mov dword [ebp - 0x1c], 0xe0009
mov dword [ebp - 0x18], 0x2a000c
mov dword [ebp - 0x14], 0xd003a
mov dword [ebp - 0x10], 0x70001
mov dword [ebp - 0xc], 0x4c004f
mov word [ebp - 8], ax
xor ecx, ecx
jmp 0x4445b0
movzx eax, byte [ecx + 0x53b360]
xor ax, word [ebp + ecx*2 - 0x34]
add ecx, 2
mov word [ecx*2 + 0x53b694], ax
movzx eax, byte [ecx + 0x53b35f]
xor ax, word [ebp + ecx*2 - 0x36]
mov word [ecx*2 + 0x53b696], ax
cmp ecx, 0x16
jl 0x4445b0
mov eax, dword [0x53ed90]
imul eax, eax
cdq
mov ecx, 0x15
idiv ecx
mov byte [0x53fb26], 1
cmp edx, 8
jne 0x444666
push edi
xor eax, eax
push 0x880
push eax
mov word [ebp - 0x8b8], ax
lea eax, [ebp - 0x8b6]
push eax
call fcn.004b1a50
add esp, 0xc
xor edi, edi
xor esi, esi
nop
xor eax, eax
test edi, edi
je 0x44464a
test eax, eax
je 0x44464a
lea ecx, [esi + eax]
lea edx, [ebp - 0x8b8]
lea edx, [edx + ecx*2]
lea ecx, [esi + eax]
mov cx, word [ebp + ecx*2 - 0x8fa]
inc cx
add cx, word [edx - 2]
mov word [edx], cx
inc eax
cmp eax, 0x21
jl 0x444622
add esi, 0x21
inc edi
cmp esi, 0x441
jl 0x444620
movsx eax, word [ebp - 0x38]
mov dword [0x53ed90], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b698
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x444680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb57], 0
jne 0x444773
push ebx
push esi
push edi
pop edi
pop esi
mov dword [ebp - 0x38], 0x4000a
mov dword [ebp - 0x34], 0x300018
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 0x1a0017
mov dword [ebp - 0x28], 0xf0003
mov dword [ebp - 0x24], 0x17000c
mov dword [ebp - 0x20], 0x60008
mov dword [ebp - 0x1c], 0x80036
mov dword [ebp - 0x18], 0xa0001
mov dword [ebp - 0x14], 0x7000c
mov dword [ebp - 0x10], 0x4002a
mov dword [ebp - 0xc], 0x1000f
mov dword [ebp - 8], 0x1b
xor eax, eax
pop ebx
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 5
mov word [eax*2 + 0x53b81e], cx
movzx ecx, byte [eax + 0x53b35c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x53b820], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x53b822], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x53b824], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x53b826], cx
cmp eax, 0x19
jl 0x444700
mov byte [0x53fb57], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b828
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x444790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb4b], 0
jne 0x444812
mov dword [ebp - 0x2c], 0x330032
mov dword [ebp - 0x28], 0x30004
mov dword [ebp - 0x24], 0xd001e
mov dword [ebp - 0x20], 0x1a0037
mov dword [ebp - 0x1c], 0x240041
mov dword [ebp - 0x18], 0x4e001b
mov dword [ebp - 0x14], 0x17003e
mov dword [ebp - 0x10], 0x7000a
mov dword [ebp - 0xc], 0x1a000b
mov dword [ebp - 8], 0x1e
xor ecx, ecx
movzx eax, byte [ecx + 0x53b360]
xor ax, word [ebp + ecx*2 - 0x2c]
inc ecx
mov word [ecx*2 + 0x53b4c6], ax
cmp ecx, 0x13
jl 0x4447f1
mov byte [0x53fb4b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b4c8
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x444830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb3b], 0
jne 0x44494c
push esi
xor eax, eax
push edi
mov dword [ebp - 0x28], 0x130014
mov dword [ebp - 0x24], 0xa001a
mov dword [ebp - 0x20], 0x1a001f
mov dword [ebp - 0x1c], 0x120052
mov dword [ebp - 0x18], 0x50001
mov dword [ebp - 0x14], 0x43000c
mov dword [ebp - 0x10], 0x30003
mov edi, 4
mov dword [ebp - 0xc], 0x10004
mov word [ebp - 8], ax
jmp 0x4448a0
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x53bb9c], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x53bb9e], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x53bba0], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x53bba2], cx
cmp eax, 0x10
jl 0x4448a0
mov esi, dword [0x53ed90]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x11
idiv ecx
mov byte [0x53fb3b], 1
cmp edx, 3
jne 0x44494a
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004abd49
push eax
call fcn.004acddb
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bba4
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x444a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb28], 0
jne 0x444b4f
xor eax, eax
push esi
mov dword [ebp - 0x28], 0x2002b
mov dword [ebp - 0x24], 0x1000d
mov dword [ebp - 0x20], 0x1c0021
mov dword [ebp - 0x1c], 0x1001d
mov dword [ebp - 0x18], 0x190016
mov dword [ebp - 0x14], 0x43001c
mov dword [ebp - 0x10], 0x7001e
mov dword [ebp - 0xc], 0x20005
mov word [ebp - 8], ax
lea esp, [esp]
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x53b508], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x53b50a], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x53b50c], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x53b50e], cx
cmp eax, 0x10
jl 0x444aa0
mov ecx, dword [0x53ed90]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 0x11
jne 0x444b47
push edi
push 0x28
call fcn.004abd49
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004acfe8
add eax, dword [0x53ed90]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x444b20
mov eax, dword [edi + 0x24]
push edi
mov dword [0x53ed90], eax
call fcn.004acddb
add esp, 4
pop edi
mov byte [0x53fb28], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b510
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x4486d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d8678
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x539c80]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov eax, dword [0x539c80]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push 0x20028
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call fcn.004234d0
mov edx, esi
mov ecx, eax
call fcn.00434f50
test eax, eax
jne 0x448761
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.004409f0
mov dword [esp + 0x58], 0
push eax
call fcn.00442140
push eax
lea ecx, [esp + 0x18]
call fcn.00444d10
push 0x52472c
lea eax, [esp + 0x14]
push eax
call fcn.004b447b
lea eax, [esp + 0x18]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4487b9
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.004409f0
mov dword [esp + 0x58], 1
push eax
call fcn.00442650
push eax
lea ecx, [esp + 0x18]
call fcn.00444d10
push 0x52472c
lea eax, [esp + 0x14]
push eax
call fcn.004b447b
mov dword [esp + 0x20], 1
call fcn.00440aa0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 2
mov dword [esp + 0x2c], eax
call fcn.00440aa0
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0xc]
test eax, eax
jne 0x448846
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.004409f0
mov dword [esp + 0x58], 2
push eax
call fcn.004416d0
push eax
lea ecx, [esp + 0x18]
call fcn.00444d10
push 0x52472c
lea eax, [esp + 0x14]
push eax
call fcn.004b447b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret 4