joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8d42
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x14
mov dword [esp + 0x10], 0x79e2380d
mov dword [esp + 0xc], 0x20042
mov dword [esp + 8], esi
mov esi, 0x4b8d10
mov dword [esp + 4], eax
mov dword [esp + 0x10], esi
xor esi, esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
xor esi, eax
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4b8d81
cmp esi, 0x2f26
je 0x4b8d9e
int3
mov eax, dword [esp + 4]
add ebx, esi
mov esi, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebx
mov dword [esp + 4], 0xcd0004c2
jmp 0x4b8db2
ret 4

Function at 0x4b8e89
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x82
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x20
mov dword [esp + 0x1c], 0xe27a2e88
mov dword [esp + 0x18], 0x20045
mov dword [esp + 0x14], edi
mov edi, 0x4b8e58
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], edi
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov ebp, dword [ebp]
xor edi, ebp
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b8ec8
cmp edi, 0x79f
je 0x4b8ee6
int3
mov ebp, dword [esp + 0x10]
add eax, edi
mov edi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], eax
mov dword [esp + 4], 0x140004c2
jmp 0x4b8efa
ret 4

Function at 0x4b8f80
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x1c
mov dword [esp + 0x18], 0x295f7e1e
mov dword [esp + 0x14], 0x20051
mov dword [esp + 0x10], esi
mov esi, 0x4b8f50
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], esi
xor esi, esi
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
xor esi, eax
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x4b8fbf
cmp esi, 0xeb0
je 0x4b8fdc
int3
mov eax, dword [esp + 0xc]
add edx, esi
mov esi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], edx
mov dword [esp + 4], 0x610004c2
jmp 0x4b8ff0
ret 4

Function at 0x4b9944
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x20
mov dword [esp + 0x1c], 0xd9c39b79
mov dword [esp + 0x18], 0x20040
mov dword [esp + 0x14], edi
mov edi, 0x4b9914
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edi
xor edi, edi
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
xor edi, eax
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b9983
cmp edi, 0x1f76
je 0x4b99a0
int3
mov eax, dword [esp + 0x10]
add ebx, edi
mov edi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0x5a0004c2
jmp 0x4b99b4
ret 4
Function at 0x4b9b3a
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x20
mov dword [esp + 0x1c], 0xe6cbac84
mov dword [esp + 0x18], 0x20051
mov dword [esp + 0x14], ebx
mov ebx, 0x4b9b08
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ebx
xor ebx, ebx
mov esi, dword [esp + 0x1c]
mov esi, dword [esi]
xor ebx, esi
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b9b79
cmp ebx, 0xb14
je 0x4b9b96
int3
mov esi, dword [esp + 0x10]
add edx, ebx
mov ebx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edx
mov dword [esp + 4], 0xdb0004c2
jmp 0x4b9baa
ret 4

Function at 0x4b9c34
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x20
mov dword [esp + 0x1c], 0x7977f8bb
mov dword [esp + 0x18], 0x2003b
mov dword [esp + 0x14], ecx
mov ecx, 0x4b9c04
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov esi, dword [esp + 0x1c]
mov esi, dword [esi]
xor ecx, esi
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b9c73
cmp ecx, 0x37e
je 0x4b9c90
int3
mov esi, dword [esp + 0x10]
add edi, ecx
mov ecx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edi
mov dword [esp + 4], 0x430004c2
jmp 0x4b9ca4
ret 4

Function at 0x4b9fcb
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x20
mov dword [esp + 0x1c], 0xcc161d91
mov dword [esp + 0x18], 0x2004a
mov dword [esp + 0x14], esi
mov esi, 0x4b9f98
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], esi
xor esi, esi
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor esi, edi
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4ba00b
cmp esi, 0x10e5
je 0x4ba028
int3
mov edi, dword [esp + 0x10]
add ebp, esi
mov esi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebp
mov dword [esp + 4], 0xa40004c2
jmp 0x4ba03c
ret 4

Function at 0x4ba109
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x24
mov dword [esp + 0x20], 0xba9bbec2
mov dword [esp + 0x1c], 0x2005b
mov dword [esp + 0x18], edi
mov edi, 0x4ba0d8
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], edi
xor edi, edi
mov ebp, dword [esp + 0x20]
mov ebp, dword [ebp]
xor edi, ebp
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x4ba148
cmp edi, 0x209b
je 0x4ba166
int3
mov ebp, dword [esp + 0x14]
add eax, edi
mov edi, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], eax
mov dword [esp + 4], 0x500004c2
jmp 0x4ba17a
ret 4
Function at 0x4ba203
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x14
mov dword [esp + 0x10], 0x7597e542
mov dword [esp + 0xc], 0x20040
mov dword [esp + 8], edx
mov edx, 0x4ba1d0
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
xor edx, edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
xor edx, ecx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4ba242
cmp edx, 0x3ba8
je 0x4ba25f
int3
mov ecx, dword [esp + 4]
add edi, edx
mov edx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], edi
mov dword [esp + 4], 0xc00004c2
jmp 0x4ba273
ret 4

