joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532790], 0
jne 0x440ecf
push esi
xor eax, eax
push edi
mov dword [ebp - 0x38], 0x1a0000
mov dword [ebp - 0x34], 0x3e0019
mov dword [ebp - 0x30], 0x2001a
mov dword [ebp - 0x2c], 0xa000d
mov dword [ebp - 0x28], 0x17001c
mov dword [ebp - 0x24], 0x1c0000
mov dword [ebp - 0x20], 0xb0007
mov dword [ebp - 0x1c], 0x100036
mov dword [ebp - 0x18], 0x9000d
mov dword [ebp - 0x14], 0x180016
mov dword [ebp - 0x10], 0x1b0017
mov dword [ebp - 0xc], 0x1d001a
mov word [ebp - 8], ax
lea esp, [esp]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x52ea30], cx
movzx ecx, byte [eax + 0x52e35b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x52ea32], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x52ea34], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x52ea36], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x52ea38], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x52ea3a], cx
cmp eax, 0x18
jl 0x440df0
mov esi, dword [0x531d90]
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 3
jne 0x440ec6
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x141]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a90f9
push eax
call fcn.004aa18b
add esp, 8
pop edi
mov byte [0x532790], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ea3c
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x440ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532765], 0
jne 0x441017
push ebx
push esi
push edi
pop edi
xor eax, eax
pop esi
mov dword [ebp - 0x44], 0xd000d
mov dword [ebp - 0x40], 0x150007
mov dword [ebp - 0x3c], 0xa004f
mov dword [ebp - 0x38], 0x1c0001
mov dword [ebp - 0x34], 0x520008
mov dword [ebp - 0x30], 0x1d0000
mov dword [ebp - 0x2c], 0x1d0010
mov dword [ebp - 0x28], 0x1b000c
mov dword [ebp - 0x24], 0x270001
mov dword [ebp - 0x20], 0xc001c
mov dword [ebp - 0x1c], 0x1e0016
mov dword [ebp - 0x18], 0x530010
mov dword [ebp - 0x14], 0xd0016
mov dword [ebp - 0x10], 0x4d001b
mov dword [ebp - 0xc], case.0x45ffc3.88
mov word [ebp - 8], ax
pop ebx
jmp 0x440f90
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x44]
add eax, 6
mov word [eax*2 + 0x52e4b4], cx
movzx ecx, byte [eax + 0x52e35b]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x52e4b6], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x52e4b8], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x52e4ba], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x48]
mov word [eax*2 + 0x52e4bc], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x46]
mov word [eax*2 + 0x52e4be], cx
cmp eax, 0x1e
jl 0x440f90
mov byte [0x532765], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e4c0
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x4410a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532796], 0
jne 0x4411c8
push ebx
push esi
xor eax, eax
push edi
mov dword [ebp - 0x48], 0x1e000b
mov dword [ebp - 0x44], 0xe001b
mov dword [ebp - 0x40], 0x33001d
mov dword [ebp - 0x3c], 0x1d000b
mov dword [ebp - 0x38], 0x1f0001
mov dword [ebp - 0x34], 0x60016
mov dword [ebp - 0x30], 0xc000b
mov dword [ebp - 0x2c], 0x10008
mov dword [ebp - 0x28], 0x4001c
mov dword [ebp - 0x24], 0x370014
mov dword [ebp - 0x20], 0x1e0007
mov dword [ebp - 0x1c], 0x2c0019
mov dword [ebp - 0x18], 0x70002
mov dword [ebp - 0x14], 0x4000e
mov dword [ebp - 0x10], 0x60003
mov dword [ebp - 0xc], 0xd001c
mov word [ebp - 8], ax
jmp 0x441140
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 4
mov word [eax*2 + 0x52ec00], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x52ec02], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x52ec04], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x52ec06], cx
cmp eax, 0x20
jl 0x441140
mov esi, dword [0x531d90]
mov edi, 0x13
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
idiv edi
pop edi
mov byte [0x532796], 1
cmp edx, 4
cmove esi, ecx
mov dword [0x531d90], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ec08
