joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443860
Capabilities:
Hash data with crc32

Disassembly:
push ecx
cmp dword [esp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
je 0x4438d2
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x4438a8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x44388f
cmp byte [esi], cl
jne 0x44388f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4def10]
test cl, cl
jne 0x443880
mov ecx, dword [0x4f0690]
not eax
cmp dword [ecx + 0x1c88], eax
jne 0x4438be
mov dword [ecx + 0x1c8c], eax
cmp dword [ecx + 0x1cc4], eax
jne 0x443934
mov byte [ecx + 0x1cc8], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov edi, dword [0x4f0690]
xor edx, edx
mov eax, dword [edi + 0x1c4c]
mov ecx, dword [eax + 0xf8]
mov eax, dword [eax + 0x100]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.00403960
mov esi, eax
add esp, 4
cmp dword [edi + 0x1c88], esi
jne 0x44390a
mov dword [edi + 0x1c8c], esi
cmp dword [edi + 0x1cc4], esi
jne 0x443919
mov byte [edi + 0x1cc8], 1
cmp dword [edi + 0x1c70], esi
jne 0x443932
push ecx
push ebx
mov edx, 0xb
mov ecx, esi
call fcn.00422df0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4499c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x4ef400]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [esp + 0x20], ecx
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
xor eax, eax
mov dword [esp + 0xc], edx
cmp ax, word [ecx + 6]
jae 0x449b16
mov eax, edx
mov dword [esp + 0x40], 0
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
movaps xmmword [esp + 0x30], xmm0
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449a40
sub eax, esi
lea ecx, [esp + 0x30]
push eax
push edx
call fcn.0045b260
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x30]
mov esi, dword [esp + 0x30]
cmp ecx, 0xf
mov dword [esp + 0x18], esi
cmova eax, esi
cmp dword [esp + 0x40], 5
jne 0x449ac8
cmp dword [eax], 0x7865742e
jne 0x449ac8
cmp byte [eax + 4], 0x74
jne 0x449ac8
mov eax, dword [esp + 0xc]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x24], eax
mov edi, dword [eax + 0xc]
add edi, dword [esp + 0x14]
mov dword [esp + 0x28], edi
cmp dword [eax + 8], ecx
jbe 0x449ab3
mov esi, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
crc32 ecx, eax
cmp edx, dword [esi + 8]
jb 0x449aa0
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
movq xmm0, qword [esp + 0x24]
movq qword [edi], xmm0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x449af2
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x449ae8
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449b2b
push ecx
push esi
call fcn.004ca5d3
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
inc ecx
add edx, 0x28
mov dword [esp + 0x10], ecx
movzx eax, word [eax + 6]
mov dword [esp + 0xc], edx
cmp ecx, eax
jl 0x449a22
mov ecx, dword [esp + 0x5c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004ca5c5
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x44b800
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], ebx
cmp byte [ebx + 0x47], 0
je 0x44b9a8
movaps xmm5, xmmword [0x4e6b10]
mov ecx, 0x69
movaps xmm6, xmmword [0x4e6b80]
sub ecx, ebx
movups xmm4, xmmword [0x4e6c10]
push ebp
push esi
mov dword [esp + 0x10], ecx
lea ebp, [ebx + 8]
push edi
mov edx, 0x6c
mov dword [esp + 0x10], 0x65
sub edx, ebx
mov esi, 0x6b
sub esi, ebx
mov dword [esp + 0x18], edx
mov edi, 0x6a
mov dword [esp + 0x1c], esi
sub edi, ebx
mov ecx, 0x61
sub ecx, ebx
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x24], ecx
sub dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm0, eax
add ecx, ebp
pshufd xmm1, xmm0, 0
add eax, 0x10
movd xmm0, dword [ebp - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
mov ecx, dword [esp + 0x10]
packuswb xmm1, xmm1
add ecx, ebp
packuswb xmm1, xmm1
movd dword [ebp - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebp]
packuswb xmm1, xmm1
lea edx, [esi + ebp]
packuswb xmm1, xmm1
lea esi, [edi + ebp]
movd dword [ebp - 4], xmm1
lea edi, [ebx + ebp]
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [esp + 0x20]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [esp + 0x18]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp], xmm1
movd xmm0, dword [ebp + 4]
punpcklbw xmm0, xmm0
movd xmm2, ecx
mov ecx, dword [esp + 0x24]
movd xmm1, esi
mov esi, dword [esp + 0x1c]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebp + 4], xmm3
add ebp, 0x10
cmp eax, 0x40
jb 0x44b880
mov ebx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
cmp eax, 0x46
jae 0x44b9a4
lea edx, [ebx + eax]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x44b996
mov byte [ebx + 0x47], 0
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x44b9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccfd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 7], 0
je 0x44ba13
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x44ba01
mov byte [esi + 7], 0
push ecx
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0045a4c0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x44ba33
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.0045d670
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x44baac
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44baa2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44baa2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x44bbc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x44bc39
movups xmm4, xmmword [0x4e6c10]
mov esi, 0x68
push ebx
lea ebx, [esi - 0x66]
nop dword [eax + eax]
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + esi - 0x68]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + esi - 0x68], xmm3
add esi, 4
sub ebx, 1
jne 0x44bbe0
pop ebx
mov byte [edi + 9], 0
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [edi + 8]
push eax
push edi
call fcn.0045a4c0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ecx
ret 4
Function at 0x44bc60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccfd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 0xa], 0
je 0x44bcc3
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x44bcb1
mov byte [esi + 0xa], 0
push ecx
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0045a4c0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x44bce3
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.0045d670
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x44bd5c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44bd52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44bd52
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x44bd80
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x44be07
movups xmm4, xmmword [0x4e6c10]
push ebx
mov ebx, 0x68
lea eax, [ebx - 0x5c]
nop dword [eax + eax]
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx - 0x68]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx - 0x68], xmm3
add ebx, 4
cmp ebx, 0x74
jb 0x44bda0
pop ebx
