joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x545d90]
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul edx, eax
imul edx, ecx
and edx, 0x80000003
jns 0x44579f
dec edx
or edx, 0xfffffffc
inc edx
mov eax, dword [0x546e6c]
cmp edx, 3
mov ecx, 0xa3f3603d
cmove eax, ecx
cmp byte [0x547052], 0
mov dword [0x546e6c], eax
jne 0x445873
mov dword [ebp - 0x24], 0x10002d
mov dword [ebp - 0x20], 0x4000c
mov dword [ebp - 0x1c], 0x90000
mov dword [ebp - 0x18], 0xa0030
mov dword [ebp - 0x14], 0x60006
mov dword [ebp - 0x10], 0x150003
mov dword [ebp - 0xc], 0x1e0020
mov dword [ebp - 8], 0x51
xor eax, eax
jmp 0x445800
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x5429b6], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x5429b8], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x5429ba], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x5429bc], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x5429be], cx
cmp eax, 0xf
jl 0x445800
mov byte [0x547052], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x5429c0
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x445890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x545d90]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 6
idiv ecx
cmp edx, 4
jne 0x4458ce
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, dword [0x545d90]
cmp byte [0x547046], 0
jne 0x4459b3
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0xf
idiv ecx
mov dword [ebp - 0x24], 0xf0007
mov dword [ebp - 0x20], 0x20008
mov dword [ebp - 0x1c], 0x4c0011
mov dword [ebp - 0x18], 0x100014
mov dword [ebp - 0x14], 0x1b
mov dword [ebp - 0x10], 0x1f0042
mov dword [ebp - 0xc], 0xb0004
mov dword [ebp - 8], 0xe
cmp edx, 1
jne 0x44593d
push 0xac
push 0xab
push 0x52630c
call fcn.004b05f1
add esp, 0xc
xor eax, eax
nop
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x542a62], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x542a64], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x542a66], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x542a68], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x542a6a], cx
cmp eax, 0xf
jl 0x445940
mov byte [0x547046], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542a6c
pop esi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x445c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547059], 0
jne 0x445dc7
xor eax, eax
push ebx
push esi
mov esi, dword [0x545d90]
mov word [ebp - 8], ax
lea ecx, [esi + 2]
lea eax, [esi + 1]
imul eax, ecx
imul eax, esi
push edi
cdq
mov edi, 0x17
idiv edi
mov dword [ebp - 0x38], 0x3000d
mov dword [ebp - 0x34], 0x110007
mov dword [ebp - 0x30], 0xd0054
mov dword [ebp - 0x2c], 0xe0008
mov dword [ebp - 0x28], 0x1b
mov dword [ebp - 0x24], 0x100042
mov dword [ebp - 0x20], 0x50006
mov dword [ebp - 0x1c], 0x17000e
mov dword [ebp - 0x18], 0x500011
mov dword [ebp - 0x14], 0x90014
mov dword [ebp - 0x10], 0x80008
mov dword [ebp - 0xc], 0x9000d
cmp edx, 0xb
jne 0x445d15
mov edx, 1
mov eax, edx
mov ecx, 4
dec ecx
lea esi, [eax + edx]
lea edx, [eax]
mov eax, esi
jns 0x445d05
mov dword [0x545d90], esi
xor ecx, ecx
jmp 0x445d20
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x38]
movzx edx, byte [ecx + 0x542365]
mov word [ecx*2 + 0x54295c], ax
movzx eax, byte [ecx + 0x542361]
xor ax, word [ebp + ecx*2 - 0x36]
xor dx, word [ebp + ecx*2 - 0x2e]
mov word [ecx*2 + 0x54295e], ax
movzx eax, byte [ecx + 0x542362]
xor ax, word [ebp + ecx*2 - 0x34]
mov word [ecx*2 + 0x542966], dx
mov word [ecx*2 + 0x542960], ax
movzx eax, byte [ecx + 0x542363]
xor ax, word [ebp + ecx*2 - 0x32]
add ecx, 6
mov word [ecx*2 + 0x542956], ax
movzx eax, byte [ecx + 0x54235e]
xor ax, word [ebp + ecx*2 - 0x3c]
mov word [ecx*2 + 0x542958], ax
cmp ecx, 0x18
jl 0x445d20
imul esi, esi
mov eax, esi
cdq
mov ecx, 0x14
idiv ecx
pop edi
pop esi
pop ebx
cmp edx, 0xa
jne 0x445dc0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x545d90], eax