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x4411e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53276a], 0
jne 0x4412b3
mov dword [ebp - 0x24], 0x1e002d
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], 0x9001b
mov dword [ebp - 0x18], 0x1a003c
mov dword [ebp - 0x14], 0x17001e
mov dword [ebp - 0x10], 0xc0002
mov dword [ebp - 0xc], 0x170027
mov dword [ebp - 8], 0x53
xor eax, eax
jmp 0x441240
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x52eaca], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52eacc], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52eace], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x52ead0], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x52ead2], cx
cmp eax, 0xf
jl 0x441240
mov byte [0x53276a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ead4
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x4412d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532772], 0
jne 0x4413a3
mov dword [ebp - 0x24], 0x10007
mov dword [ebp - 0x20], 0x60008
mov dword [ebp - 0x1c], 0x4c000a
mov dword [ebp - 0x18], 0x18
mov dword [ebp - 0x14], 0x110003
mov dword [ebp - 0x10], 0x60043
mov dword [ebp - 0xc], 0x20003
mov dword [ebp - 8], 0xc
xor eax, eax
jmp 0x441330
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x52ea12], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52ea14], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52ea16], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x52ea18], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x52ea1a], cx
cmp eax, 0xf
jl 0x441330
mov byte [0x532772], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ea1c
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x441520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532785], 0
jne 0x441667
push esi
mov esi, dword [0x531d90]
mov ecx, 0xe
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
cmp edx, 9
jne 0x441579
push edi
xor edi, edi
test esi, esi
je 0x441572
mov edi, edi
mov eax, esi
mov ecx, esi
cdq
sub eax, edx
and ecx, 1
mov esi, eax
add edi, ecx
sar esi, 1
jne 0x441560
mov dword [0x531d90], edi
pop edi
xor eax, eax
mov dword [ebp - 0x38], 0xd000d
mov dword [ebp - 0x34], 0x150007
mov dword [ebp - 0x30], 0xd004f
mov dword [ebp - 0x2c], 0x1e0004
mov dword [ebp - 0x28], 0x110003
mov dword [ebp - 0x24], 0x90043
mov dword [ebp - 0x20], 0xc0001
mov dword [ebp - 0x1c], 0x6000c
mov dword [ebp - 0x18], 0x4a0006
mov dword [ebp - 0x14], 0xd0017
mov dword [ebp - 0x10], 0x1b000d
mov dword [ebp - 0xc], 0x170010
mov word [ebp - 8], ax
pop esi
jmp 0x4415e0
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x52e928], cx
movzx ecx, byte [eax + 0x52e35b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x52e92a], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x52e92c], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x52e92e], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x52e930], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x52e932], cx
cmp eax, 0x18
jl 0x4415e0
mov byte [0x532785], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e934
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x441750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532783], 0
jne 0x4417d1
mov dword [ebp - 0x28], 0x1a0000
mov dword [ebp - 0x24], 0x3e0019
mov dword [ebp - 0x20], 0x1c0006
mov dword [ebp - 0x1c], 0x2d000b
mov dword [ebp - 0x18], 0xa0009
mov dword [ebp - 0x14], 0xd0000
mov dword [ebp - 0x10], 0x1b0012
mov dword [ebp - 0xc], 0x1a0000
mov dword [ebp - 8], 0x1b
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x28]
inc eax
mov word [eax*2 + 0x52e6ba], cx
cmp eax, 0x11
jl 0x4417b0
mov byte [0x532783], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e6bc
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x4418a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x52cc80]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp byte [0x532770], 0
push esi
push edi
jne 0x441a17
xor eax, eax
mov dword [esp + 8], 0x1a0000