lea edx, [edi + eax]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x44bdf5
mov byte [edi + 0x10], 0
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xf]
push eax
push edi
call fcn.0045a4c0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ecx
ret 4
Function at 0x44be20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], ebx
cmp byte [ebx + 0x44], 0
je 0x44bfc8
movaps xmm5, xmmword [0x4e6b10]
mov ecx, 0x69
movaps xmm6, xmmword [0x4e6b80]
sub ecx, ebx
movups xmm4, xmmword [0x4e6c10]
push ebp
push esi
mov dword [esp + 0x10], ecx
lea ebp, [ebx + 8]
push edi
mov edx, 0x6c
mov dword [esp + 0x10], 0x65
sub edx, ebx
mov esi, 0x6b
sub esi, ebx
mov dword [esp + 0x18], edx
mov edi, 0x6a
mov dword [esp + 0x1c], esi
sub edi, ebx
mov ecx, 0x61
sub ecx, ebx
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x24], ecx
sub dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm0, eax
add ecx, ebp
pshufd xmm1, xmm0, 0
add eax, 0x10
movd xmm0, dword [ebp - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
mov ecx, dword [esp + 0x10]
packuswb xmm1, xmm1
add ecx, ebp
packuswb xmm1, xmm1
movd dword [ebp - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebp]
packuswb xmm1, xmm1
lea edx, [esi + ebp]
packuswb xmm1, xmm1
lea esi, [edi + ebp]
movd dword [ebp - 4], xmm1
lea edi, [ebx + ebp]
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [esp + 0x20]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [esp + 0x18]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp], xmm1
movd xmm0, dword [ebp + 4]
punpcklbw xmm0, xmm0
movd xmm2, ecx
mov ecx, dword [esp + 0x24]
movd xmm1, esi
mov esi, dword [esp + 0x1c]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebp + 4], xmm3
add ebp, 0x10
cmp eax, 0x40
jb 0x44bea0
mov ebx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
cmp eax, 0x43
jae 0x44bfc4
lea edx, [ebx + eax]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x44bfb6
mov byte [ebx + 0x44], 0
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x44bfe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], ebx
cmp byte [ebx + 0x136], 0
je 0x44c197
movaps xmm5, xmmword [0x4e6b10]
mov ecx, 0x69
movaps xmm6, xmmword [0x4e6b80]
sub ecx, ebx
movups xmm4, xmmword [0x4e6c10]
push ebp
push esi
mov dword [esp + 0x10], ecx
lea ebp, [ebx + 8]
push edi
mov edx, 0x6c
mov dword [esp + 0x10], 0x65
sub edx, ebx
mov esi, 0x6b
sub esi, ebx
mov dword [esp + 0x18], edx
mov edi, 0x6a
mov dword [esp + 0x1c], esi
sub edi, ebx
mov ecx, 0x61
sub ecx, ebx
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x24], ecx
sub dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm0, eax
add ecx, ebp
pshufd xmm1, xmm0, 0
add eax, 0x10
movd xmm0, dword [ebp - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
mov ecx, dword [esp + 0x10]
packuswb xmm1, xmm1
add ecx, ebp
packuswb xmm1, xmm1
movd dword [ebp - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebp]
packuswb xmm1, xmm1
lea edx, [esi + ebp]
packuswb xmm1, xmm1
lea esi, [edi + ebp]
movd dword [ebp - 4], xmm1
lea edi, [ebx + ebp]
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [esp + 0x20]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [esp + 0x18]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp], xmm1
movd xmm0, dword [ebp + 4]
punpcklbw xmm0, xmm0
movd xmm2, ecx
mov ecx, dword [esp + 0x24]
movd xmm1, esi
mov esi, dword [esp + 0x1c]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebp + 4], xmm3
add ebp, 0x10
cmp eax, 0x130
jb 0x44c060
mov ebx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
cmp eax, 0x135
jae 0x44c190
nop word [eax + eax]
lea edx, [ebx + eax]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x44c180
mov byte [ebx + 0x136], 0
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x44d560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccf25
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
cmp byte [edi + 0xb], 0
je 0x44d5b2
xor edx, edx
nop dword [eax]
lea ecx, [edi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x44d5a0
mov byte [edi + 0xb], 0
push ecx
lea eax, [edi + 0xa]
push eax
push edi
lea ecx, [ebp - 0x48]
call fcn.0045a4c0
mov dword [ebp - 4], 0
cmp byte [esi + 0xb], 0
je 0x44d5e2
xor edx, edx
nop
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x44d5d0
mov byte [esi + 0xb], 0
push ecx
lea eax, [esi + 0xa]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.0045a4c0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
push dword [ebp - 0x14]
call fcn.0045c800
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x44d636
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44d62c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d65c
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x44d66c
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44d662
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44d662
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d680
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccfd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 0xc], 0
je 0x44d6e3
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x44d6d1
mov byte [esi + 0xc], 0
push ecx
lea eax, [esi + 0xb]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0045a4c0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x44d703
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.0045d670
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x44d77c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44d772
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44d772
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x44d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccfd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 8], 0
je 0x44d803
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 7
jb 0x44d7f1
mov byte [esi + 8], 0
push ecx
lea eax, [esi + 7]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0045a4c0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x44d823
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.0045d670
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x44d89c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44d892
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44d892
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x44eda0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccfd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 6], 0
je 0x44ee03
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 5
jb 0x44edf1
mov byte [esi + 6], 0
push ecx
lea eax, [esi + 5]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0045a4c0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x44ee23
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.0045d670
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x44ee9c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44ee92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44ee92
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret