joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d51fe
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xc4], 0
mov eax, dword [0x531d90]
mov ecx, eax
imul ecx, eax
imul eax, ecx
cdq
mov ecx, 0x15
idiv ecx
mov dword [ebp - 0xcc], esi
cmp edx, 0x11
jne 0x43e5b0
dec dword [0x53248c]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [0x531d90]
mov ebx, eax
movzx eax, bl
mov dword [ebp - 0xc0], eax
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0xc8], eax
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 0x16
jne 0x43e5fd
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp ebx, 0x80000000
jae 0x43e60a
mov edi, ebx
shr edi, 0x10
mov ebx, dword [ebp - 0xc0]
cmp ebx, 6
jb 0x43e638
cmp dword [ebp - 0xc8], 2
jb 0x43e638
mov ecx, esi
call fcn.0043e8e0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc4], 1
jmp 0x43e6b2
mov eax, dword [0x52c6d8]
mov ecx, 0x52c6d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc0], eax
mov dword [ebp - 4], 2
push edi
push dword [ebp - 0xc8]
lea eax, [ebp - 0xc0]
push ebx
push str._d._d___d_
push eax
call fcn.00410de0
mov edi, dword [ebp - 0xc0]
add edi, 0xfffffff0
add esp, 0x14
mov ecx, edi
call fcn.004027c0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0xc4], 1
mov dword [ebp - 4], 0
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e6b2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x43ecc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5368
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x52cc80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x52c6d8]
mov ecx, 0x52c6d8
xor bl, bl
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.0043ec40
test eax, eax
je 0x43ed8a
cmp dword [ebp - 0x10], 0
je 0x43ed8a
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x43ed64
cmp eax, 5
jne 0x43ed8e
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr eax, 8
movzx eax, al
cmp ecx, 6
ja 0x43ed60
jne 0x43ed8a
cmp eax, 1
jbe 0x43ed8a
mov al, 1
jmp 0x43ed8c
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.0043ec40
test eax, eax
je 0x43ed81
cmp dword [ebp - 0x10], 0
movzx ebx, bl
mov eax, 1
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43ed8e
xor al, al
mov bl, al
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43edb2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532791], 0
jne 0x43f8d4
push esi
push edi
pop edi
mov dword [ebp - 0x34], 0xd0008
mov dword [ebp - 0x30], 0xd0000
mov dword [ebp - 0x2c], 0x8000a
mov dword [ebp - 0x28], 0x60037
mov dword [ebp - 0x24], 0x2d0003
mov dword [ebp - 0x20], 0x1a0000
mov dword [ebp - 0x1c], 0xe0007
mov dword [ebp - 0x18], 0x10001d
mov dword [ebp - 0x14], 0x1d002a
mov dword [ebp - 0x10], 0x6001a
mov dword [ebp - 0xc], 0x1d0007
mov dword [ebp - 8], 2
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x34]
inc eax
mov word [eax*2 + 0x52e856], cx
cmp eax, 0x17
jl 0x43f8b3
mov byte [0x532791], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e858
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x43f960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x531d90]
push edi
lea ecx, [esi + 1]
mov eax, ecx
imul eax, esi
cdq
mov edi, 0xa
idiv edi
cmp edx, 8
cmove esi, ecx
cmp byte [0x532784], 0
mov dword [0x531d90], esi
jne 0x43fa47
xor eax, eax
mov dword [ebp - 0x3c], 0x1a0000
mov dword [ebp - 0x38], 0x3e0019
mov dword [ebp - 0x34], 0x2001a
mov dword [ebp - 0x30], 0xa000d
mov dword [ebp - 0x2c], 0x17001c
mov dword [ebp - 0x28], 0x1c0000
mov dword [ebp - 0x24], 0xb0007
mov dword [ebp - 0x20], 0x70036
mov dword [ebp - 0x1c], 0x70010
mov dword [ebp - 0x18], 0x1c001c
mov dword [ebp - 0x14], 0x2d0006
mov dword [ebp - 0x10], 0x12001d
mov dword [ebp - 0xc], 0x16001c
mov word [ebp - 8], ax
jmp 0x43fa10
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x3c]
add eax, 2
mov word [eax*2 + 0x52eb10], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x52eb12], cx
cmp eax, 0x1a
jl 0x43fa10