mov byte [0x547059], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x54295c
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x445eb0
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x545d90]
push ebx
push esi
push edi
mov edi, ecx
imul edi, ecx
mov esi, edi
imul esi, ecx
mov eax, esi
cdq
mov ebx, 0x12
idiv ebx
mov ebx, 0xe
cmp edx, 4
jne 0x445f25
and esi, 0x8000000f
jns 0x445ef4
dec esi
or esi, 0xfffffff0
inc esi
cmp esi, 6
je 0x445f13
mov eax, edi
cdq
idiv ebx
cmp edx, 0xc
jne 0x445f13
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 4
call fcn.004afe4a
mov ecx, dword [0x545d90]
add esp, 4
mov dword [eax], ecx
cmp byte [0x547057], 0
jne 0x445fa3
imul ecx, ecx
mov eax, ecx
cdq
idiv ebx
cmp edx, 5
jne 0x445f41
inc dword [0x546c3c]
mov dword [ebp - 0x28], 0x140000
mov dword [ebp - 0x24], 0x3a0019
mov dword [ebp - 0x20], 0x1c001d
mov dword [ebp - 0x1c], 0x3d0007
mov dword [ebp - 0x18], 0x1b0011
mov dword [ebp - 0x14], 0x140001
mov dword [ebp - 0x10], 0x120015
mov dword [ebp - 0xc], 0xb0002
mov dword [ebp - 8], 0xc
xor ecx, ecx
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x28]
inc ecx
mov word [ecx*2 + 0x54272a], ax
cmp ecx, 0x11
jl 0x445f82
mov byte [0x547057], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x54272c
pop ebx
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x4460c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547043], 0
jne 0x4461df
xor eax, eax
push ebx
mov ebx, dword [0x545d90]
mov word [ebp - 8], ax
lea eax, [ebx + 1]
imul eax, ebx
push esi
cdq
mov esi, 0xc
idiv esi
mov dword [ebp - 0x40], 0x140000
mov dword [ebp - 0x3c], 0x3a0019
mov dword [ebp - 0x38], 0x50012
mov dword [ebp - 0x34], 0x110016
mov dword [ebp - 0x30], 0x3c0000
mov dword [ebp - 0x2c], 0x1f000b
mov dword [ebp - 0x28], 0x3000f
mov dword [ebp - 0x24], 0x100008
mov dword [ebp - 0x20], 0x1f000b
mov dword [ebp - 0x1c], 0x33001e
mov dword [ebp - 0x18], 0x40002
mov dword [ebp - 0x14], 0x8001c
mov dword [ebp - 0x10], 0x1d000a
mov dword [ebp - 0xc], 0xa000c
cmp edx, 5
jne 0x446173
push edi
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0xd5
jb 0x446168
pop edi
pop esi
xor eax, eax
pop ebx
jmp 0x446180
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x40]
add eax, 4
mov word [eax*2 + 0x542c7c], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x46]
mov word [eax*2 + 0x542c7e], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x44]
mov word [eax*2 + 0x542c80], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x542c82], cx
cmp eax, 0x1c
jl 0x446180
mov byte [0x547043], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542c84
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x446200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x545d90]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 2
jne 0x446251
lea eax, [ecx + 0x21]
mov esi, 0xb3
test esi, esi
je 0x446249
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x446238
add esi, eax
mov dword [0x545d90], esi
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, 7
idiv ecx
cmp edx, 3
jne 0x446276
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp byte [0x547039], 0
jne 0x44634b
push ebx
push edi
pop edi
mov dword [ebp - 0x48], 0x10000b
mov dword [ebp - 0x44], 0xa001b
mov dword [ebp - 0x40], 0x4c0006
mov dword [ebp - 0x3c], 0x70003
mov dword [ebp - 0x38], 0x170000
mov dword [ebp - 0x34], 0x1f000b
mov dword [ebp - 0x30], 0x460002
mov dword [ebp - 0x2c], 0xd000d
mov dword [ebp - 0x28], 0x30010
mov dword [ebp - 0x24], 0x4c0004
mov dword [ebp - 0x20], 0x130016
mov dword [ebp - 0x1c], 0xe0007
mov dword [ebp - 0x18], 0x1a000c
mov dword [ebp - 0x14], 0x4e001a
mov dword [ebp - 0x10], 0x1b0000
mov dword [ebp - 0xc], 0x30016
mov dword [ebp - 8], 0x4b
xor eax, eax
pop ebx
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 3
mov word [eax*2 + 0x542482], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x542484], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x542486], cx
cmp eax, 0x21
jl 0x446300
mov byte [0x547039], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542488
pop esi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x446360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547050], 0
jne 0x4463d1
mov dword [ebp - 0x1c], 0x70018
mov dword [ebp - 0x18], 0x16001b
mov dword [ebp - 0x14], 0x3001d
mov dword [ebp - 0x10], 0x42000a
mov dword [ebp - 0xc], 0x110011
mov dword [ebp - 8], 0x10
xor eax, eax
jmp 0x4463b0
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x1c]
inc eax
mov word [eax*2 + 0x5427c6], cx
cmp eax, 0xb
jl 0x4463b0
mov byte [0x547050], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x5427c8
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x4463f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547064], 0
jne 0x446584
push ebx
push esi
mov esi, dword [0x545d90]
push edi
lea eax, [esi + 1]
imul eax, esi
mov edi, 0xb
cdq
idiv edi
mov dword [ebp - 0x24], 0x120021
mov dword [ebp - 0x20], 0xb000c
mov dword [ebp - 0x1c], 0x1e0024
mov dword [ebp - 0x18], 0x1000b
lea ebx, [edi - 0xa]
mov dword [ebp - 0x14], 0x100011
mov dword [ebp - 0x10], 0x510011
mov dword [ebp - 0xc], 0x130006
mov dword [ebp - 8], 0x19
cmp edx, 5
jne 0x44646f
test esi, esi
cmove esi, ebx
mov dword [0x545d90], esi
xor eax, eax
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x54278a], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x54278c], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x54278e], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x542790], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x542792], cx
cmp eax, 0xf
jl 0x446471
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x13
idiv ecx
mov byte [0x547064], bl
cmp edx, 4
jne 0x446581
xor edx, edx
mov ecx, edx
and ecx, ebx
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, ebx
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, ebx
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, ebx
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x446502
mov dword [0x545d90], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542794
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x446650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x545d90]
push edi
lea eax, [esi + 1]
imul eax, esi
cdq
mov edi, 0xf
idiv edi
cmp edx, 1
jne 0x446704
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x446681
mov dword [0x545d90], esi
cmp byte [0x547073], 0
jne 0x4467a4
mov dword [ebp - 0x44], 0x10002d
mov dword [ebp - 0x40], 0x4000c
mov dword [ebp - 0x3c], 0x90000
mov dword [ebp - 0x38], 0xd0030
mov dword [ebp - 0x34], 0xf001b
mov dword [ebp - 0x30], 0x14000a
mov dword [ebp - 0x2c], 0x160009
mov dword [ebp - 0x28], 0x560058
mov dword [ebp - 0x24], 0x1e0031
mov dword [ebp - 0x20], 0x1c0011
mov dword [ebp - 0x1c], 0x90015
mov dword [ebp - 0x18], 0x190007
mov dword [ebp - 0x14], 0xf0049
mov dword [ebp - 0x10], 0x70008
mov dword [ebp - 0xc], 0x100005
mov dword [ebp - 8], 0x14
xor eax, eax
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x44]
inc eax
mov word [eax*2 + 0x54254e], cx
cmp eax, 0x1f
jl 0x446783
mov byte [0x547073], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x542550
pop esi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x4467c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54706f], 0
jne 0x4468a3
push esi
xor eax, eax
mov dword [ebp - 0x30], 0x100039
mov dword [ebp - 0x2c], 0x110000
mov dword [ebp - 0x28], 0x3c0011
mov dword [ebp - 0x24], 0xd0016
mov dword [ebp - 0x20], 0x60017
mov dword [ebp - 0x1c], 0x20011
mov dword [ebp - 0x18], 0x30028
mov dword [ebp - 0x14], 0xb0006
mov dword [ebp - 0x10], 0x90010
mov dword [ebp - 0xc], 0x4c004a
mov word [ebp - 8], ax
pop esi
jmp 0x446830
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x30]
add eax, 5
mov word [eax*2 + 0x542d62], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x38]