Function at 0x4ba3f5
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x14
mov dword [esp + 0x10], 0x78d7b48d
mov dword [esp + 0xc], 0x2003e
mov dword [esp + 8], ebx
mov ebx, 0x4ba3c4
mov dword [esp + 4], edx
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
xor ebx, edx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4ba435
cmp ebx, 0x863
je 0x4ba452
int3
mov edx, dword [esp + 4]
add ebp, ebx
mov ebx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebp
mov dword [esp + 4], 0x420004c2
jmp 0x4ba466
ret 4

Function at 0x4ba72d
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x20
mov dword [esp + 0x1c], 0x50bc8242
mov dword [esp + 0x18], 0x20059
mov dword [esp + 0x14], ecx
mov ecx, 0x4ba6fc
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
xor ecx, ebx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4ba76c
cmp ecx, 0x391a
je 0x4ba789
int3
mov ebx, dword [esp + 0x10]
add edi, ecx
mov ecx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edi
mov dword [esp + 4], 0x60004c2
jmp 0x4ba79d
ret 4

Function at 0x51d3d3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x4d80521a
mov dword [esp + 0x18], 0x20050
mov dword [esp + 0x14], ebp
mov ebp, 0x51d3a0
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebp
xor ebp, ebp
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor ebp, edi
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x51d412
cmp ebp, 0x2566
je 0x51d42f
int3
mov edi, dword [esp + 0x10]
add edx, ebp
mov ebp, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edx
mov dword [esp + 4], 0x6c0004c2
jmp 0x51d443
ret 4
Function at 0x51d4a3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x24
mov dword [esp + 0x20], 0x3a1a0ffb
mov dword [esp + 0x1c], 0x20040
mov dword [esp + 0x18], eax
mov eax, 0x51d470
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], eax
xor eax, eax
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
xor eax, edx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x51d4e2
cmp eax, 0x2d1d
je 0x51d4fe
int3
mov edx, dword [esp + 0x14]
add ecx, eax
mov eax, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ecx
mov dword [esp + 4], 0x6e0004c2
jmp 0x51d512
ret 4

Function at 0x5221c3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x18
mov dword [esp + 0x14], 0xb01c988a
mov dword [esp + 0x10], 0x2007c
mov dword [esp + 0xc], esi
mov esi, 0x522190
mov dword [esp + 8], edx
mov dword [esp + 0x14], esi
xor esi, esi
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
xor esi, edx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x522202
cmp esi, 0x1af0
je 0x52221f
int3
mov edx, dword [esp + 8]
add edi, esi
mov esi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], edi
mov dword [esp + 4], 0xcd0004c2
jmp 0x522233
ret 4

Function at 0x5222b7
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x1c
mov dword [esp + 0x18], 0x288393ee
mov dword [esp + 0x14], 0x2004d
mov dword [esp + 0x10], esi
mov esi, 0x522284
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], esi
xor esi, esi
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
xor esi, ebp
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x5222f6
cmp esi, 0x3413
je 0x522314
int3
mov ebp, dword [esp + 0xc]
add eax, esi
mov esi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], eax
mov dword [esp + 4], 0x9c0004c2
jmp 0x522328
ret 4

Function at 0x527150
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x83
push dword [esp]
sub dword [esp], 0x80
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x14
mov dword [esp + 0x10], 0x897abb73
mov dword [esp + 0xc], 0x2005e
mov dword [esp + 8], ecx
mov ecx, 0x527120
mov dword [esp + 4], esi
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov esi, dword [esp + 0x10]
mov esi, dword [esi]
xor ecx, esi
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x527190
cmp ecx, 0x3f79
je 0x5271ad
int3
mov esi, dword [esp + 4]
add ebp, ecx
mov ecx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebp
mov dword [esp + 4], 0x9b0004c2
jmp 0x5271c1
ret 4
Function at 0x52c1f7
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x14
mov dword [esp + 0x10], 0xa3015858
mov dword [esp + 0xc], 0x20049
mov dword [esp + 8], eax
mov eax, 0x52c1c4
mov dword [esp + 4], ebp
mov dword [esp + 0x10], eax
xor eax, eax
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp]
xor eax, ebp
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x52c236
cmp eax, 0x399f
je 0x52c253
int3
mov ebp, dword [esp + 4]
add ecx, eax
mov eax, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ecx
mov dword [esp + 4], 0xdb0004c2
jmp 0x52c267
ret 4