mov byte [0x532784], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x52eb14
pop esi
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x43fa60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53277c], 0
jne 0x43fb1f
xor eax, eax
mov dword [ebp - 0x28], 0x4000d
mov dword [ebp - 0x24], 0x19002c
mov dword [ebp - 0x20], 0x180006
mov dword [ebp - 0x1c], 0x1d002b
mov dword [ebp - 0x18], 0x170008
mov dword [ebp - 0x14], 0xb0045
mov dword [ebp - 0x10], 0xb000d
mov dword [ebp - 0xc], 0x48000c
mov word [ebp - 8], ax
jmp 0x43fac0
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x52e780], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x52e782], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52e784], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52e786], cx
cmp eax, 0x10
jl 0x43fac0
mov byte [0x53277c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e788
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x43fce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532781], 0
jne 0x43fdb5
push esi
push edi
mov dword [ebp - 0x40], 0x8002f
mov dword [ebp - 0x3c], 0x140003
mov dword [ebp - 0x38], 0x18001c
mov dword [ebp - 0x34], 0x1d003c
mov dword [ebp - 0x30], 0x170007
mov edi, 0xd
mov dword [ebp - 0x2c], 0x38000d
mov dword [ebp - 0x28], 0x60010
mov dword [ebp - 0x24], 0x1c001f
mov dword [ebp - 0x20], 0xf0019
mov dword [ebp - 0x1c], 0xd0014
mov dword [ebp - 0x18], 0x520010
mov dword [ebp - 0x14], 0x120013
mov dword [ebp - 0x10], 0xe0019
mov dword [ebp - 0xc], 0x9000c
mov dword [ebp - 8], 0x50
xor eax, eax
nop
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x40]
inc eax
mov word [eax*2 + 0x52e606], cx
cmp eax, 0x1d
jl 0x43fd70
mov eax, dword [0x531d90]
imul eax, eax
cdq
idiv edi
pop edi
pop esi
cmp edx, 6
jne 0x43fdae
push 4
call fcn.004aa1ba
mov ecx, dword [0x531d90]
add esp, 4
mov dword [eax], ecx
mov byte [0x532781], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e608
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x43fdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53277e], 0
jne 0x43fe77
xor eax, eax
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x30], 0x410005
mov dword [ebp - 0x2c], 0x20002b
mov dword [ebp - 0x28], 0x10024
mov dword [ebp - 0x24], 0x16004c
mov dword [ebp - 0x20], 0xd000c
mov dword [ebp - 0x1c], 0x10011
mov dword [ebp - 0x18], 0x55001d
mov dword [ebp - 0x14], 0x120010
mov dword [ebp - 0x10], 0x1b001a
mov dword [ebp - 0xc], 0x5c0017
mov word [ebp - 8], ax
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x34]
add eax, 2
mov word [eax*2 + 0x52e720], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x52e722], cx
cmp eax, 0x16
jl 0x43fe40
mov byte [0x53277e], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e724
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x43fff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532774], 0
jne 0x4400a4
push esi
push edi
pop edi
mov dword [ebp - 0x44], 0x90029
mov dword [ebp - 0x40], 0x31001d
mov dword [ebp - 0x3c], 0x3001d
mov dword [ebp - 0x38], 0x33000b
mov dword [ebp - 0x34], 0x160008
mov dword [ebp - 0x30], 0xd0011
mov dword [ebp - 0x2c], 0x1c0011
mov dword [ebp - 0x28], 0x1a0049
mov dword [ebp - 0x24], 0x4a0013
mov dword [ebp - 0x20], 0x7003f
mov dword [ebp - 0x1c], 0x160002
mov dword [ebp - 0x18], 0x1a0039
mov dword [ebp - 0x14], 0x100012
mov dword [ebp - 0x10], 0x1f0008
mov dword [ebp - 0xc], 0x480009
mov dword [ebp - 8], 0x4e
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x44]
inc eax
mov word [eax*2 + 0x52e646], cx
cmp eax, 0x1f
jl 0x440083
mov byte [0x532774], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e648
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x4400c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532799], 0
jne 0x440131
mov dword [ebp - 0x1c], 0x20043
mov dword [ebp - 0x18], 0x170006
mov dword [ebp - 0x14], 0x5a000e
mov dword [ebp - 0x10], 0x5c005c
mov dword [ebp - 0xc], 0x1e0008
