joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d7428
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x539c80]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x24], edx
mov ebx, ecx
mov esi, dword [0x53ed90]
mov dword [esp + 0x14], 0x15
lea eax, [esi + 1]
imul eax, esi
cdq
idiv dword [esp + 0x14]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp edx, 0x11
jne 0x43c5d0
movsd xmm3, qword [0x522870]
movsd xmm6, qword [0x522898]
movsd xmm5, qword [0x522868]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
lea esp, [esp]
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x43c5ba
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x43c5a0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0
push 0x2001f
push dword [edi]
push ecx
lea ecx, [esp + 0x24]
call fcn.00418a70
mov esi, dword [esp + 0x18]
test eax, eax
je 0x43c60d
xor bl, bl
jmp 0x43c660
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push 0
push dword [eax]
mov dword [esp + 0x28], 4
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x43c642
cmp dword [esp + 0x28], 4
mov eax, 0xd
cmovne edi, eax
test esi, esi
je 0x43c653
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x18], esi
test edi, edi
mov dword [esp + 0x1c], 0
sete bl
mov dword [esp + 0x38], 0xffffffff
test esi, esi
je 0x43c67b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c6a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x53ed90]
push edi
lea edi, [esi + 1]
mov eax, edi
imul eax, esi
mov ebx, edx
mov dword [ebp - 4], ecx
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 5
jne 0x43c6ed
sub esi, 0
je 0x43c6e3
dec esi
je 0x43c6d7
mov dword [0x53ed90], edi
jmp 0x43c6ed
mov dword [0x53ed90], 0
jmp 0x43c6ed
mov dword [0x53ed90], 2
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0x2001f
push 0
push dword [eax]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c713
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebp - 4]
push ecx
push 1
push 0
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ce60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp + 8]
push ecx
push 0x2001f
push 0
push dword [eax]
mov dword [ebp - 4], edx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43ce8e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x53ed90]
imul eax, eax
cdq
mov ecx, 0x13
idiv ecx
mov eax, dword [0x53f65c]
mov ecx, 0x9ba2c3a9
cmp edx, 3
cmove eax, ecx
mov dword [0x53f65c], eax
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43cee0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d72f2
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x824], edx
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 4], 0
mov edx, ecx
push 0
lea ecx, [ebp - 0x814]
call fcn.0043b260
add esp, 4
mov byte [ebp - 4], 1
push 0x2001f
push dword [eax]
lea ecx, [ebp - 0x820]
push dword [0x53b31c]
call fcn.00418a70
test eax, eax
setne bl
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x814]
add edx, 0xfffffff0
or eax, 0xffffffff
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43cf90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x820]
test bl, bl
je 0x43cfa7
xor bl, bl
jmp 0x43d0d6
xor ebx, ebx
lea esp, [esp]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004b1a50
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push edi
mov dword [ebp - 0x828], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
test eax, eax
jne 0x43d0b5
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x810]
test eax, 0xffff0000
jne 0x43d048
movzx esi, ax
mov ecx, esi
call fcn.00401b90
test eax, eax
je 0x43d072
push esi
push eax
lea ecx, [ebp - 0x814]
call fcn.00402860
jmp 0x43d072