mov dword [esp + 0xc], 0x3e0019
mov dword [esp + 0x10], 0x50009
mov dword [esp + 0x14], 0x1001a
mov dword [esp + 0x18], 0x2d0018
mov dword [esp + 0x1c], 0x6000a
mov dword [esp + 0x20], 0xa0008
mov dword [esp + 0x24], 0x1000a
mov dword [esp + 0x28], 0x5001c
mov dword [esp + 0x2c], 0x37001d
mov dword [esp + 0x30], 0x170007
mov dword [esp + 0x34], 0x160001
mov dword [esp + 0x38], 0x160013
mov dword [esp + 0x3c], 0x9000c
mov word [esp + 0x40], ax
xor ecx, ecx
lea esp, [esp]
movzx eax, byte [ecx + 0x52e360]
xor ax, word [esp + ecx*2 + 8]
add ecx, 4
mov word [ecx*2 + 0x52ec44], ax
movzx eax, byte [ecx + 0x52e35d]
xor ax, word [esp + ecx*2 + 2]
mov word [ecx*2 + 0x52ec46], ax
movzx eax, byte [ecx + 0x52e35e]
xor ax, word [esp + ecx*2 + 4]
mov word [ecx*2 + 0x52ec48], ax
movzx eax, byte [ecx + 0x52e35f]
xor ax, word [esp + ecx*2 + 6]
mov word [ecx*2 + 0x52ec4a], ax
cmp ecx, 0x1c
jl 0x441940
mov esi, dword [0x531d90]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 2
jne 0x441a10
movsd xmm3, qword [0x514d18]
movsd xmm6, qword [0x514d40]
movsd xmm5, qword [0x514d10]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
lea ebx, [ebx]
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x4419fa
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x4419e0
mov byte [0x532770], 1
mov ecx, dword [esp + 0x44]
pop edi
pop esi
xor ecx, esp
mov eax, 0x52ec4c
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x441a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53277f], 0
jne 0x441b1b
push ebx
push esi
push edi
pop edi
pop esi
mov dword [ebp - 0x48], 0x1e000b
mov dword [ebp - 0x44], 0xe001b
mov dword [ebp - 0x40], 0x4c001d
mov dword [ebp - 0x3c], 0x17000f
mov dword [ebp - 0x38], 0x60018
mov dword [ebp - 0x34], 0x6000a
mov dword [ebp - 0x30], 0x4f0005
mov dword [ebp - 0x2c], 0x1c000f
mov dword [ebp - 0x28], 0x190007
mov dword [ebp - 0x24], 0x480007
mov dword [ebp - 0x20], 0x13
mov dword [ebp - 0x1c], 0x10001a
mov dword [ebp - 0x18], 0x110015
mov dword [ebp - 0x14], 0x4d001a
mov dword [ebp - 0x10], 0x1c0019
mov dword [ebp - 0xc], 0x1b0008
mov dword [ebp - 8], 0x48
xor eax, eax
pop ebx
lea esp, [esp]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 3
mov word [eax*2 + 0x52e8d2], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x52e8d4], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x52e8d6], cx
cmp eax, 0x21
jl 0x441ad0
mov byte [0x53277f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e8d8
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x441b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532764], 0
jne 0x441ba1
mov dword [ebp - 0x1c], 0x90018
mov dword [ebp - 0x18], 0x12001b
mov dword [ebp - 0x14], 0x30006
mov dword [ebp - 0x10], 0x520006
mov dword [ebp - 0xc], 9
mov dword [ebp - 8], 0x11
xor eax, eax
jmp 0x441b80
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x1c]
inc eax
mov word [eax*2 + 0x52e9a2], cx
cmp eax, 0xb
jl 0x441b80
mov byte [0x532764], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e9a4
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x441bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x531d90]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 0xe
jne 0x441bf7
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, dword [0x531d90]
cmp byte [0x53278c], 0
jne 0x441cd9
push edi
mov dword [ebp - 0x24], 0x1c0021
mov dword [ebp - 0x20], 0xf000c
mov edi, 0xf
mov dword [ebp - 0x1c], 0x1e003f
mov dword [ebp - 0x18], 0x110007
mov dword [ebp - 0x14], 0x10009
mov dword [ebp - 0x10], 0x480010
mov dword [ebp - 0xc], 0x1a0001
mov dword [ebp - 8], 0x1b
xor eax, eax
jmp 0x441c50
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x52e75e], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52e760], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52e762], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x52e764], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x52e766], cx
cmp eax, 0xf
jl 0x441c50