Function at 0x531a81
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
sub esp, 0x1c
mov dword [esp + 0x18], 0x244dd426
mov dword [esp + 0x14], 0x20040
mov dword [esp + 0x10], eax
mov eax, 0x531a50
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], eax
xor eax, eax
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
xor eax, ebp
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x531ac0
cmp eax, 0x70e
je 0x531add
int3
mov ebp, dword [esp + 0xc]
add esi, eax
mov eax, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], esi
mov dword [esp + 4], 0x730004c2
jmp 0x531af1
ret 4

Function at 0x54214b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 0x28b
xor dword [esp], 0x293
sub esp, dword [esp]
mov dword [ebp - 4], 0
sub esp, 4
mov dword [esp], ebp
mov ebp, dword [0x723a1c]
sub ebp, 0
pop ebp
push 0x3021
je 0x542195
add dword [esp], 0x476b0e
add dword [esp], 0xc86c3
jmp 0x54218f
ret
sub esp, 0x18
mov dword [esp + 0x14], 0x7652ab82
mov dword [esp + 0x10], 0x2006b
mov dword [esp + 0xc], eax
mov eax, 0x542164
mov dword [esp + 8], esi
mov dword [esp + 0x14], eax
xor eax, eax
mov esi, dword [esp + 0x14]
mov esi, dword [esi]
xor eax, esi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x5421bb
cmp eax, 0x85
je 0x5421d7
int3
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc]
add esp, 0x18
add dword [esp], 0x441eaa
add dword [esp], 0xfdac3
jmp 0x5421ec
ret

Function at 0x544b4e
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x14
mov dword [esp + 0x10], 0xd8b241ea
mov dword [esp + 0xc], 0x20032
mov dword [esp + 8], esi
mov esi, 0x544b1c
mov dword [esp + 4], ecx
mov dword [esp + 0x10], esi
xor esi, esi
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
xor esi, ecx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x544b8d
cmp esi, 0x3821
je 0x544baa
int3
mov ecx, dword [esp + 4]
add ebx, esi
mov esi, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebx
mov dword [esp + 4], 0xbe0004c2
jmp 0x544bbe
ret 4
Function at 0x5450e9
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x1c
mov dword [esp + 0x18], 0x2144591
mov dword [esp + 0x14], 0x2006b
mov dword [esp + 0x10], eax
mov eax, 0x5450b8
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], eax
xor eax, eax
mov ebx, dword [esp + 0x18]
mov ebx, dword [ebx]
xor eax, ebx
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x545128
cmp eax, 0x431
je 0x545144
int3
mov ebx, dword [esp + 0xc]
add ecx, eax
mov eax, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ecx
mov dword [esp + 4], 0xf0004c2
jmp 0x545158
ret 4

Function at 0x545a63
Capabilities:
Encode data using xor

Disassembly:
add byte [edx + 0xc], ch
push 0x71a564
push 0x73c6a0
call 0x545a63
in eax, dx
xchg edx, eax
aam 0x51
arpl word [eax], ax
add dword cs:[esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x24
mov dword [esp + 0x20], 0x4b2c8dda
mov dword [esp + 0x1c], 0x2007c
mov dword [esp + 0x18], edx
mov edx, 0x545a30
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], edx
xor edx, edx
mov ebp, dword [esp + 0x20]
mov ebp, dword [ebp]
xor edx, ebp
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x545aa2
cmp edx, 0x1e7c
je 0x545ac0
int3
mov ebp, dword [esp + 0x14]
add edi, edx
mov edx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edi
mov dword [esp + 4], 0x1f0004c2
jmp 0x545ad4
ret 4

Function at 0x545b91
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], 0xcc279510
mov dword [esp + 0x14], 0x2007a
mov dword [esp + 0x10], edx
mov edx, 0x545b60
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], edx
xor edx, edx
mov esi, dword [esp + 0x18]
mov esi, dword [esi]
xor edx, esi
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x545bd0
cmp edx, 0x150d
je 0x545bed
int3
mov esi, dword [esp + 0xc]
add ebx, edx
mov edx, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ebx
mov dword [esp + 4], 0x630004c2
jmp 0x545c01
ret 4

