joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x56c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40463a
cmp byte [esi + 0x3d], 0
je 0x40463a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x404628
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4045f0
sub eax, 1
je 0x4045f4
sub eax, 2
jne 0x404628
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040605c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404611
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040c4c9
add esp, 0x10
cmp edi, eax
jne 0x404628
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040605c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040605c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040605c
mov esp, ebp
pop ebp
ret

Function at 0x404a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4228a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x56c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040606a
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004056d1
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414c49
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414abf
Function at 0x410220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg eax
imul edi
not eax
imul edx
rcl eax, 0xb3
mov esi, 0x5a
dec esi
and eax, 0x87
sbb edx, 0x7c
neg ebx
rcl esi, 0x19
mov edi, 0x3d
neg edi
inc esi
inc edi
mov esi, 0xde
dec eax
dec edx
bswap esi
neg edx
inc ebx
sub esi, 0x9e
add ebx, 0x8d
add esi, 0xcc
rcr edi, 4
ror esi, 0x66
dec edi
inc edx
inc eax
neg esi
dec ebx
inc eax
imul ebx
bswap ebx
dec esi
ror esi, 0xf4
not ebx
sbb ebx, 0xfa
rol eax, 0x62
not ebx
dec eax
rcl esi, 0xd9
or edx, 0x13
add ebx, 0xbc
or ebx, 0xcb
rol esi, 0xd8
sbb ebx, 0xdc
ror eax, 0x5b
sbb esi, 0xd0
not ebx
xor ecx, ecx
xor edi, edi
or eax, 0x7b
rcr edx, 0x73
sbb esi, 0xfa
dec esi
sub edx, 0xf
sbb esi, 0x92
mov esi, 0xab
bswap edi
imul edi
inc edx
sbb esi, 0xad
sub eax, 0xbc
sub edx, 0xc6
neg edx
sbb edx, 0x7e
rcl esi, 0x1d
or ebx, 0x31
bswap esi
neg edi
not eax
not edx
or esi, 0x3b
neg ebx
sbb edi, 0x20
neg edi
or edi, 0x14
rcl edx, 0x85
not eax
mov ebx, 0x74
dec edx
rol eax, 0xba
add esi, 0x4b
sbb esi, 0x3c
rcl eax, 0xf5
bswap edx
imul edi
rcl ebx, 0xc9
sub edi, 0x89
bswap edi
rcl ebx, 0x82
rol edi, 0xc9
imul edx
inc edx
and esi, 0x73
rcr edx, 0xcf
bswap edx
inc ebx
inc ebx
inc eax
mov edi, 0x99
mov ecx, dword [ebp + 0xc]
not edi
neg edx
rcr edi, 5
or eax, 0xd2
sub esi, 0x32
inc eax
sub edx, 3
inc edx
or edi, 0x34
neg edx
imul edx
bswap edx
sub ebx, 0xc
neg esi
mov edx, 0x8f
neg eax
not edi
mov ebx, 0x42
ror ebx, 0xe2
inc esi
bswap eax
rcr esi, 0x1f
mov esi, 0x48
bswap eax
and esi, 0x46
add edx, 0x44
sbb edi, 0x9b
dec edx
sub ebx, 0xf0
dec esi
rcr edi, 0x93
ror ebx, 0x83
imul edx
rcl edi, 0x75
and ebx, 0xf4
or ebx, 0x44
imul edx
inc edx
rcr ebx, 0x84
not edi
and esi, 0xe5
