joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416580
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x601f78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2f
push 0x5c
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp + 8]
mov dword [esi], 0
mov dword [esi + 4], 1
call fcn.00517c70
mov edx, dword [ebp + 8]
or edi, 0xffffffff
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov dword [eax], edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x4165fb
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x4165fb
push ecx
call fcn.004a8172
add esp, 4
lea eax, [ebp + 8]
mov edx, str.Global_
push eax
lea ecx, [ebp - 0x10]
call fcn.005189d0
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
mov dword [esi], eax
cmp ecx, 0x7a1354
je 0x41664d
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x41664d
push ecx
call fcn.004a8172
add esp, 4
cmp dword [esi], 0
jne 0x4166a5
lea eax, [ebp + 8]
mov edx, str.Local_
push eax
lea ecx, [ebp - 0x10]
call fcn.005189d0
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
mov dword [esi], eax
cmp ecx, 0x7a1354
je 0x4166a0
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x4166a0
push ecx
call fcn.004a8172
add esp, 4
cmp dword [esi], 0
je 0x4166f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4166f4
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4166d6
mov eax, dword [esi]
test eax, eax
je 0x4166f4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
jmp 0x4166f4
cmovs eax, edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4166f4
cmp eax, 0x80
je 0x4166f4
mov ecx, esi
call fcn.00416730
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x416712
lock xadd dword [eax], edi
test edi, edi
jne 0x416712
push eax
call fcn.004a8172
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x419b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x601370
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004a7e6f
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004a6b5f
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423860
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x602ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov dword [ebp + 8], esi
lea ecx, [esi - 8]
cmp ecx, 0x7a1354
je 0x4238a4
mov eax, 1
lock xadd dword [ecx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x423b30
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [ebp - 0x20]
sub ebx, 1
mov dword [ebp - 0x14], ebx
js 0x4239fa
nop dword [eax]
nop word [eax + eax]
lea ecx, [ebp + 8]
mov dword [ebp - 0x34], 0xc403
call fcn.0040fc40
lea eax, [eax*4 + 4]
mov dword [ebp - 0x30], eax
cmp byte [esi], 0
jne 0x423918
mov edx, 0x7a3584
jmp 0x4239c8
mov dword [ebp - 0x10], esi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x423920
sub esi, ecx
lea ecx, [ebp - 0x10]
lea edi, [esi + 4]
and edi, 0xfffffffc
call fcn.0040fc40
inc eax
lea ecx, [ebp + 8]
lea eax, [edi + eax*4]
push eax
call fcn.0051a030
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x18], esi
lea edx, [edi + esi]
mov ecx, edx
mov bl, byte [eax]
inc eax
test bl, bl
movzx ebx, bl
jns 0x4239b1
xor esi, esi
mov dword [ebp - 0x10], 0x7f
mov edi, 0x40
test bl, 0x40
je 0x42397f
nop
cmp edi, 8
jbe 0x42397f
shr dword [ebp - 0x10], 1
inc esi
shr edi, 1
test ebx, edi
jne 0x423970
and ebx, dword [ebp - 0x10]
sub esi, 1
mov dword [ebp - 0x10], ebx
js 0x4239b1
nop word [eax + eax]
movzx edi, byte [eax]
mov ebx, edi
and bl, 0xc0
cmp bl, 0x80
mov ebx, dword [ebp - 0x10]
jne 0x4239b1
and edi, 0x3f
shl ebx, 6
or ebx, edi
inc eax
sub esi, 1
mov dword [ebp - 0x10], ebx
jns 0x423990
test ebx, ebx
je 0x4239bc
mov dword [ecx], ebx
add ecx, 4
jmp 0x423951
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
push eax
push 0x1f40
push 3
lea eax, [ebp - 0x34]
push eax
push dword [0x800f68]
mov eax, dword [ebp - 0x28]
push 0x4a
push dword [eax + ebx*4]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
sub ebx, 1
mov dword [ebp - 0x14], ebx
jns 0x4238f0
push dword [ebp - 0x28]
mov dword [ebp - 0x20], 0
call fcn.004c2bdc
add esi, 0xfffffff8
add esp, 4
cmp esi, 0x7a1354
je 0x423a2b
or eax, 0xffffffff
lock xadd dword [esi], eax
test eax, eax
jne 0x423a2b
push esi
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x427920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x602d20
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x30]
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [edi + 8]
cmp edx, 1
mov eax, dword [ecx]
mov esi, dword [eax + 4]
setne al
push eax
push dword [edi + 0x40]
lea eax, [ebp - 0x10]
push dword [edi + 0x3c]
push edx
push eax
call esi
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
test esi, esi
je 0x4279a1
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0x28]
jmp 0x4279a6
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea ecx, [edi + 4]
mov eax, 1
lock xadd dword [ecx], eax
mov dword [ebp - 0x10], edi
push 0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
movaps xmm0, xmmword [0x7b9b60]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], 0x3f800000
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.0057fd20
mov ecx, dword [ebp - 0x10]
or ebx, 0xffffffff
test ecx, ecx
je 0x427a0b
lea eax, [ecx + 4]
mov edx, ebx
lock xadd dword [eax], edx
lea eax, [edx - 1]
test eax, eax
jne 0x427a0b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x427a18
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [ebp + 8]
lea ecx, [esi + 4]
mov eax, 1
mov dword [edi], esi
lock xadd dword [ecx], eax
test esi, esi
je 0x427a40
lock xadd dword [ecx], ebx
lea eax, [ebx - 1]
test eax, eax
jne 0x427a40
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x427a4d
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e130
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0xc], ecx
imul esi, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 4], edx
push edi
xor esi, eax
mov eax, ebx
shr eax, 0x10
imul ecx, esi, 0x1000193
mov esi, dword [ebp - 4]
movzx eax, al
xor ecx, eax
mov esi, dword [esi + 4]
imul ecx, ecx, 0x1000193
mov eax, ebx
shr eax, 0x18
xor ecx, eax
mov eax, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
imul ecx, ecx, 0x1000193
and eax, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [eax*8]
mov edi, dword [ecx + edx]
mov eax, edi
add edx, ecx
nop dword [eax]
cmp edi, esi
jne 0x42e1a8
mov ecx, esi
jmp 0x42e1ad
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x42e1c8
cmp dword [eax + 8], ebx
je 0x42e1ba
mov eax, dword [eax]
jmp 0x42e1a0
cmp eax, esi
je 0x42e1c8
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 8], bx
push 1
mov word [ebp - 6], ax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_GetGlyphIndicesW]
cmp eax, 0xffffffff
je 0x42e2ac
mov eax, dword [ebp + 8]
mov ecx, 0xffff
cmp ax, cx
je 0x42e2ac
mov esi, dword [ebp - 4]
movzx eax, ax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], ebx
mov eax, dword [esi + 0x18]
and eax, dword [ebp - 0x10]
mov edx, dword [esi + 0xc]
mov esi, dword [esi + 4]
lea ecx, [eax*8]
mov edi, dword [ecx + edx]
mov eax, edi
add edx, ecx
nop word [eax + eax]
cmp edi, esi
jne 0x42e238
mov ecx, esi
jmp 0x42e23d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x42e24e
cmp dword [eax + 8], ebx
je 0x42e24a
mov eax, dword [eax]
jmp 0x42e230
cmp eax, esi
jne 0x42e29b
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov edi, dword [esi + 4]
push ecx
push edi
push esi
call fcn.00453180
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x42e2b6
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00451ba0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
mov dword [eax + 0xc], ecx
movzx eax, word [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.004a5262
int3
Function at 0x42e2d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x20], ecx
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push edi
mov dword [ebp - 0x1c], esi
xor edx, eax
mov eax, ebx
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
sar eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
mov edi, dword [edx + ecx*8]
mov eax, edi
lea edx, [edx + ecx*8]
nop dword [eax]
cmp edi, esi
jne 0x42e348
mov ecx, esi
jmp 0x42e34d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x42e372
cmp dword [eax + 8], ebx
je 0x42e35a
mov eax, dword [eax]
jmp 0x42e340
cmp eax, esi
je 0x42e372
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret
push 0x7a6a40
xor eax, eax
push eax
push eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x18]
push eax
push 0x82
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_GetGlyphOutlineW]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x1c]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov edx, dword [esi + 0xc]