Function at 0x54604d
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x18
mov dword [esp + 0x14], 0xc570090c
mov dword [esp + 0x10], 0x20044
mov dword [esp + 0xc], ecx
mov ecx, 0x54601c
mov dword [esp + 8], edx
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
xor ecx, edx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x54608c
cmp ecx, 0xb06
je 0x5460a9
int3
mov edx, dword [esp + 8]
add edi, ecx
mov ecx, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], edi
mov dword [esp + 4], 0xec0004c2
jmp 0x5460bd
ret 4
Function at 0x546104
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x24
mov dword [esp + 0x20], 0x9fffe11b
mov dword [esp + 0x1c], 0x20035
mov dword [esp + 0x18], edi
mov edi, 0x5460d4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], edi
xor edi, edi
mov ebp, dword [esp + 0x20]
mov ebp, dword [ebp]
xor edi, ebp
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x546143
cmp edi, 0xa9c
je 0x546161
int3
mov ebp, dword [esp + 0x14]
add ecx, edi
mov edi, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ecx
mov dword [esp + 4], 0x2b0004c2
jmp 0x546175
ret 4

Function at 0x546297
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x24
mov dword [esp + 0x20], 0xd8d13a36
mov dword [esp + 0x1c], 0x20054
mov dword [esp + 0x18], eax
mov eax, 0x546264
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
xor eax, eax
mov esi, dword [esp + 0x20]
mov esi, dword [esi]
xor eax, esi
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5462d6
cmp eax, 0x3678
je 0x5462f2
int3
mov esi, dword [esp + 0x14]
add ebx, eax
mov eax, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ebx
mov dword [esp + 4], 0x120004c2
jmp 0x546306
ret 4

Function at 0x54644d
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x82
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x20
mov dword [esp + 0x1c], 0xbb43bcc7
mov dword [esp + 0x18], 0x2007c
mov dword [esp + 0x14], edx
mov edx, 0x54641c
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
xor edx, edx
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor edx, edi
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x54648c
cmp edx, 0x206b
je 0x5464a9
int3
mov edi, dword [esp + 0x10]
add eax, edx
mov edx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], eax
mov dword [esp + 4], 0xe20004c2
jmp 0x5464bd
ret 4

Function at 0x5466c1
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp + 0x10], 0xd03fc1d
mov dword [esp + 0xc], 0x20076
mov dword [esp + 8], ebp
mov ebp, 0x546690
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebp
xor ebp, ebp
mov esi, dword [esp + 0x10]
mov esi, dword [esi]
xor ebp, esi
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x546700
cmp ebp, 0x3c45
je 0x54671d
int3
mov esi, dword [esp + 4]
add edx, ebp
mov ebp, dword [esp + 8]
add esp, 0x14
xchg dword [esp], edx
mov dword [esp + 4], 0xfd0004c2
jmp 0x546731
ret 4
Function at 0x546b83
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], 0xcf2e1669
mov dword [esp + 0x14], 0x20041
mov dword [esp + 0x10], edx
mov edx, 0x546b50
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
xor edx, ecx
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x546bc2
cmp edx, 0x1678
je 0x546bdf
int3
mov ecx, dword [esp + 0xc]
add ebx, edx
mov edx, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ebx
mov dword [esp + 4], 0x210004c2
jmp 0x546bf3
ret 4

Function at 0x546d11
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x1c
mov dword [esp + 0x18], 0xa1328cdf
mov dword [esp + 0x14], 0x2003c
mov dword [esp + 0x10], esi
mov esi, 0x546ce0
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], esi
xor esi, esi
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
xor esi, eax
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x546d50
cmp esi, 0x568
je 0x546d6d
int3
mov eax, dword [esp + 0xc]
add ecx, esi
mov esi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ecx
mov dword [esp + 4], 0xfd0004c2
jmp 0x546d81
ret 4

Function at 0x546dc7
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7a
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x18
mov dword [esp + 0x14], 0xea79d20a
mov dword [esp + 0x10], 0x20074
mov dword [esp + 0xc], edx
mov edx, 0x546d94
mov dword [esp + 8], edi
mov dword [esp + 0x14], edx
xor edx, edx
mov edi, dword [esp + 0x14]
mov edi, dword [edi]
xor edx, edi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x546e07
cmp edx, 0x50
je 0x546e21
int3
mov edi, dword [esp + 8]
add ebp, edx
mov edx, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], ebp
mov dword [esp + 4], 0x460004c2
jmp 0x546e35
ret 4

Function at 0x546e7c
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x1c
mov dword [esp + 0x18], 0x4877ff5e
mov dword [esp + 0x14], 0x2005f
mov dword [esp + 0x10], ecx
mov ecx, 0x546e4c
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov edi, dword [esp + 0x18]
mov edi, dword [edi]
xor ecx, edi
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x546ebc
cmp ecx, 0x16a1
je 0x546ed9
int3
mov edi, dword [esp + 0xc]
add ebp, ecx
mov ecx, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ebp
mov dword [esp + 4], 0x4d0004c2
jmp 0x546eed
ret 4