mov dword [ebp - 8], 0xf
xor eax, eax
jmp 0x440110
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x1c]
inc eax
mov word [eax*2 + 0x52e91a], cx
cmp eax, 0xb
jl 0x440110
mov byte [0x532799], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e91c
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x440150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532771], 0
jne 0x44024f
push ebx
push esi
push edi
pop edi
xor eax, eax
pop esi
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x44], 0xe0005
mov dword [ebp - 0x40], 0x4c000c
mov dword [ebp - 0x3c], 0x13000e
mov dword [ebp - 0x38], 0x1e0005
mov dword [ebp - 0x34], 0xc0006
mov dword [ebp - 0x30], 0x1f0042
mov dword [ebp - 0x2c], 0x1a001b
mov dword [ebp - 0x28], 0x4a0016
mov dword [ebp - 0x24], 0x1b001a
mov dword [ebp - 0x20], 0x60043
mov dword [ebp - 0x1c], 0x10010
mov dword [ebp - 0x18], 0xb001d
mov dword [ebp - 0x14], 0xc0007
mov dword [ebp - 0x10], 0x1b0004
mov dword [ebp - 0xc], 0x130000
mov word [ebp - 8], ax
pop ebx
lea esp, [esp]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 4
mov word [eax*2 + 0x52ed28], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x52ed2a], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x52ed2c], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x52ed2e], cx
cmp eax, 0x20
jl 0x4401f0
mov byte [0x532771], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ed30
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x440270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53278a], 0
jne 0x440367
xor eax, eax
mov dword [ebp - 0x2c], 0x4000d
mov dword [ebp - 0x28], 0x170036
mov dword [ebp - 0x24], 0x1e000a
mov dword [ebp - 0x20], 0x1b001b
mov dword [ebp - 0x1c], 0x1c0003
mov dword [ebp - 0x18], 0xb003c
mov dword [ebp - 0x14], 0xe000a
mov dword [ebp - 0x10], 0x120007
mov dword [ebp - 0xc], 0x350010
mov word [ebp - 8], ax
jmp 0x4402e0
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x2c]
add eax, 6
mov word [eax*2 + 0x52ea64], cx
movzx ecx, byte [eax + 0x52e35b]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x52ea66], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x34]
mov word [eax*2 + 0x52ea68], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x32]
mov word [eax*2 + 0x52ea6a], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x30]
mov word [eax*2 + 0x52ea6c], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x52ea6e], cx
cmp eax, 0x12
jl 0x4402e0
mov byte [0x53278a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ea70
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x4403d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53276b], 0
jne 0x440464
push esi
push edi
pop edi
mov dword [ebp - 0x34], 0xd000d
mov dword [ebp - 0x30], 0x150007
mov dword [ebp - 0x2c], 0xa004f
mov dword [ebp - 0x28], 0x1c0001
mov dword [ebp - 0x24], 0x520008
mov dword [ebp - 0x20], 0x1d0000
mov dword [ebp - 0x1c], 0x1d0010
mov dword [ebp - 0x18], 0x1b000c
mov dword [ebp - 0x14], 0x270001
mov dword [ebp - 0x10], 0xc001c
mov dword [ebp - 0xc], 0x1e0016
mov dword [ebp - 8], 0x10
xor eax, eax
pop esi
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x34]
inc eax
mov word [eax*2 + 0x52ecc2], cx
cmp eax, 0x17
jl 0x440443
mov byte [0x53276b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ecc4
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x440480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532797], 0
jne 0x44053f
xor eax, eax
mov dword [ebp - 0x28], 0x1a0000
mov dword [ebp - 0x24], 0x3e0019
mov dword [ebp - 0x20], 0x1c0006
mov dword [ebp - 0x1c], 0x2d000b
mov dword [ebp - 0x18], 0x1b0018
mov dword [ebp - 0x14], 0xd000e
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0x1001c
mov word [ebp - 8], ax
jmp 0x4404e0
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x52e82c], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x52e82e], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x52e830], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52e832], cx