lea edx, [eax + 2]
jmp 0x43d050
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43d050
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.004025f0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x824]
lea eax, [ebp - 0x814]
push eax
call fcn.0041a200
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x814]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43cfb0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x43cfb0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x43d0ca
push edi
call esi
xor edi, edi
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x81c], 0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x43d0ee
push edi
call esi
mov dword [ebp - 0x820], 0
mov al, bl
mov dword [ebp - 0x81c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x43fad0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7f19
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x539c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, eax
shr edx, 8
movzx ecx, dl
movzx ebx, al
mov dword [ebp - 0x18], ecx
cmp eax, 0x80000000
jae 0x43fb26
mov edi, eax
shr edi, 0x10
cmp ebx, 6
jb 0x43fb59
cmp ecx, 2
jb 0x43fb59
mov ecx, esi
call fcn.0043fdf0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
push edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push ebx
push 0x51f88c
push eax
call fcn.004114f0
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
add esp, 0x14
mov ecx, edi
call fcn.00402720
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43fbc4
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440290
Capabilities:
Check if file exists
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8081
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x5396d8]
xor bl, bl
mov ecx, 0x5396d8
mov dword [ebp - 0x348], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x344], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x33c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x33c]
mov ecx, eax
call fcn.00440200
test eax, eax
je 0x4403e6
cmp dword [ebp - 0x33c], 0
je 0x4403e6
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x33c], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x53ed90]
imul eax, eax
cdq
mov ecx, 0xa
idiv ecx
mov dword [ebp - 0x340], edi
cmp edx, 2
jne 0x44037c
mov ebx, dword [0x53ed90]
xor esi, esi
mov edi, ebx
lea ebx, [ebx]
inc esi
dec edi
cmp esi, 0xca
jb 0x440360
mov ebx, dword [ebp - 0x348]
mov esi, dword [ebp - 0x33c]
mov edi, dword [ebp - 0x340]
test esi, esi
jne 0x4403ba
cmp edi, 5
jne 0x4403ea
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr eax, 8
movzx esi, al
mov eax, dword [0x53ed90]
imul eax, eax
cdq
idiv edi
cmp edx, 2
jne 0x4403aa
inc dword [0x53f634]
cmp ecx, 6
ja 0x4403b6
jne 0x4403e6
cmp esi, 1
jbe 0x4403e6
mov al, 1
jmp 0x4403e8
lea edx, [ebp - 0x340]
mov ecx, esi
call fcn.00440200
test eax, eax
je 0x4403dd
cmp dword [ebp - 0x340], 0
movzx ebx, bl
mov eax, 1
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4403ea
xor al, al
mov bl, al
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x344]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440411
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x441040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xe1fc
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x53ed90]
mov ebx, 0x18
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ebx
push edi
cmp edx, 0x11
jne 0x4410da
xor eax, eax
push 0xe1c6
push eax
mov word [ebp - 0xe1fc], ax
lea eax, [ebp - 0xe1fa]
push eax
call fcn.004b1a50
add esp, 0xc
xor edi, edi
xor esi, esi
xor eax, eax
test edi, edi
je 0x4410bf
test eax, eax
je 0x4410bf
lea ecx, [esi + eax]