lea eax, [esi + 1]
imul eax, esi
cdq
idiv edi
pop edi
cmp edx, 0xa
jne 0x441cd2
dec esi
mov dword [0x531d90], esi
mov byte [0x53278c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e768
pop esi
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x441da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53279f], 0
jne 0x441e51
mov dword [ebp - 0x44], 0x1e002d
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], 0x9001b
mov dword [ebp - 0x38], 0x1d003c
mov dword [ebp - 0x34], 0x1e0003
mov dword [ebp - 0x30], 0xd000b
mov dword [ebp - 0x2c], 0x1f000e
mov dword [ebp - 0x28], 0x47005a
mov dword [ebp - 0x24], 0x40026
mov dword [ebp - 0x20], 0x180012
mov dword [ebp - 0x1c], 0x1a0010
mov dword [ebp - 0x18], 0x7001a
mov dword [ebp - 0x14], 0x40050
mov dword [ebp - 0x10], 0x40008
mov dword [ebp - 0xc], 0x17001c
mov dword [ebp - 8], 0xa
xor eax, eax
nop
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x44]
inc eax
mov word [eax*2 + 0x52e516], cx
cmp eax, 0x1f
jl 0x441e30
mov byte [0x53279f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e518
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x441e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x531d90]
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0x11
idiv ecx
cmp edx, 3
jne 0x441f57
mov eax, ebx
cdq
push esi
sub eax, edx
xor ecx, ecx
mov esi, eax
sar esi, 1
push edi
mov edi, 0xb3
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], esi
lea esp, [esp]
test esi, esi
jle 0x441f49
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
lea ebx, [ebx]
xor edx, edx
xor esi, esi
xor ecx, ecx
cmp eax, 2
jl 0x441f21
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffffe
shr ecx, 1
inc ecx
mov eax, ebx
lea ebx, [ecx + ecx]
mov dword [ebp - 0x44], ebx
mov ebx, dword [ebp - 0x40]
nop
dec esi
add edx, eax
add esi, eax
sub eax, 2
dec ecx
jne 0x441f10
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
jge 0x441f2b
mov eax, ebx
sub eax, ecx
add edi, eax
mov ecx, dword [ebp - 0x38]
lea eax, [esi + edx]
add edi, eax
mov eax, dword [ebp - 0x34]
add ebx, ecx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
jne 0x441ef0
mov esi, dword [ebp - 0x48]
mov ebx, dword [0x531d90]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, edi
jl 0x441ed0
pop edi
pop esi
cmp byte [0x53278b], 0
pop ebx
jne 0x442033
xor eax, eax
mov dword [ebp - 0x30], 0x1e0039
mov dword [ebp - 0x2c], 0x150000
mov dword [ebp - 0x28], 0x3c000a
mov dword [ebp - 0x24], 0x1d001a
mov dword [ebp - 0x20], 0x17000f
mov dword [ebp - 0x1c], 0x1b0010
mov dword [ebp - 0x18], 0xa002f
mov dword [ebp - 0x14], 0x1a0004
mov dword [ebp - 0x10], 0x130007
mov dword [ebp - 0xc], 0x480049
mov word [ebp - 8], ax
xor ecx, ecx
jmp 0x441fc0
movzx eax, byte [ecx + 0x52e360]
xor ax, word [ebp + ecx*2 - 0x30]
add ecx, 5
mov word [ecx*2 + 0x52e56e], ax
movzx eax, byte [ecx + 0x52e35c]
xor ax, word [ebp + ecx*2 - 0x38]
mov word [ecx*2 + 0x52e570], ax
movzx eax, byte [ecx + 0x52e35d]
xor ax, word [ebp + ecx*2 - 0x36]
mov word [ecx*2 + 0x52e572], ax
movzx eax, byte [ecx + 0x52e35e]
xor ax, word [ebp + ecx*2 - 0x34]
mov word [ecx*2 + 0x52e574], ax
movzx eax, byte [ecx + 0x52e35f]
xor ax, word [ebp + ecx*2 - 0x32]
mov word [ecx*2 + 0x52e576], ax
cmp ecx, 0x14
jl 0x441fc0
mov byte [0x53278b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e578
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x442050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532795], 0
jne 0x44210f
xor eax, eax
mov dword [ebp - 0x28], 0x90018
mov dword [ebp - 0x24], 0x12001b
mov dword [ebp - 0x20], 0x30006
mov dword [ebp - 0x1c], 0x480006
mov dword [ebp - 0x18], 0x42004c
mov dword [ebp - 0x14], 0x58004d
mov dword [ebp - 0x10], 0x5f004c
mov dword [ebp - 0xc], 0x450047
mov word [ebp - 8], ax
jmp 0x4420b0
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x52e978], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x52e97a], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52e97c], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52e97e], cx
