joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54706b], 0
jne 0x4443b1
mov edx, dword [0x545d90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 0xe
jne 0x44435e
inc dword [0x546d5c]
mov dword [ebp - 0x1c], 0xc0043
mov dword [ebp - 0x18], 0x130006
mov dword [ebp - 0x14], 0x5a0015
mov dword [ebp - 0x10], 0x4c0050
mov dword [ebp - 0xc], 0xf0010
mov dword [ebp - 8], 0xe
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x1c]
inc eax
mov word [eax*2 + 0x542942], cx
cmp eax, 0xb
jl 0x444390
mov byte [0x54706b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542944
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x4443d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547045], 0
jne 0x4444cf
push ebx
push esi
push edi
pop edi
xor eax, eax
pop esi
mov dword [ebp - 0x48], 0xe000f
mov dword [ebp - 0x44], 0xa0005
mov dword [ebp - 0x40], 0x4c0017
mov dword [ebp - 0x3c], 0x30002
mov dword [ebp - 0x38], 0xf001d
mov dword [ebp - 0x34], 0x150007
mov dword [ebp - 0x30], 0x160045
mov dword [ebp - 0x2c], 0xb0019
mov dword [ebp - 0x28], 0x500001
mov dword [ebp - 0x24], 0x1f0019
mov dword [ebp - 0x20], 0x150046
mov dword [ebp - 0x1c], 0x1f000d
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0xf0007
mov dword [ebp - 0x10], 0x1c001d
mov dword [ebp - 0xc], 0xb001e
mov word [ebp - 8], ax
pop ebx
lea esp, [esp]
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 4
mov word [eax*2 + 0x542d08], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x542d0a], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x542d0c], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x542d0e], cx
cmp eax, 0x20
jl 0x444470
mov byte [0x547045], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542d10
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x4444f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54705d], 0
jne 0x4445e7
xor eax, eax
mov dword [ebp - 0x2c], 0xa000d
mov dword [ebp - 0x28], 0x130036
mov dword [ebp - 0x24], 0x1e0011
mov dword [ebp - 0x20], 0xb0017
mov dword [ebp - 0x1c], 0xd001b
mov dword [ebp - 0x18], 0x12003d
mov dword [ebp - 0x14], 0x7000d
mov dword [ebp - 0x10], 0x30005
mov dword [ebp - 0xc], 0x2f0007
mov word [ebp - 8], ax
jmp 0x444560
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x2c]
add eax, 6
mov word [eax*2 + 0x542ab4], cx
movzx ecx, byte [eax + 0x54235b]
xor cx, word [ebp + eax*2 - 0x36]
mov word [eax*2 + 0x542ab6], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x34]
mov word [eax*2 + 0x542ab8], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x32]
mov word [eax*2 + 0x542aba], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x30]
mov word [eax*2 + 0x542abc], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x542abe], cx
cmp eax, 0x12
jl 0x444560
mov byte [0x54705d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542ac0
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x4446d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x545d90]
push edi
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov edi, 7
idiv edi
cmp edx, 3
jne 0x44475d
test ecx, ecx
je 0x44475d
mov edi, edi
mov eax, ecx
and eax, 0x80000001
jns 0x44470e
dec eax
or eax, 0xfffffffe
inc eax
jne 0x44471b
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x444722
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x545d90], ecx
sub edx, 0
je 0x44474c
sub edx, 2
je 0x44474f
dec edx
je 0x444750
jmp 0x444759
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x545d90], ecx
test ecx, ecx
jne 0x444700
cmp byte [0x547058], 0
jne 0x444821
lea edx, [ecx + 1]
lea eax, [ecx + 2]
imul eax, edx
imul eax, ecx
push esi
cdq
mov esi, 0xc
idiv esi
cmp edx, 9
jne 0x4447a2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x34], 0x3000d
mov dword [ebp - 0x30], 0x110007