lea edx, [ebp - 0xe1fc]
lea edx, [edx + ecx*2]
lea ecx, [esi + eax]
mov cx, word [ebp + ecx*2 - 0xe350]
inc cx
add cx, word [edx - 2]
mov word [edx], cx
inc eax
cmp eax, 0xaa
jl 0x441097
add esi, 0xaa
inc edi
cmp esi, 0x70e4
jl 0x441095
movsx esi, word [ebp - 0x36]
lea ecx, [esi + 1]
mov eax, ecx
imul eax, esi
cdq
idiv ebx
cmp edx, 0x11
cmove esi, ecx
mov dword [0x53ed90], esi
lea eax, [esi + 2]
lea ecx, [esi + 1]
imul eax, ecx
imul eax, esi
cdq
idiv ebx
cmp edx, 0xf
jne 0x44113f
push 0x28
call fcn.004abd49
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004acfe8
add eax, dword [0x53ed90]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x441113
mov eax, dword [edi + 0x24]
push edi
mov dword [0x53ed90], eax
call fcn.004acddb
mov esi, dword [0x53ed90]
add esp, 4
cmp byte [0x53fb27], 0
jne 0x4411f1
imul esi, esi
mov eax, esi
cdq
mov edi, 0xc
idiv edi
cmp edx, 0xa
jne 0x441174
call fcn.004acfe8
mov ecx, dword [0x53ed90]
cmp ecx, eax
jne 0x441174
dec ecx
mov dword [0x53ed90], ecx
mov dword [ebp - 0x34], 0x130002
mov dword [ebp - 0x30], 0x30001
mov dword [ebp - 0x2c], 0xa0014
mov dword [ebp - 0x28], 0x16002d
mov dword [ebp - 0x24], 0x35001c
mov dword [ebp - 0x20], 0x11000c
mov dword [ebp - 0x1c], 0x30008
mov dword [ebp - 0x18], 0x1001d
mov dword [ebp - 0x14], 0x1e0031
mov dword [ebp - 0x10], 0x50004
mov dword [ebp - 0xc], 0x30011
mov dword [ebp - 8], 0x19
xor ecx, ecx
lea ebx, [ebx]
movzx eax, byte [ecx + 0x53b360]
xor ax, word [ebp + ecx*2 - 0x34]
inc ecx
mov word [ecx*2 + 0x53bd66], ax
cmp ecx, 0x17
jl 0x4411d0
mov byte [0x53fb27], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x53bd68
pop ebx
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x441280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x53ed90]
mov eax, esi
imul eax, esi
imul eax, esi
and eax, 0x8000000f
jns 0x4412ac
dec eax
or eax, 0xfffffff0
inc eax
mov ebx, 4
cmp eax, ebx
jne 0x4412e8
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004abd49
push eax
call fcn.004acddb
add esp, 8
cmp byte [0x53fb45], 0
jne 0x441397
push edi
xor eax, eax
mov dword [ebp - 0x3c], 0x4000a
mov dword [ebp - 0x38], 0x300018
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x1a0017
mov dword [ebp - 0x2c], 0xf0003
mov dword [ebp - 0x28], 0x17000c
mov dword [ebp - 0x24], 0x60008
mov dword [ebp - 0x20], 0x160036
mov dword [ebp - 0x1c], 0x4000b
mov dword [ebp - 0x18], 0x1f0002
mov dword [ebp - 0x14], 0x330010
mov dword [ebp - 0x10], 0xc0006
mov dword [ebp - 0xc], 0x1f0003
mov word [ebp - 8], ax
pop edi
jmp 0x441360
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x3c]
add eax, 2
mov word [eax*2 + 0x53b76c], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x53b76e], cx
cmp eax, 0x1a
jl 0x441360
mov byte [0x53fb45], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x53b770
pop ebx
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x4413b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x53ed90]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push ebx
cdq
mov ebx, 0x18
idiv ebx
cmp edx, 0xa
jne 0x441441
push esi
xor edx, edx
push edi
mov dword [ebp - 0x440], edx
lea edi, [ebp - 0x438]
nop
mov eax, dword [0x53ed90]
xor ebx, ebx
inc ebx
cdq
xor ecx, ecx
idiv ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], edx
lea esp, [esp]
lea esi, [ecx + 1]
mov ecx, esi
cmp ecx, 0xd
jl 0x441410
mov ebx, dword [ebp - 0x448]
mov eax, dword [0x53ed90]
add edi, 0xd
cmp ebx, 0x10
jl 0x4413f7
mov edx, dword [ebp - 0x440]
inc edx
mov dword [ebp - 0x440], edx
cmp edx, 5
jl 0x4413f0
pop edi
pop esi
cmp byte [0x53fb24], 0
jne 0x4414ef
xor eax, eax
mov dword [ebp - 0x28], 0x1a0007
mov dword [ebp - 0x24], 0x17002d
mov dword [ebp - 0x20], 0x1a0018
mov dword [ebp - 0x1c], 0xd0031
mov dword [ebp - 0x18], 0xf0017
mov dword [ebp - 0x14], 0x49
mov dword [ebp - 0x10], 0x60002
mov dword [ebp - 0xc], 0x59000c
mov word [ebp - 8], ax
xor ecx, ecx
mov edi, edi
movzx eax, byte [ecx + 0x53b360]
xor ax, word [ebp + ecx*2 - 0x28]
add ecx, 4
mov word [ecx*2 + 0x53b7f0], ax
movzx eax, byte [ecx + 0x53b35d]
xor ax, word [ebp + ecx*2 - 0x2e]
mov word [ecx*2 + 0x53b7f2], ax
movzx eax, byte [ecx + 0x53b35e]
xor ax, word [ebp + ecx*2 - 0x2c]
mov word [ecx*2 + 0x53b7f4], ax
movzx eax, byte [ecx + 0x53b35f]
xor ax, word [ebp + ecx*2 - 0x2a]
mov word [ecx*2 + 0x53b7f6], ax
cmp ecx, 0x10
jl 0x441490
mov byte [0x53fb24], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b7f8
pop ebx
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x4416d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x53ed90]
mov ecx, 0x17
lea eax, [ebx + 1]
imul eax, ebx
cdq
idiv ecx
push esi
cmp edx, 8
jne 0x441792
mov eax, ebx
cdq
sub eax, edx
push edi
lea edi, [ecx + 0x58]
xor ecx, ecx
mov esi, eax
sar esi, 1
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x58], esi
test esi, esi
jle 0x441789
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ebx, ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], esi
mov edi, edi
xor edx, edx
xor esi, esi
xor ecx, ecx
cmp eax, 2
jl 0x441761
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffffe
shr ecx, 1
inc ecx
mov eax, ebx
lea ebx, [ecx + ecx]
mov dword [ebp - 0x54], ebx
mov ebx, dword [ebp - 0x50]
nop
dec esi
add edx, eax
add esi, eax
sub eax, 2
dec ecx
jne 0x441750
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
jge 0x44176b
mov eax, ebx
sub eax, ecx
add edi, eax
mov ecx, dword [ebp - 0x48]
lea eax, [esi + edx]
add edi, eax
mov eax, dword [ebp - 0x44]
add ebx, ecx
dec dword [ebp - 0x4c]
mov dword [ebp - 0x50], ebx
jne 0x441730
mov esi, dword [ebp - 0x58]
mov ebx, dword [0x53ed90]
inc ecx
mov dword [ebp - 0x48], ecx
cmp ecx, edi
jl 0x441714
pop edi
cmp byte [0x53fb41], 0
jne 0x44184c
mov dword [ebp - 0x40], 0x160025
mov dword [ebp - 0x3c], 0x1a0002
mov dword [ebp - 0x38], 0x1a0002
mov dword [ebp - 0x34], 0xd0026
mov dword [ebp - 0x30], 0xf0018
mov dword [ebp - 0x2c], 0x330001
mov dword [ebp - 0x28], 0xb001f
mov dword [ebp - 0x24], 0xd001f
mov dword [ebp - 0x20], 0xc0002
mov dword [ebp - 0x1c], 0xe000a
mov dword [ebp - 0x18], 0x4c0006
mov dword [ebp - 0x14], 0xc0008
mov dword [ebp - 0x10], 0x70006
mov dword [ebp - 0xc], 0x14000a
mov dword [ebp - 8], 0x42
xor ecx, ecx
lea ebx, [ebx]
movzx eax, byte [ecx + 0x53b360]
xor ax, word [ebp + ecx*2 - 0x40]
inc ecx
mov word [ecx*2 + 0x53b5c2], ax
cmp ecx, 0x1d
jl 0x441810
mov eax, ebx
imul eax, ebx
imul eax, ebx
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 5
jne 0x441845
inc dword [0x53f874]
mov byte [0x53fb41], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x53b5c4
pop ebx
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x441870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb3d], 0
jne 0x441927
push esi
xor eax, eax
mov dword [ebp - 0x34], 0x1e0005
mov dword [ebp - 0x30], 0x4f0004
mov dword [ebp - 0x2c], 0x220035
mov dword [ebp - 0x28], 0x11003e
mov dword [ebp - 0x24], 0xe0053
mov dword [ebp - 0x20], 0x60000
mov dword [ebp - 0x1c], 0xc001e
mov dword [ebp - 0x18], 0x44001d
mov dword [ebp - 0x14], 0x11000b
mov dword [ebp - 0x10], 0x180004
mov dword [ebp - 0xc], 0x420001
mov word [ebp - 8], ax
pop esi
jmp 0x4418f0
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x34]
add eax, 2
mov word [eax*2 + 0x53b728], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x53b72a], cx