cmp eax, 0x10
jl 0x4420b0
mov byte [0x532795], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e980
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x442130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532780], 0
jne 0x442225
push esi
push edi
mov dword [ebp - 0x24], 0x10007
mov edi, 1
mov dword [ebp - 0x20], 0x60008
mov dword [ebp - 0x1c], 0x4c000a
mov dword [ebp - 0x18], 0x130006
mov dword [ebp - 0x14], 0x170001
mov dword [ebp - 0x10], 0x1b0043
mov dword [ebp - 0xc], 0x30007
mov dword [ebp - 8], 0xf
xor eax, eax
mov edi, edi
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x52e80a], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52e80c], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52e80e], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x52e810], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x52e812], cx
cmp eax, 0xf
jl 0x442190
mov ecx, dword [0x531d90]
mov esi, 0xc
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
mov byte [0x532780], 1
cmp edx, 0xb
cmove ecx, edi
pop edi
mov dword [0x531d90], ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e814
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x442310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532779], 0
jne 0x442417
xor eax, eax
push esi
mov dword [ebp - 0x38], 0xd000d
mov dword [ebp - 0x34], 0x150007
mov dword [ebp - 0x30], 0xd004f
mov dword [ebp - 0x2c], 0x1e0004
mov dword [ebp - 0x28], 0x110003
mov dword [ebp - 0x24], 0x70043
mov dword [ebp - 0x20], 0x1b0017
mov dword [ebp - 0x1c], 0x1a0049
mov dword [ebp - 0x18], 0x4a0013
mov dword [ebp - 0x14], 0xd001e
mov dword [ebp - 0x10], 0x1d000e
mov dword [ebp - 0xc], 0xa0007
mov word [ebp - 8], ax
xor ecx, ecx
pop esi
jmp 0x442390
movzx eax, byte [ecx + 0x52e360]
xor ax, word [ebp + ecx*2 - 0x38]
add ecx, 6
mov word [ecx*2 + 0x52e5bc], ax
movzx eax, byte [ecx + 0x52e35b]
xor ax, word [ebp + ecx*2 - 0x42]
mov word [ecx*2 + 0x52e5be], ax
movzx eax, byte [ecx + 0x52e35c]
xor ax, word [ebp + ecx*2 - 0x40]
mov word [ecx*2 + 0x52e5c0], ax
movzx eax, byte [ecx + 0x52e35d]
xor ax, word [ebp + ecx*2 - 0x3e]
mov word [ecx*2 + 0x52e5c2], ax
movzx eax, byte [ecx + 0x52e35e]
xor ax, word [ebp + ecx*2 - 0x3c]
mov word [ecx*2 + 0x52e5c4], ax
movzx eax, byte [ecx + 0x52e35f]
xor ax, word [ebp + ecx*2 - 0x3a]
mov word [ecx*2 + 0x52e5c6], ax
cmp ecx, 0x18
jl 0x442390
mov byte [0x532779], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e5c8
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x442430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532792], 0
jne 0x4424b2
mov dword [ebp - 0x2c], 0x9003c
mov dword [ebp - 0x28], 0x50008
mov dword [ebp - 0x24], 0x1e003f
mov dword [ebp - 0x20], 0x110007
mov dword [ebp - 0x1c], 0x10009
mov dword [ebp - 0x18], 0x250010
mov dword [ebp - 0x14], 0x20007
mov dword [ebp - 0x10], 0x70006
mov dword [ebp - 0xc], 0x50000c
mov dword [ebp - 8], 0x53
xor eax, eax
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x2c]
inc eax
mov word [eax*2 + 0x52eb4a], cx
cmp eax, 0x13
jl 0x442491
mov byte [0x532792], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52eb4c
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x4424d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532787], 0
jne 0x442562
push esi
mov dword [ebp - 0x34], 0xd000d
mov dword [ebp - 0x30], 0x150007
mov dword [ebp - 0x2c], 0x4f
mov dword [ebp - 0x28], 0x130007
mov dword [ebp - 0x24], 0x520008
mov dword [ebp - 0x20], 0x5c0055
mov dword [ebp - 0x1c], 0xd0042
mov dword [ebp - 0x18], 0x10000
mov dword [ebp - 0x14], 0x70055
mov dword [ebp - 0x10], 0xc001c
mov dword [ebp - 0xc], 0x1e0016
mov dword [ebp - 8], 0x10
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x34]
inc eax
mov word [eax*2 + 0x52ec86], cx
cmp eax, 0x17
jl 0x442541
mov byte [0x532787], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ec88
call fcn.004a992a
mov esp, ebp
pop ebp
ret