mov dword [ebp - 0x2c], 0xa0054
mov dword [ebp - 0x28], 0xc000d
mov dword [ebp - 0x24], 0x430010
mov dword [ebp - 0x20], 0x40001
mov dword [ebp - 0x1c], 0x140017
mov dword [ebp - 0x18], 0xa000e
mov dword [ebp - 0x14], 0x3d0016
mov dword [ebp - 0x10], 0x8001f
mov dword [ebp - 0xc], 0xd0013
mov dword [ebp - 8], 0xd
xor ecx, ecx
pop esi
lea esp, [esp]
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x34]
inc ecx
mov word [ecx*2 + 0x542cca], ax
cmp ecx, 0x17
jl 0x444800
mov byte [0x547058], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542ccc
pop edi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x444840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547069], 0
jne 0x444961
xor eax, eax
mov word [ebp - 8], ax
push esi
mov esi, dword [0x545d90]
push edi
lea edi, [esi + 1]
lea eax, [esi + 2]
imul eax, edi
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
mov eax, dword [0x546cf8]
mov ecx, 0xc9c8db68
mov dword [ebp - 0x28], 0x140000
mov dword [ebp - 0x24], 0x3a0019
mov dword [ebp - 0x20], 0x1c001d
mov dword [ebp - 0x1c], 0x3d0007
mov dword [ebp - 0x18], 0xa0000
mov dword [ebp - 0x14], 0x14000f
mov dword [ebp - 0x10], 0x90001
mov dword [ebp - 0xc], 0x10001e
cmp edx, 0xd
cmove eax, ecx
mov dword [0x546cf8], eax
xor eax, eax
mov edi, edi
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x28]
add eax, 4
mov word [eax*2 + 0x5428d8], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x2e]
mov word [eax*2 + 0x5428da], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x2c]
mov word [eax*2 + 0x5428dc], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x5428de], cx
cmp eax, 0x10
jl 0x4448d0
imul edi, esi
mov eax, edi
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 5
jne 0x444958
xor edi, edi
test esi, esi
je 0x444952
mov eax, esi
mov ecx, esi
cdq
sub eax, edx
and ecx, 1
mov esi, eax
add edi, ecx
sar esi, 1
jne 0x444940
mov dword [0x545d90], edi
pop edi
mov byte [0x547069], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x5428e0
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x444980
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547040], 0
jne 0x444ab7
mov ecx, dword [0x545d90]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 9
idiv ecx
cmp edx, 4
jne 0x4449c8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push esi
xor eax, eax
mov dword [ebp - 0x38], 0x120021
mov dword [ebp - 0x34], 0xb000c
mov dword [ebp - 0x30], 0x1e0024
mov dword [ebp - 0x2c], 0x1000b
mov dword [ebp - 0x28], 0x100011
mov dword [ebp - 0x24], 0x250011
mov dword [ebp - 0x20], 0xd000a
mov dword [ebp - 0x1c], 0xa000e
mov dword [ebp - 0x18], 0x160042
mov dword [ebp - 0x14], 0x50011
mov dword [ebp - 0x10], 0x4000a
mov dword [ebp - 0xc], 0x4d000c
mov word [ebp - 8], ax
pop esi
jmp 0x444a30
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x5426ec], cx
movzx ecx, byte [eax + 0x54235b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x5426ee], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x5426f0], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x5426f2], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x5426f4], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x5426f6], cx
cmp eax, 0x18
jl 0x444a30
mov byte [0x547040], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x5426f8
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x444ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x545d90]
push esi
lea eax, [ebx + 1]
imul eax, ebx
cdq
mov esi, 0x16
idiv esi
cmp edx, 3
jne 0x444b9b
xor edx, edx
mov dword [ebp - 0x61c], edx
lea ecx, [ebp - 0x618]
push edi
xor eax, eax
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], ecx
nop
lea edi, [eax + 1]
lea ecx, [edx + 1]
mov eax, ebx
cdq
idiv ecx
mov eax, ebx
mov ecx, ebx
sub ecx, dword [ebp - 0x61c]
mov ebx, dword [ebp - 0x620]
mov esi, edx
cdq
imul esi, ecx
idiv edi
add esi, eax
sub esi, dword [ebp - 0x624]
push esi
push 0x5262b4
call fcn.004b05f1
mov edx, dword [ebp - 0x61c]
mov eax, edi
add ebx, 4
add esp, 8
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], ebx
cmp eax, 0x15
jge 0x444b7d
mov ebx, dword [0x545d90]
jmp 0x444b20
inc edx
mov dword [ebp - 0x61c], edx
cmp edx, 0x12
jge 0x444b9a
mov ebx, dword [0x545d90]
mov ecx, dword [ebp - 0x620]
jmp 0x444b11
pop edi
cmp byte [0x547074], 0
jne 0x444c73
xor eax, eax
mov dword [ebp - 0x30], 0x10002d
mov dword [ebp - 0x2c], 0x4000c
mov dword [ebp - 0x28], 0x90000
mov dword [ebp - 0x24], 0x70036
mov dword [ebp - 0x20], 0xc0019
mov dword [ebp - 0x1c], 0x140016
mov dword [ebp - 0x18], 0xe0031
mov dword [ebp - 0x14], 0x10019
mov dword [ebp - 0x10], 0x140003
mov dword [ebp - 0xc], 0x4c004a
mov word [ebp - 8], ax
xor ecx, ecx
jmp 0x444c00
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x30]
add ecx, 5
mov word [ecx*2 + 0x5429d6], ax
movzx eax, byte [ecx + 0x54235c]
xor ax, word [ebp + ecx*2 - 0x38]
mov word [ecx*2 + 0x5429d8], ax
movzx eax, byte [ecx + 0x54235d]
xor ax, word [ebp + ecx*2 - 0x36]
mov word [ecx*2 + 0x5429da], ax
movzx eax, byte [ecx + 0x54235e]
xor ax, word [ebp + ecx*2 - 0x34]
mov word [ecx*2 + 0x5429dc], ax
movzx eax, byte [ecx + 0x54235f]
xor ax, word [ebp + ecx*2 - 0x32]
mov word [ecx*2 + 0x5429de], ax
cmp ecx, 0x14
jl 0x444c00
mov byte [0x547074], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x5429e0
pop ebx
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x444c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547072], 0
jne 0x444d83
push esi
mov dword [ebp - 0x38], 0x160020
mov dword [ebp - 0x34], 0x90028
mov dword [ebp - 0x30], 0x30018
mov dword [ebp - 0x2c], 0x30007
mov dword [ebp - 0x28], 0x60000
mov dword [ebp - 0x24], 0x180034
mov dword [ebp - 0x20], 0x120017
mov dword [ebp - 0x1c], 0x5001e
mov dword [ebp - 0x18], 0x3d000e
mov dword [ebp - 0x14], 0x10015
mov dword [ebp - 0x10], 0x130009
mov dword [ebp - 0xc], 0x570011
mov dword [ebp - 8], 0x49
xor eax, eax
pop esi
lea esp, [esp]
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 5
mov word [eax*2 + 0x542baa], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x542bac], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x542bae], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x542bb0], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x542bb2], cx
cmp eax, 0x19
jl 0x444d10
mov byte [0x547072], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542bb4
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x444da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x545d90]
mov ecx, 0xf
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
push edi
cmp edx, 0xa
jne 0x444de6
lea ecx, [edx - 9]
cmp esi, ecx
jle 0x444dde
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x444dd2
mov esi, ecx
mov dword [0x545d90], esi
cmp byte [0x547061], 0
jne 0x444f1b
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0xe
idiv ecx
mov dword [ebp - 0x3c], 0x10002d
mov dword [ebp - 0x38], 0x4000c
mov dword [ebp - 0x34], 0x90000
mov dword [ebp - 0x30], 0xa0030
mov dword [ebp - 0x2c], 0x60006
mov dword [ebp - 0x28], 0x150003
mov dword [ebp - 0x24], 0x1e0020
mov dword [ebp - 0x20], 0x4b
mov dword [ebp - 0x1c], 0x15000d
mov dword [ebp - 0x18], 0x20003
mov dword [ebp - 0x14], 0x410012
mov dword [ebp - 0x10], 0x15000d
mov dword [ebp - 0xc], 0x1a0000
mov dword [ebp - 8], 0x1d
cmp edx, 7
jne 0x444ec1
movsd xmm3, qword [0x528e10]
movsd xmm6, qword [0x528e38]
movsd xmm5, qword [0x528e08]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x444eab
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x444e91
xor ecx, ecx
jmp 0x444ed0
movzx eax, byte [ecx + 0x542360]
xor ax, word [ebp + ecx*2 - 0x3c]
add ecx, 3
mov word [ecx*2 + 0x5428fe], ax
movzx eax, byte [ecx + 0x54235e]
xor ax, word [ebp + ecx*2 - 0x40]
mov word [ecx*2 + 0x542900], ax
movzx eax, byte [ecx + 0x54235f]
xor ax, word [ebp + ecx*2 - 0x3e]
mov word [ecx*2 + 0x542902], ax
cmp ecx, 0x1b
jl 0x444ed0
mov byte [0x547061], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x542904
pop esi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x445080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54703e], 0
jne 0x44516f
push ebx
push esi
push edi
pop edi
xor eax, eax
pop esi
mov dword [ebp - 0x40], 0xd0022
mov dword [ebp - 0x3c], 0xe0006
mov dword [ebp - 0x38], 0x1c0001
mov dword [ebp - 0x34], 0x100034
mov dword [ebp - 0x30], 0x15001d
mov dword [ebp - 0x2c], 0x1d000b
mov dword [ebp - 0x28], 0x10000
mov dword [ebp - 0x24], 0x32000e
mov dword [ebp - 0x20], 0x1c0003
mov dword [ebp - 0x1c], 0x90005
mov dword [ebp - 0x18], 0x70046
mov dword [ebp - 0x14], 0x40009
mov dword [ebp - 0x10], 0xc0005
mov dword [ebp - 0xc], 0x4e000d
mov word [ebp - 8], ax
pop ebx
jmp 0x445110
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x40]
add eax, 4
mov word [eax*2 + 0x542ae0], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x46]
mov word [eax*2 + 0x542ae2], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x44]
mov word [eax*2 + 0x542ae4], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x542ae6], cx
cmp eax, 0x1c
jl 0x445110
mov byte [0x54703e], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542ae8
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x445190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54704f], 0
jne 0x445267
xor eax, eax
mov dword [ebp - 0x20], 0x260048
mov dword [ebp - 0x1c], 0x90005
mov dword [ebp - 0x18], 0x90022
mov dword [ebp - 0x14], 0x110016
mov dword [ebp - 0x10], 0xc001d
mov dword [ebp - 0xc], 0x4c000c
mov word [ebp - 8], ax
lea ecx, [ecx]
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x20]
add eax, 6
mov word [eax*2 + 0x54285c], cx
movzx ecx, byte [eax + 0x54235b]
xor cx, word [ebp + eax*2 - 0x2a]
mov word [eax*2 + 0x54285e], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x28]
mov word [eax*2 + 0x542860], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x26]
mov word [eax*2 + 0x542862], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x24]
mov word [eax*2 + 0x542864], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x22]
mov word [eax*2 + 0x542866], cx
cmp eax, 0xc
jl 0x4451e0
mov byte [0x54704f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542868
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x445280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x545d90]
push esi
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
mov esi, 0x11
idiv esi
cmp edx, 0xc
jne 0x4452ce
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [0x54704a], 0
jne 0x445341
mov dword [ebp - 0x28], 0x140000
mov dword [ebp - 0x24], 0x3a0019
mov dword [ebp - 0x20], 0x180007
mov dword [ebp - 0x1c], 0x3d0000
mov dword [ebp - 0x18], 0x1b0011
mov dword [ebp - 0x14], 0x140001
mov dword [ebp - 0x10], 0x120015
mov dword [ebp - 0xc], 0xb0002
mov dword [ebp - 8], 0xc
xor eax, eax
jmp 0x445320
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x28]
inc eax
mov word [eax*2 + 0x542be6], cx
cmp eax, 0x11
jl 0x445320
mov byte [0x54704a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542be8
pop esi
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x445360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547063], 0
jne 0x445467
push esi
xor eax, eax
mov dword [ebp - 0x38], 0x140000
mov dword [ebp - 0x34], 0x3a0019
mov dword [ebp - 0x30], 0x20001
mov dword [ebp - 0x2c], 0x1a0001
mov dword [ebp - 0x28], 0x60004
mov dword [ebp - 0x24], 0x50001
mov dword [ebp - 0x20], 0x20000
mov dword [ebp - 0x1c], 0x10034
mov dword [ebp - 0x18], 0x13001a
mov dword [ebp - 0x14], 0x1c0015
mov dword [ebp - 0x10], 0x80012
mov dword [ebp - 0xc], 0x30007
mov word [ebp - 8], ax
pop esi
lea esp, [esp]
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x38]
add eax, 6
mov word [eax*2 + 0x542a80], cx
movzx ecx, byte [eax + 0x54235b]
xor cx, word [ebp + eax*2 - 0x42]
mov word [eax*2 + 0x542a82], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x40]
mov word [eax*2 + 0x542a84], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x3e]
mov word [eax*2 + 0x542a86], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x3c]
mov word [eax*2 + 0x542a88], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x3a]
mov word [eax*2 + 0x542a8a], cx
cmp eax, 0x18
jl 0x4453e0
mov byte [0x547063], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542a8c
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
Function at 0x445480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54703d], 0
jne 0x445597
xor eax, eax
mov dword [ebp - 0x44], 0x3000d
mov dword [ebp - 0x40], 0x110007
mov dword [ebp - 0x3c], 0xa0054
mov dword [ebp - 0x38], 0xc000d
mov dword [ebp - 0x34], 0x430010
mov dword [ebp - 0x30], 0x40001
mov dword [ebp - 0x2c], 0x140017
mov dword [ebp - 0x28], 0xa000e
mov dword [ebp - 0x24], 0x3d0016
mov dword [ebp - 0x20], 0x8001f
mov dword [ebp - 0x1c], 0xd0013
mov dword [ebp - 0x18], 0x4d000d
mov dword [ebp - 0x14], 0x6000f
mov dword [ebp - 0x10], 0x4e001b
mov dword [ebp - 0xc], 0x41005f
mov word [ebp - 8], ax
lea esp, [esp]
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x44]
add eax, 6
mov word [eax*2 + 0x542630], cx
movzx ecx, byte [eax + 0x54235b]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x542632], cx
movzx ecx, byte [eax + 0x54235c]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x542634], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x542636], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x48]
mov word [eax*2 + 0x542638], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x46]
mov word [eax*2 + 0x54263a], cx
cmp eax, 0x1e
jl 0x445510
mov byte [0x54703d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x54263c
call fcn.004af5ba
mov esp, ebp
pop ebp
ret

Function at 0x445620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x547068], 0
jne 0x44574f
mov ecx, dword [0x545d90]
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xa
idiv ecx
push ebx
push esi
push edi
pop edi
pop esi
mov dword [ebp - 0x48], 0x10000b
mov dword [ebp - 0x44], 0xa001b
mov dword [ebp - 0x40], 0x330006
mov dword [ebp - 0x3c], 0xd0007
mov dword [ebp - 0x38], 0xe0019
mov dword [ebp - 0x34], 0x1f0017
mov dword [ebp - 0x30], 0x5000c
mov dword [ebp - 0x2c], 0x10000a
mov dword [ebp - 0x28], 0x1e000b
mov dword [ebp - 0x24], 0x330017
mov dword [ebp - 0x20], 0xd0002
mov dword [ebp - 0x1c], 0x320004
mov dword [ebp - 0x18], 0xc001b
mov dword [ebp - 0x14], 0x7000e
mov dword [ebp - 0x10], 0x1001a
mov dword [ebp - 0xc], 0x150002
pop ebx
cmp edx, 8
jne 0x4456e9
push 0xb1
push 0xb0
push 0x5262d8
call fcn.004b05f1
add esp, 0xc
xor eax, eax
jmp 0x4456f0
movzx ecx, byte [eax + 0x542360]
xor cx, word [ebp + eax*2 - 0x48]
add eax, 4
mov word [eax*2 + 0x542c08], cx
movzx ecx, byte [eax + 0x54235d]
xor cx, word [ebp + eax*2 - 0x4e]
mov word [eax*2 + 0x542c0a], cx
movzx ecx, byte [eax + 0x54235e]
xor cx, word [ebp + eax*2 - 0x4c]
mov word [eax*2 + 0x542c0c], cx
movzx ecx, byte [eax + 0x54235f]
xor cx, word [ebp + eax*2 - 0x4a]
mov word [eax*2 + 0x542c0e], cx
cmp eax, 0x20
jl 0x4456f0
mov byte [0x547068], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x542c10
call fcn.004af5ba
mov esp, ebp
pop ebp
ret