imul esi
inc edx
add eax, 0x92
inc esi
dec edi
bswap eax
rcl esi, 0x4f
and eax, 0x2c
rcl edx, 0x7d
mov edi, dword [ebp + 8]
xor eax, esi
xor eax, esi
xor eax, ebx
not byte [edi]
xor eax, esi
mov eax, eax
mov eax, esi
xor esi, esi
xor eax, ebx
mov ebx, ebx
mov esi, esi
mov ebx, ebx
xor eax, eax
add byte [edi], 0x26
mov esi, esi
mov eax, esi
xor ebx, eax
xor ebx, ebx
mov esi, eax
xor esi, esi
mov eax, ebx
mov esi, ebx
mov ebx, esi
sub byte [edi], 0x86
mov ebx, eax
mov esi, ebx
xor eax, ebx
mov ebx, ebx
xor eax, esi
xor ebx, esi
xor eax, eax
xor ebx, ebx
xor eax, eax
imul byte [edi]
inc edi
loop 0x4103df
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4050e0
Capabilities:
Encode data using xor

Disassembly:
dec dword [0x45c09c]
mov eax, dword [0x45c09c]
add eax, 0xb98bd021
or eax, dword [0x460788]
mov dword [0x460788], eax
xor dword [0x4614d0], 0xd4040000
inc dword [0x45ef2c]
mov eax, dword [0x45ef2c]
add eax, 0xd31eb608
cmp eax, 0x2af7de88
jle 0x405155
dec dword [0x460480]
mov eax, dword [0x460480]
mov ecx, dword [0x45d4bc]
add eax, 0x44682990
xor ecx, 0x40136b88
sar ecx, 2
cmp ecx, eax
jle 0x40514b
add dword [0x45dad4], 0xecfdc327
jmp 0x405155
mov eax, dword [0x45b7f0]
mov eax, dword [0x45a624]
push ebx
mov ebx, dword [esp + 8]
push edi
xor edi, edi
test ebx, ebx
jle 0x4052e0
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
sub ebp, eax
mov ecx, dword [0x461410]
dec dword [0x461410]
xor ecx, 0x280e4000
cmp ecx, 0x46f4d565
jle 0x4051ab
cmp dword [0x45ed54], 0xc16a0dbb
jl 0x4051ab
movzx ecx, word [0x467b34]
imul ecx, ecx, 0xbe7f3957
mov word [0x467b34], cx
cmp dword [eax], edi
sbb esi, esi
dec word [0x466f2a]
mov cx, word [0x466f2a]
neg esi
movsx edx, word [0x4637e8]
movsx ecx, cx
sub edx, ecx
movsx ecx, word [0x463aa6]
and ecx, edx
cmp ecx, 0xfff7efbe
jle 0x4051f2
cmp dword [0x45fba0], 0x7da01ec5
jl 0x4051f2
add dword [0x45ee20], 0xd97bb987
sub dword [eax], edi
mov ecx, dword [0x45b610]
add ecx, 0x3bb55549
xor dword [0x45e098], ecx
mov ecx, dword [eax]
cmp ecx, dword [eax + ebp]
sbb edi, edi
dec dword [0x45c0f8]
mov ecx, dword [0x45c0f8]
neg edi
xor ecx, 0xdce81310
add edi, esi
or ecx, dword [0x45dd34]
mov dword [0x45dd34], ecx
mov ecx, dword [eax + ebp]
sub dword [eax], ecx
mov ecx, 0x823
add eax, 4
mov word [0x463e28], cx
dec ebx
jne 0x405171
test edi, edi
je 0x4052de
jmp 0x405260
xor dword [0x460c10], 0xebc2a493
lea eax, [eax + 4]
cmp dword [eax - 4], edi
mov ecx, dword [0x46135c]
sbb esi, esi
sub ecx, dword [0x45e3d8]
and ecx, 0x878494ac
neg esi
sub dword [0x45aba4], ecx
sub dword [eax - 4], edi
mov edi, esi
or dword [0x45d8d8], 0xf88d595e
xor dword [0x45b940], 0x412693ef
inc word [0x466b98]
mov cx, word [0x466b98]
movsx edx, cx
mov ecx, dword [0x45ef2c]
add ecx, 0x54c103b0
add ecx, edx
mov dword [0x45ef2c], ecx
imul ecx, dword [0x45dd14], 0xbd72ab8
mov dword [0x45dd14], ecx