mov word [eax*2 + 0x542d64], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x542d66], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x34]
mov word [eax*2 + 0x542d68], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x32]
mov word [eax*2 + 0x542d6a], cx
cmp eax, 0x14
jl 0x446830
mov byte [0x54706f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542d6c
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x4468c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac4
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547067], 0
jne 0x446a00
xor eax, eax
mov dword [ebp - 0x28], 0x70018
mov dword [ebp - 0x24], 0x16001b
mov dword [ebp - 0x20], 0x3001d
mov dword [ebp - 0x1c], 0x58000a
mov dword [ebp - 0x18], 0x530054
mov dword [ebp - 0x14], 0x41004c
mov dword [ebp - 0x10], 0x56004b
mov dword [ebp - 0xc], 0x540045
mov word [ebp - 8], ax
xor ecx, ecx
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x28]
add ecx, 4
mov word [ecx*2 + 0x542994], ax
movzx eax, byte [ecx + 0x54235d]
xor ax, word [ebp + ecx*2 - 0x2e]
mov word [ecx*2 + 0x542996], ax
movzx eax, byte [ecx + 0x54235e]
xor ax, word [ebp + ecx*2 - 0x2c]
mov word [ecx*2 + 0x542998], ax
movzx eax, byte [ecx + 0x54235f]
xor ax, word [ebp + ecx*2 - 0x2a]
mov word [ecx*2 + 0x54299a], ax
cmp ecx, 0x10
jl 0x446920
mov edx, dword [0x545d90]
lea ecx, [edx + 2]
lea eax, [edx + 1]
imul ecx, eax
imul ecx, edx
and ecx, 0x80000003
jns 0x446997
dec ecx
or ecx, 0xfffffffc
inc ecx
cmp ecx, 3
jne 0x4469f9
push ebx
push esi
xor ecx, ecx
push edi
mov dword [ebp - 0xabc], ecx
lea edi, [ebp - 0xab4]
lea ecx, [ecx]
xor ebx, ebx
mov eax, edx
inc ebx
cdq
xor ecx, ecx
idiv ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xac0], edx
lea esi, [ecx + 1]
mov ecx, esi
cmp ecx, 0xf
jl 0x4469c6
mov ebx, dword [ebp - 0xac4]
mov edx, dword [0x545d90]
add edi, 0xf
cmp ebx, 0xf
jl 0x4469b2
mov ecx, dword [ebp - 0xabc]
inc ecx
mov dword [ebp - 0xabc], ecx
cmp ecx, 0xc
jl 0x4469b0
pop edi
pop esi
pop ebx
mov byte [0x547067], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x54299c
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x446a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547055], 0
jne 0x446b3b
push esi
push edi
mov dword [ebp - 0x24], 0xf0007
mov edi, 0xf
mov dword [ebp - 0x20], 0x20008
mov dword [ebp - 0x1c], 0x4c0011
mov dword [ebp - 0x18], 0x3000a
mov dword [ebp - 0x14], 0x60019
mov dword [ebp - 0x10], 0x20042
mov dword [ebp - 0xc], 0xa0000
mov dword [ebp - 8], 0xd
xor eax, eax
mov edi, edi
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x24]
add eax, 5
mov word [eax*2 + 0x5428b6], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x5428b8], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x5428ba], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x5428bc], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x5428be], cx
cmp eax, 0xf
jl 0x446a80
mov esi, dword [0x545d90]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 0xa
jne 0x446b1b
call fcn.004aff67
mov esi, dword [0x545d90]
cmp esi, eax
jne 0x446b1b
dec esi
lea ecx, [esi + 1]
mov eax, ecx
imul eax, esi
cdq
idiv edi
pop edi
mov byte [0x547055], 1
cmp edx, 1
cmove esi, ecx
mov dword [0x545d90], esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x5428c0
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x446c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x545d90]
push edi
lea eax, [esi + 1]
imul eax, esi
and eax, 0x80000003
jns 0x446c5a
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 1
jne 0x446c75
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov esi, dword [0x545d90]
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0x17
idiv ecx
lea edi, [ecx - 0x13]
cmp edx, 0x10
jne 0x446cbe
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aed89
push eax
call fcn.004afe1b
add esp, 8
cmp byte [0x547071], 0
jne 0x446db7
xor eax, eax
mov dword [ebp - 0x38], 0x3000d
mov dword [ebp - 0x34], 0x110007
mov dword [ebp - 0x30], 0xd0054