cmp eax, 0x16
jl 0x4418f0
mov byte [0x53fb3d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b72c
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x441a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb37], 0
jne 0x441b12
push esi
mov dword [ebp - 0x44], 0x170023
mov dword [ebp - 0x40], 0x3f001c
mov dword [ebp - 0x3c], 0x10003
mov dword [ebp - 0x38], 0x230011
mov dword [ebp - 0x34], 0xe0017
mov dword [ebp - 0x30], 0x6001d
mov dword [ebp - 0x2c], 0x11001e
mov dword [ebp - 0x28], 0xb0049
mov dword [ebp - 0x24], 0x490008
mov dword [ebp - 0x20], 0x40021
mov dword [ebp - 0x1c], 0x80014
mov dword [ebp - 0x18], 0x40022
mov dword [ebp - 0x14], 0x19000d
mov dword [ebp - 0x10], 0x2000e
mov dword [ebp - 0xc], 0x58001b
mov dword [ebp - 8], 0x4a
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x44]
inc eax
mov word [eax*2 + 0x53b5fe], cx
cmp eax, 0x1f
jl 0x441af1
mov byte [0x53fb37], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b600
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x441b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb58], 0
jne 0x441c30
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x1c0049
mov ebx, 7
mov dword [ebp - 0x18], 0x190007
mov dword [ebp - 0x14], 0x580010
mov dword [ebp - 0x10], 0x4c0046
mov dword [ebp - 0xc], 0x60017
mov dword [ebp - 8], 3
xor eax, eax
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x1c]
inc eax
mov word [eax*2 + 0x53b932], cx
cmp eax, 0xb
jl 0x441b81
mov ecx, dword [0x53ed90]
mov edi, 9
lea esi, [ecx + 1]
lea eax, [ecx + 2]
imul eax, esi
imul eax, ecx
cdq
idiv edi
mov byte [0x53fb58], 1
cmp edx, 1
jne 0x441c2d
mov eax, ecx
imul eax, ecx
cdq
mov edi, 0xe
idiv edi
cmp edx, 0xd
je 0x441c2d
imul esi, ecx
mov eax, esi
cdq
idiv ebx
cmp edx, 1
jne 0x441c2d
mov ax, word [0x51fd7c]
movq xmm0, qword [str.1OXWNlyq0K]
mov word [ebp - 0x20], ax
mov al, byte [0x51fd7e]
mov byte [ebp - 0x1e], al
lea eax, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x441c05
sub eax, edx
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004abd49
push eax
call fcn.004acddb
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53b934
call fcn.004ac57a
mov esp, ebp
pop ebp
ret

Function at 0x441c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53fb34], 0
jne 0x441d6f
mov edx, dword [0x53ed90]
xor eax, eax
mov word [ebp - 8], ax
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
push esi
mov esi, 0x18
cdq
idiv esi
mov dword [ebp - 0x48], 0x1e0005
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x40], 0x4e0012
mov dword [ebp - 0x3c], 0x30014
mov dword [ebp - 0x38], 0x6001a
mov dword [ebp - 0x34], 0x7000a
mov dword [ebp - 0x30], 0x12004d
mov dword [ebp - 0x2c], 0xb001b
mov dword [ebp - 0x28], 0x49000d
mov dword [ebp - 0x24], 0x180004
mov dword [ebp - 0x20], 0x180055
mov dword [ebp - 0x1c], 0x1f000b
mov dword [ebp - 0x18], 0x20002
mov dword [ebp - 0x14], 0x110001
mov dword [ebp - 0x10], 0xb0016
mov dword [ebp - 0xc], 0xc0004
pop esi
cmp edx, 0x17
jne 0x441d0a
inc dword [0x53f8cc]
xor eax, eax
lea esp, [esp]
movzx ecx, byte [eax + 0x53b360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 4
mov word [eax*2 + 0x53bcd8], cx
movzx ecx, byte [eax + 0x53b35d]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x53bcda], cx
movzx ecx, byte [eax + 0x53b35e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x53bcdc], cx
movzx ecx, byte [eax + 0x53b35f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x53bcde], cx
cmp eax, 0x20
jl 0x441d10
mov byte [0x53fb34], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x53bce0
call fcn.004ac57a
mov esp, ebp
pop ebp
ret