test esi, esi
jne 0x405260
pop esi
pop ebp
movzx eax, word [0x464524]
add eax, 0x5da3e2b9
pop edi
mov word [0x464524], ax
pop ebx
ret
Function at 0x40f710
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x46204c]
mov eax, dword [0x45a534]
shl edx, 5
not eax
or eax, edx
push esi
mov dword [0x458cf0], eax
mov esi, ecx
call fcn.00407b40
mov dword [0x4616b0], 0xd80569a6
cmp dword [esi + 0x18], 0
jne 0x40f774
nop
movsx ecx, word [0x463450]
movzx eax, word [0x4642d2]
and ecx, 0xe605be38
or eax, ecx
mov word [0x4642d2], ax
call fcn.00401430
mov dword [esi + 0x18], eax
xor dword [0x45f8b8], 0xc6a147d0
cmp dword [esi + 0x18], 0
je 0x40f740
add dword [0x459e6c], 0xf5fffff0
pop esi
ret
Function at 0x412710
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x460660]
add eax, 0xacd195e
cmp eax, 0xeaae505d
jl 0x412744
mov eax, dword [0x462b00]
movsx ecx, word [0x4675ca]
not eax
imul eax, eax, 0x5c068ea4
or ecx, eax
or dword [0x45cee8], ecx
dec word [0x4675ca]
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00416a40
mov ecx, edi
mov esi, eax
call fcn.004044f0
cmp esi, eax
je 0x41278f
mov edi, edi
mov dword [0x4611ac], 0x14bcbc04
mov ecx, edi
mov byte [esi], 0
inc esi
mov eax, dword [0x4591c0]
xor eax, dword [0x458c44]
mov dword [0x4591c0], eax
inc dword [0x458c44]
call fcn.004044f0
cmp esi, eax
jne 0x412760
cmp dword [0x45cf20], 0x490531c0
pop edi
pop esi
jl 0x4127a8
or dword [0x45c39c], 0xe69ad3ab
ret
add dword [0x45f830], 0x40d42e46
ret
Function at 0x4175e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4600d8]
sub esp, 0x14
mov edx, dword [0x45939c]
sar eax, 6
imul edx, eax
mov eax, 0xab6d7dfe
push edi
mov edi, ecx
sub eax, edx
and dword [0x459a10], eax
call fcn.004067b0
test al, al
jne 0x41779f
mov eax, dword [0x45dc54]
lea ecx, [esp + 4]
xor eax, 0x2520bdcc
and dword [0x45c2f8], eax
movzx eax, word [0x468998]
sub eax, 0x5c0e3cbb
push esi
mov word [0x468998], ax
call fcn.00403f30
imul eax, dword [0x45fa94], 0xb6ab74bd
mov dword [0x45fa94], eax
movzx eax, word [0x4685b8]
movsx ecx, ax
mov eax, dword [0x462428]
add eax, 0x334788e9
add eax, ecx
mov ecx, edi
mov dword [0x462428], eax
call fcn.004067c0
mov ecx, edi
mov esi, eax
call fcn.00428600
cmp esi, eax
je 0x41771a
nop
or dword [0x463310], 0x89011102
mov ecx, esi
call fcn.004067e0
push eax
call dword [0x45879c]
test eax, eax
je 0x4176d8
add dword [0x45a260], 0x552e10f6
lea ecx, [esp + 8]
push esi
call fcn.0040d1f0
dec word [0x465e74]
movzx eax, word [0x465e74]
imul ecx, eax, 0x70633cfd
movzx eax, word [0x4685f2]
add eax, 0x29970e93
add eax, ecx
mov word [0x4685f2], ax
mov eax, dword [0x45df50]
inc dword [0x45df50]
cmp eax, 0xcb911e4a
jle 0x417708
imul eax, dword [0x45a0f8], 0xd412ca00
cmp eax, 0xf9c49aa3
jg 0x417708
mov ax, word [0x46674c]
inc word [0x46674c]
mov ecx, edi
add esi, 0x14
call fcn.00428600
cmp esi, eax