cmp eax, 0x10
jl 0x4404e0
mov byte [0x532797], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e834
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x440560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53276d], 0
jne 0x4406d7
mov edx, dword [0x531d90]
push ebx
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x14
idiv ecx
push esi
push edi
lea ebx, [ecx - 0x10]
cmp edx, 5
jne 0x4405ea
mov ax, word [0x513c6c]
movq xmm0, qword [str.eFg465IP3M]
mov word [ebp - 0x3c], ax
mov al, byte [0x513c6e]
mov byte [ebp - 0x3a], al
lea eax, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4405c7
xor ecx, ecx
sub eax, edx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a90f9
push eax
call fcn.004aa18b
add esp, 8
pop edi
xor eax, eax
pop esi
mov dword [ebp - 0x38], 0x1c0021
mov dword [ebp - 0x34], 0xf000c
mov dword [ebp - 0x30], 0x1e003f
mov dword [ebp - 0x2c], 0x110007
mov dword [ebp - 0x28], 0x10009
mov dword [ebp - 0x24], 0x3c0010
mov dword [ebp - 0x20], 0x4000d
mov dword [ebp - 0x1c], 0x1b000c
mov dword [ebp - 0x18], 0xc0055
mov dword [ebp - 0x14], 0x10012
mov dword [ebp - 0x10], 0x17000f
mov dword [ebp - 0xc], 0x530011
mov word [ebp - 8], ax
pop ebx
jmp 0x440650
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x52e67c], cx
movzx ecx, byte [eax + 0x52e35b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x52e67e], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x52e680], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x52e682], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x52e684], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x52e686], cx
cmp eax, 0x18
jl 0x440650
mov byte [0x53276d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e688
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x4406f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5327a0], 0
jne 0x4407d3
xor eax, eax
mov dword [ebp - 0x30], 0x1e002d
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x28], 0x9001b
mov dword [ebp - 0x24], 0x17003a
mov dword [ebp - 0x20], 0x1d0001
mov dword [ebp - 0x1c], 0xd0017
mov dword [ebp - 0x18], 0x70036
mov dword [ebp - 0x14], 0x10001b
mov dword [ebp - 0x10], 0xe0014
mov dword [ebp - 0xc], 0x480049
mov word [ebp - 8], ax
lea esp, [esp]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x30]
add eax, 5
mov word [eax*2 + 0x52e48a], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x38]
mov word [eax*2 + 0x52e48c], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x52e48e], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x34]
mov word [eax*2 + 0x52e490], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x32]
mov word [eax*2 + 0x52e492], cx
cmp eax, 0x14
jl 0x440760
mov byte [0x5327a0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e494
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x4407f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53279e], 0
jne 0x4408e3
mov dword [ebp - 0x38], 0x180020
mov dword [ebp - 0x34], 0xd0028
mov dword [ebp - 0x30], 0x30003
mov dword [ebp - 0x2c], 0x13000b
mov dword [ebp - 0x28], 0x170018
mov dword [ebp - 0x24], 0x10035
mov dword [ebp - 0x20], 0x1b0010
mov dword [ebp - 0x1c], 0x14001c
mov dword [ebp - 0x18], 0x270019
mov dword [ebp - 0x14], 0x50016
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], 0x49000c
mov dword [ebp - 8], 0x50
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 5
mov word [eax*2 + 0x52eba6], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x52eba8], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x52ebaa], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x52ebac], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x52ebae], cx
cmp eax, 0x19
jl 0x440870
mov byte [0x53279e], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ebb0
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x440900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53279b], 0
jne 0x4409db
push esi
push edi
pop edi
mov dword [ebp - 0x3c], 0x1e002d
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], 0x9001b
mov dword [ebp - 0x30], 0x1a003c
mov dword [ebp - 0x2c], 0x17001e
mov dword [ebp - 0x28], 0xc0002
mov dword [ebp - 0x24], 0x170027
mov dword [ebp - 0x20], 0x110049
mov dword [ebp - 0x1c], 0xf001a
mov dword [ebp - 0x18], 0x60000
mov dword [ebp - 0x14], 0x520017
mov dword [ebp - 0x10], 0xb0010
mov dword [ebp - 0xc], 0x110019
mov dword [ebp - 8], 0x1d
xor eax, eax
pop esi
jmp 0x440990
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x3c]
add eax, 3
mov word [eax*2 + 0x52e88e], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x52e890], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x52e892], cx
cmp eax, 0x1b
jl 0x440990
mov byte [0x53279b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e894
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x440ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53276c], 0
jne 0x440bbf
push ebx
push esi
push edi
pop edi
xor eax, eax
pop esi
mov dword [ebp - 0x40], 0x30022
mov dword [ebp - 0x3c], 0xa0006
mov dword [ebp - 0x38], 0x1c001a
mov dword [ebp - 0x34], 0x38
mov dword [ebp - 0x30], 0x40005
mov dword [ebp - 0x2c], 0x4000a
mov dword [ebp - 0x28], 0x80007
mov dword [ebp - 0x24], 0x23000c
mov dword [ebp - 0x20], 0x60014
mov dword [ebp - 0x1c], 0xd0006
mov dword [ebp - 0x18], 0x140043
mov dword [ebp - 0x14], 0x1a0014
mov dword [ebp - 0x10], 0x7001c
mov dword [ebp - 0xc], 0x4d000d
mov word [ebp - 8], ax
pop ebx
jmp 0x440b60
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x40]
add eax, 4
mov word [eax*2 + 0x52ea90], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x46]
mov word [eax*2 + 0x52ea92], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x44]
mov word [eax*2 + 0x52ea94], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x52ea96], cx
cmp eax, 0x1c
jl 0x440b60
mov byte [0x53276c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ea98
call fcn.004a992a
mov esp, ebp
pop ebp
ret
Function at 0x440be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53277d], 0
jne 0x440cb7
xor eax, eax
mov dword [ebp - 0x20], 0x280048
mov dword [ebp - 0x1c], 0xd0005
mov dword [ebp - 0x18], 0x90039
mov dword [ebp - 0x14], 0x1001a
mov dword [ebp - 0x10], 0x1d0005
mov dword [ebp - 0xc], 0x55000d
mov word [ebp - 8], ax
lea ecx, [ecx]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x20]
add eax, 6
mov word [eax*2 + 0x52e7b0], cx
movzx ecx, byte [eax + 0x52e35b]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x52e7b2], cx
movzx ecx, byte [eax + 0x52e35c]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x52e7b4], cx
movzx ecx, byte [eax + 0x52e35d]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x52e7b6], cx
movzx ecx, byte [eax + 0x52e35e]
xor cx, word [ebp + eax*2 - 0x24]
mov word [eax*2 + 0x52e7b8], cx
movzx ecx, byte [eax + 0x52e35f]
xor cx, word [ebp + eax*2 - 0x22]
mov word [eax*2 + 0x52e7ba], cx
cmp eax, 0xc
jl 0x440c30
mov byte [0x53277d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52e7bc
call fcn.004a992a
mov esp, ebp
pop ebp
ret

Function at 0x440cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52cc80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x532777], 0
jne 0x440d51
mov dword [ebp - 0x28], 0x1a0000
mov dword [ebp - 0x24], 0x3e0019
mov dword [ebp - 0x20], 0x18001c
mov dword [ebp - 0x1c], 0x2d000c
mov dword [ebp - 0x18], 0xa0009
mov dword [ebp - 0x14], 0xd0000
mov dword [ebp - 0x10], 0x1b0012
mov dword [ebp - 0xc], 0x1a0000
mov dword [ebp - 8], 0x1b
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [eax + 0x52e360]
xor cx, word [ebp + eax*2 - 0x28]
inc eax
mov word [eax*2 + 0x52ebe2], cx
cmp eax, 0x11
jl 0x440d30
mov byte [0x532777], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x52ebe4
call fcn.004a992a
mov esp, ebp
pop ebp
ret