mov dword [ebp - 0x2c], 0xe0008
mov dword [ebp - 0x28], 0x1b
mov dword [ebp - 0x24], 0x1e0042
mov dword [ebp - 0x20], 0x120010
mov dword [ebp - 0x1c], 0xb004b
mov dword [ebp - 0x18], 0x500004
mov dword [ebp - 0x14], 0x9001d
mov dword [ebp - 0x10], 0xe000b
mov dword [ebp - 0xc], 0x14001a
mov word [ebp - 8], ax
jmp 0x446d30
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x5425f0], cx
movzx ecx, byte [eax + 0x54235b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x5425f2], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x5425f4], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x5425f6], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x5425f8], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x5425fa], cx
cmp eax, 0x18
jl 0x446d30
mov byte [0x547071], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x5425fc
pop esi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x446dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547065], 0
jne 0x446e54
push esi
mov dword [ebp - 0x2c], 0x7003c
mov dword [ebp - 0x28], 0x10008
mov dword [ebp - 0x24], 0x1e0024
mov dword [ebp - 0x20], 0x1000b
mov dword [ebp - 0x1c], 0x100011
mov dword [ebp - 0x18], 0x3c0011
mov dword [ebp - 0x14], 0xb0000
mov dword [ebp - 0x10], 0x160004
mov dword [ebp - 0xc], 0x4a001b
mov dword [ebp - 8], 0x50
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x2c]
inc eax
mov word [eax*2 + 0x542b42], cx
cmp eax, 0x13
jl 0x446e33
mov byte [0x547065], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542b44
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x446e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54705b], 0
jne 0x446f02
push esi
mov dword [ebp - 0x34], 0x3000d
mov dword [ebp - 0x30], 0x110007
mov dword [ebp - 0x2c], 0x54
mov dword [ebp - 0x28], 0x3000b
mov dword [ebp - 0x24], 0x430010
mov dword [ebp - 0x20], 0x450054
mov dword [ebp - 0x1c], 0x40045
mov dword [ebp - 0x18], 0x100002
mov dword [ebp - 0x14], 0x1d0042
mov dword [ebp - 0x10], 0x8001f
mov dword [ebp - 0xc], 0xd0013
mov dword [ebp - 8], 0xd
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x34]
inc eax
mov word [eax*2 + 0x542c52], cx
cmp eax, 0x17
jl 0x446ee1
mov byte [0x54705b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542c54
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x446f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x545d90]
push ebx
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
mov ebx, 0x16
idiv ebx
cmp edx, 0xe
jne 0x446ff6
push esi
xor eax, eax
push edi
mov dword [ebp - 0x158], eax
lea esi, [ebp - 0x154]
jmp 0x446f70
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], esi
mov edi, edi
lea esi, [eax + 1]
lea ebx, [edx + 1]
mov eax, ecx
cdq
idiv esi
mov eax, ecx
mov esi, ecx
sub esi, dword [ebp - 0x158]
mov edi, edx
cdq
imul edi, esi
idiv ebx
mov esi, dword [ebp - 0x15c]
add edi, eax
sub edi, dword [ebp - 0x160]
push edi
push 0x526308
call fcn.004b05f1
mov eax, dword [ebp - 0x158]
mov edx, ebx
add esi, 4
add esp, 8
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], esi
cmp edx, 4
jge 0x446fdd
mov ecx, dword [0x545d90]
jmp 0x446f80
inc eax
mov dword [ebp - 0x158], eax
cmp eax, 0x13
jge 0x446ff4
mov ecx, dword [0x545d90]
jmp 0x446f70
pop edi
pop esi
cmp byte [0x54705c], 0
jne 0x447077
xor eax, eax
mov dword [ebp - 0x24], 0xd0000
mov dword [ebp - 0x20], 0x4001f
mov dword [ebp - 0x1c], 0x90059
mov dword [ebp - 0x18], 0x100016
mov dword [ebp - 0x14], 0x11001b
mov dword [ebp - 0x10], 0x16004c
mov dword [ebp - 0xc], 0xc
mov word [ebp - 8], ax
xor ecx, ecx
jmp 0x447040
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x24]
add ecx, 2
mov word [ecx*2 + 0x542b20], ax
movzx eax, byte [ecx + 0x54235f]
xor ax, word [ebp + ecx*2 - 0x26]
mov word [ecx*2 + 0x542b22], ax
cmp ecx, 0xe
jl 0x447040
mov byte [0x54705c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542b24
pop ebx
call fcn.004af5ba
mov esp, ebp
pop ebp
ret