jne 0x417680
or dword [0x45eb4c], 0x17356e63
lea ecx, [esp + 8]
call fcn.00427d40
lea ecx, [esp + 8]
mov esi, eax
call fcn.0040d250
cmp esi, eax
je 0x41777d
lea esp, [esp]
xor dword [0x45d434], 0x708f7e79
mov ecx, edi
push esi
call fcn.004047e0
inc dword [0x45fa4c]
add esi, 0x14
mov eax, dword [0x45fa4c]
mov ecx, dword [0x45ff1c]
not ecx
xor ecx, eax
and dword [0x4601e8], ecx
lea ecx, [esp + 8]
call fcn.0040d250
cmp esi, eax
jne 0x417740
mov eax, dword [0x45ddfc]
lea ecx, [esp + 8]
sar eax, 7
and eax, 0x5f680f12
xor eax, 0xe232b0fe
add dword [0x459ee0], eax
call fcn.00425d80
pop esi
mov dword [0x4593b8], 0x1971672b
pop edi
add esp, 0x14
ret
Function at 0x418f20
Capabilities:
Hash data with md5

Disassembly:
dec dword [0x45e840]
mov edx, 0x985fdf2e
push esi
mov esi, dword [0x45e840]
mov eax, dword [0x45a650]
sub edx, eax
push edi
mov edi, ecx
or edx, esi
mov dword [0x461c54], edx
inc dword [0x45a650]
mov dword [edi], 0
mov eax, dword [0x46208c]
and eax, 0x2741643d
cmp eax, 0x6a37cb4a
jl 0x418f88
movzx eax, word [0x467cee]
mov ecx, dword [0x45d42c]
cwde
imul ecx, eax
movzx eax, word [0x46504c]
xor eax, ecx
mov word [0x46504c], ax
dec word [0x467cee]
mov dword [edi + 4], 0
movzx eax, word [0x464dd8]
or eax, 0xe5a2bc8d
mov word [0x464dd8], ax
mov dword [edi + 8], 0x67452301
movzx eax, word [0x4646f0]
mov ecx, dword [0x459560]
cwde
xor ecx, eax
mov word [0x4646f0], cx
mov dword [edi + 0xc], 0xefcdab89
mov eax, dword [0x45d560]
inc dword [0x45d560]
cmp eax, 0xd6f6cdff
jg 0x418fe5
mov ax, word [0x463e0a]
cwde
xor dword [0x45fca0], eax
mov dword [edi + 0x10], 0x98badcfe
mov eax, dword [0x45b81c]
mov ecx, dword [0x460884]
shl eax, 7
add eax, 0x65160cce
and ecx, eax
cmp ecx, 0xbd8b1be2
jg 0x419013
add dword [0x462338], 0x2f6785d7
mov dword [edi + 0x14], 0x10325476
movzx eax, word [0x467c66]
and eax, 0xb6d002c
pop edi
mov word [0x467c66], ax
pop esi
ret
Function at 0x41bc40
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [0x45aeb0], 0xbfffe63a
push esi
mov esi, dword [esp + 8]
mov dword [0x45aeb0], eax
movzx eax, word [0x464450]
imul eax, eax, 0xbf353888
mov word [0x464450], ax
movzx eax, word [0x467442]
or eax, 0xdefa0422
mov word [0x467442], ax
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41bc80
and dword [0x461fec], 0x5989a6b3
sub eax, edx
movzx ecx, word [0x468362]
dec eax
imul ecx, ecx, 0xa308eeb2
mov word [0x468362], cx
cmp byte [eax + esi], 0x22
jne 0x41bd87
mov ecx, dword [0x461cec]
mov word [0x4648f0], cx
dec dword [0x461cec]
mov byte [esi], 0x22
cmp dword [0x459b00], 0x2ba49c8c
je 0x41bced
movsx ecx, word [0x4637e2]
imul ecx, ecx, 0x382b35fd
sub ecx, 0x7882719
mov dword [0x45fec0], ecx
mov byte [eax + esi], 0
movsx ecx, word [0x46516a]
or ecx, 0xdfbefb7e
cmp ecx, 0x53ef12b1
jle 0x41bd20
imul ecx, dword [0x45eb20], 0xf8c514f3
mov dword [0x45eb20], ecx
jmp 0x41bd20
mov ecx, dword [0x45bda8]
dec eax
movsx edx, word [0x463d4c]
add ecx, 0xad552dcc
xor edx, ecx
or dword [0x45acc4], edx
mov edx, 0xddc86336
inc dword [0x45bda8]
movsx ecx, word [0x46755e]
sub edx, ecx
xor dword [0x459f9c], edx
cmp byte [eax + esi], 0x22
jne 0x41bd20
inc dword [0x45b808]
inc eax
mov ecx, dword [0x45b808]
add eax, esi
add dword [0x45b498], ecx
add dword [0x4609b4], 0x370f6a20
add dword [0x460fb0], 0x20d0180d
pop esi
ret
movzx ecx, word [0x4689c4]
and ecx, 0xb7febf7b
mov word [0x4689c4], cx
mov byte [esi], 0x20
movzx ecx, word [0x46569a]
mov edx, dword [0x4590fc]
movsx ecx, cx
imul edx, ecx
movsx ecx, word [0x466180]
imul ecx, ecx, 0x56f58070
cmp ecx, edx
jge 0x41bde0
movzx ecx, word [0x464c28]
or ecx, 0xb46e7219
mov word [0x464c28], cx
jmp 0x41bde0
xor dword [0x460658], 0xf36bed54
dec eax
add dword [0x45b048], 0xca23dae
cmp byte [eax + esi], 0x20
jne 0x41bde0
mov edx, dword [0x462818]
mov ecx, dword [0x45ab70]
not edx
and ecx, edx
cmp ecx, 0xe17a360e
jg 0x41be26
movsx ecx, word [0x46650e]
xor ecx, 0x9b889fc1
mov dword [0x4590e0], ecx
mov ecx, dword [0x45e2a0]
mov edx, 0x6b84fe
sub edx, ecx
inc eax
or dword [0x45a100], edx
add eax, esi
add dword [0x460fb0], 0x20d0180d
pop esi
ret

Function at 0x424200
Capabilities:
Terminate process

Disassembly:
dec word [0x465c02]
mov cx, word [0x465c02]
inc word [0x463b8a]
movzx eax, word [0x463b8a]
movsx edx, ax
movsx eax, cx
and edx, eax
or edx, 0x282fe89
add edx, dword [0x459b60]
push dword [0x458048]
mov dword [0x459b60], edx
call fcn.0041bae0
movzx eax, word [0x4657e8]
add esp, 4
sub eax, 0x25875c14
mov word [0x4657e8], ax
push 1
call fcn.0042b880
int3
Function at 0x424700
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x4618b0]
mov eax, dword [0x46101c]
and ecx, 0x31d618a
sar eax, 3
xor eax, ecx
or dword [0x45bb78], eax
dec dword [0x45b818]
mov eax, dword [0x45b818]
mov ecx, dword [0x45eee0]
sub ecx, 0x71640c2f
or ecx, eax
movzx eax, word [0x4666a2]
add eax, ecx
mov word [0x4666a2], ax
inc dword [0x45eee0]
movsx eax, word [0x4635a4]
xor eax, 0x104085c0
sar eax, 4
and dword [0x462464], eax
cmp dword [esp + 4], 0
je 0x4247ee
lea edx, [esp + 4]
mov edi, edi
imul eax, dword [0x46173c], 0x9747a5e0
lea edx, [edx + 4]
mov dword [0x46173c], eax
mov eax, dword [esp + 4]
mov dword [eax], 1
add dword [0x461428], 0x95590d0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
or dword [0x45e268], 0xdaebbaa1
mov eax, dword [esp + 4]
mov dword [eax + 8], 0
mov eax, dword [0x462968]
mov ecx, dword [0x4595b4]
not eax
imul eax, eax, 0xe6b04cb6
or ecx, eax
mov eax, dword [edx]
or ecx, 0x5283e230
mov dword [esp + 4], eax
mov dword [0x4595b4], ecx
xor dword [0x459f38], 0x725b134f
cmp dword [esp + 4], 0
jne 0x424770
mov eax, dword [0x459cc0]
sub eax, dword [0x45fa14]
mov dword [0x459cc0], eax
movsx eax, word [0x4642a6]
and eax, 0xf5960d0a
cmp eax, 0x20108286
je 0x424824
movzx eax, word [0x4678dc]
imul eax, eax, 0x4944102
mov word [0x4678dc], ax
ret
Function at 0x4282e0
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x45f550], 0x9fffffee
je 0x4282f6
add dword [0x45d968], 0x1f6337d8
cmp dword [0x4689f8], 0
mov dword [0x45ab88], 0x5a018495
jne 0x428343
mov ecx, dword [0x45af9c]
movzx eax, word [0x46503c]
add ecx, 0x63bad5
shl ecx, 5
xor eax, ecx
mov word [0x46503c], ax
call fcn.00401430
mov dword [0x4689f8], eax
movzx eax, word [0x4686f8]
add eax, 0x70aca37a
mov word [0x4686f8], ax
push esi
push edi
push 3
mov dword [0x45d560], 0xa728bdd5
push 0x27
call fcn.00410dd0
mov esi, eax
mov dword [0x461d0c], 0xefc5919e
push esi
push dword [esp + 0x18]
call fcn.0042bea1
imul ecx, dword [0x45deac], 0xefff35fa
mov edi, eax
push esi
push 3
mov dword [0x45deac], ecx
call fcn.00410d40
mov ecx, dword [0x4595b8]
add esp, 0x18
mov eax, dword [0x461b70]
and ecx, 0xfb974ff0
lea edx, [ecx*8]
mov ecx, 0x8f6c4fea
sub ecx, eax
cmp ecx, edx
jne 0x4283c8
mov eax, dword [0x461d24]
add eax, 0x5d838f63
xor eax, 0x23e9bd47
mov dword [0x45bee0], eax
inc dword [0x461d24]
test edi, edi
jne 0x428482
mov eax, dword [0x45f0e8]
mov ecx, 0x814a29e0
sub ecx, eax
and dword [0x45df98], ecx
dec dword [0x45f0e8]
push 0x3e8
call dword [0x458854]
mov eax, dword [0x460370]
or eax, 0xb8f9f1c6
xor dword [0x459668], eax
push 3
push 0x27
call fcn.00410dd0
mov ecx, dword [0x45e1c4]
mov esi, eax
and ecx, dword [0x45b848]
push esi
push dword [esp + 0x18]
and ecx, 0xa262b086
mov dword [0x45b848], ecx
call fcn.0042bea1
and dword [0x46009c], 0x48e4342c
mov edi, eax
push esi
push 3
call fcn.00410d40
mov ecx, dword [0x461030]
add esp, 0x18
mov eax, dword [0x45b1a0]
and ecx, eax
mov eax, dword [0x45cd2c]
dec dword [0x461030]
sub eax, 0x2f170eb2
dec dword [0x45b1a0]
or eax, 0x8c236ae3
cmp eax, ecx
jne 0x428482
imul eax, dword [0x45ff00], 0xb0966174
mov dword [0x45ff00], eax
or dword [0x45e9cc], 0x9045109c
test edi, edi
je 0x42850d
imul eax, dword [0x45d388], 0x520e0c88
push edi
push 1
push 4
push 0x4689f8
mov dword [0x45d388], eax
call fcn.0042c054
inc dword [0x45f688]
add esp, 0x10
mov eax, dword [0x45f688]
imul ecx, eax, 0x7c329e29
mov eax, dword [0x45f750]
and eax, 0xfcb987e2
sub ecx, 0x616dd15a
cmp ecx, eax
jg 0x4284ec
cmp dword [0x458c50], 0x7800a715
jge 0x4284ec
and dword [0x462bb8], 0xb695fcc
push edi
call fcn.0042bb76
mov ecx, dword [0x45a1cc]
add esp, 4
movsx eax, word [0x464d7a]
sar ecx, 4
or eax, ecx
xor dword [0x4590c4], eax
mov ecx, dword [0x4622ec]
mov eax, dword [0x45f050]
not ecx
or eax, ecx
or eax, 0x7589d4c8
pop edi
mov dword [0x45f050], eax
pop esi
ret
Function at 0x429c50
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, word [0x46412c]
mov eax, dword [0x45b408]
or ecx, 0xc175f572
imul eax, ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [0x45b408], eax
xor dword [0x45c274], 0x87fbd5fd
mov eax, dword [0x45f2d0]
and eax, dword [0x45a50c]
mov dword [0x45a50c], eax
test esi, esi
jle 0x429efe
cmp dword [0x459e68], 0x53a86ec3
jl 0x429ca7
or dword [0x46027c], 0xf0c51865
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, 0x56ce5d9a
mov ebp, 0x40
mov edx, dword [edi]
mov dword [0x461af0], 0x7797a465
and edx, 0x3f
mov dword [0x45b49c], 0xd1816147
sub ebp, edx
add dword [edi], esi
mov ecx, dword [0x45d508]
sar ecx, 2
sub eax, ecx
mov dword [esp + 0x1c], edx
and dword [0x462534], eax
imul eax, dword [0x4624fc], 0xb9066480
mov dword [0x4624fc], eax
cmp dword [edi], esi
jae 0x429d00
inc dword [edi + 4]
mov eax, dword [0x45a7fc]
inc dword [0x45a7fc]
cmp eax, 0x79b111f3
jge 0x429d1c
mov dword [0x459600], 0xa541845
test edx, edx
je 0x429e0a
cmp esi, ebp
jl 0x429e0a
mov ebx, dword [esp + 0x18]
lea eax, [edi + 0x28]
and dword [0x45e35c], 0xeabd8c03
add eax, edx
push ebp
push ebx
push eax
call fcn.0042c450
mov ax, word [0x464034]
movzx ecx, word [0x46718c]
cwde
and ecx, eax
lea eax, [edi + 0x28]
push eax
and ecx, 0x949a5525
mov word [0x464034], cx
push edi
call fcn.004086c0
add dword [0x45966c], 0xb2c623e1
add esp, 0x14
mov eax, dword [0x45e334]
add ebx, ebp
dec dword [0x45e334]
xor eax, 0x9bcf1174
cmp eax, 0xeeedd334
jl 0x429db5
inc dword [0x45a130]
mov eax, dword [0x45a130]
mov ecx, dword [0x462e88]
imul ecx, eax
imul eax, ecx, 0x6bb08824
mov dword [0x462e88], eax
jmp 0x429dbf
add dword [0x4603bc], 0x6a2b757b
mov eax, dword [0x461c74]
sub esi, ebp
sar eax, 5
or dword [0x46216c], eax
inc dword [0x45f328]
mov eax, dword [0x45f328]
mov ecx, dword [0x460c34]
and ecx, eax
mov dword [esp + 0x1c], 0
cmp ecx, 0x434cb7ba
jg 0x429dfe
and dword [0x45d4dc], 0x65c83200
jmp 0x429e0e
add dword [0x458dec], 0x3af25d7c
jmp 0x429e0e
mov ebx, dword [esp + 0x18]
cmp esi, 0x40
jl 0x429eaa
mov ebp, esi
shr ebp, 6
mov eax, ebp
neg eax
shl eax, 6
add esi, eax
jmp 0x429e30
mov ecx, dword [0x459e08]
movsx eax, word [0x4647fa]
not ecx
add eax, 0xfef12728
add eax, ecx
mov ecx, dword [0x45d2b0]
imul ecx, eax
push ebx
push edi
mov dword [0x45d2b0], ecx
dec word [0x4647fa]
call fcn.004086c0
mov dword [0x462888], 0x8343c101
add esp, 8
mov ax, word [0x46693e]
add ebx, 0x40
movzx ecx, word [0x46751a]
cwde
imul ecx, eax
mov word [0x46693e], cx
mov ecx, dword [0x45d1e8]
mov eax, dword [0x461ec0]
not ecx
imul eax, ecx
xor dword [0x462b30], eax
dec dword [0x461ec0]
dec ebp
jne 0x429e30
add dword [0x461734], 0x4b586938
test esi, esi
jle 0x429ef1
mov eax, dword [esp + 0x1c]
xor dword [0x462398], 0x727d884e
add eax, 0x28
push esi
add eax, edi
push ebx
push eax
call fcn.0042c450
mov eax, dword [0x460430]
add esp, 0xc
xor eax, dword [0x45c204]
xor eax, 0x32d05248
mov dword [0x460430], eax
dec dword [0x45c204]
add dword [0x45e438], 0x84e440b
pop edi
pop ebp
pop ebx
pop esi
ret