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and eax, dword [esi + 0x18]
mov esi, dword [esi + 4]
lea ecx, [eax*8]
mov edi, dword [ecx + edx]
mov eax, edi
add edx, ecx
cmp edi, esi
jne 0x42e3e8
mov ecx, esi
jmp 0x42e3ed
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x42e3fe
cmp dword [eax + 8], ebx
je 0x42e3fa
mov eax, dword [eax]
jmp 0x42e3e0
cmp eax, esi
jne 0x42e44b
mov esi, dword [esi]
lea eax, [ebp + 8]
push ecx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov edi, dword [esi + 4]
push ecx
push edi
push esi
call fcn.00453180
mov ebx, dword [ebp - 0x1c]
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x42e465
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00451ba0
mov eax, dword [ebp - 0x24]
movsx ecx, word [ebp - 8]
mov dword [eax + 0xc], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.004a5262
int3
Function at 0x4358d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4
Function at 0x44c180
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
shl ecx, 4
add ecx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x44c33f
push ebx
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], ecx
cmp edx, ecx
jge 0x44c32d
mov edi, dword [ebp + 8]
mov edi, dword [edi]
mov eax, edx
mov ebx, dword [ebp + 8]
mov esi, dword [edi + 0xc]
mov ecx, dword [ebx + 4]
sub eax, dword [ebx + 0x10]
imul esi, edx
cdq
add esi, dword [edi]
mov dword [ebx + 0x14], esi
idiv dword [ecx + 0x18]
mov eax, dword [ebp - 0x18]
imul edx, dword [ecx + 0xc]
mov dword [ebp - 8], eax
add edx, dword [ecx]
mov dword [ebx + 0x18], edx
mov eax, dword [edi + 0x10]
mov ecx, eax
imul ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
sub ebx, dword [edi + 0xc]
add ecx, esi
cmp dword [edi + 8], 0xfe
jge 0x44c2e0
mov esi, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
mov dword [ebp - 0x24], ebx
idiv dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
mov esi, 0x100
imul ebx, edx
add ebx, dword [edi + 0x18]
movzx edx, byte [ebx + 1]
or edx, 0xff0000
imul edx, dword [edi + 8]
movzx edi, byte [ebx + 2]
shl edi, 0x10
shr edx, 8
and edx, 0xff00ff
mov eax, edx
shr eax, 0x10
sub esi, eax
movzx eax, byte [ecx + 1]
imul eax, esi
shr eax, 8
add eax, edx
movzx edx, byte [ecx + 2]
mov dword [ebp - 0x20], eax
movzx eax, byte [ebx]
mov ebx, dword [ebp + 8]
or edi, eax
movzx eax, byte [ecx]
shl edx, 0x10
or edx, eax
imul edi, dword [ebx + 8]
mov ebx, dword [ebp - 0x20]
imul edx, esi
shr edi, 8
and edi, 0xff00ff
shr edx, 8
and edx, 0xff00ff
add edi, edx
mov edx, 0x100
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shr eax, 8
or edx, edi
mov edi, dword [ebp + 8]
neg al
or al, bl
and edx, 0xff00ff
mov ebx, dword [ebp - 0x24]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp - 8]
dec eax
mov byte [ecx], dl
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
test eax, eax
jg 0x44c215
jmp 0x44c31a
mov esi, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
add esi, dword [edi + 0x18]
mov ax, word [esi]
mov dl, byte [esi + 2]
mov word [ebp - 4], ax
movzx eax, al
mov byte [ecx], al
movzx eax, byte [ebp - 3]
mov byte [ecx + 1], al
mov eax, dword [ebp - 8]
dec eax
mov byte [ecx + 2], dl
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
test eax, eax
jg 0x44c2e0
mov edx, dword [ebp - 0x10]
inc edx
mov dword [ebp - 0x10], edx
cmp edx, dword [ebp - 0x28]
jl 0x44c1c6
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x2c]
jne 0x44c1a2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44f800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0x18]
push ebx
mov ebx, ecx
inc edx
push esi
mov dword [ebp - 4], ebx
push edi
mov esi, dword [ebx + 8]
mov eax, esi
mov ecx, esi
mov edi, dword [ebp + 0x14]
shr ecx, 8
and eax, 0xff00ff
imul eax, edx
and ecx, 0xffff00ff
imul ecx, edx
dec edi
shr esi, 8
and esi, 0xff00ff
mov dword [ebp + 0x14], edi
imul esi, edx
shr eax, 8
xor eax, ecx
and eax, 0xff00ff
xor eax, esi
mov esi, dword [ebx]
mov edx, dword [esi + 0xc]
imul edx, dword [ebp + 0xc]
mov ecx, dword [esi]
add ecx, edx
mov dword [ebx + 4], ecx
mov ebx, dword [esi + 0x10]
imul ebx, dword [ebp + 8]
add ebx, ecx
mov ecx, eax
shr ecx, 0x18
mov dword [ebp + 8], ebx
cmp cl, 0xff
jb 0x44f8a7
test edi, edi
js 0x44f99a
nop word [eax + eax]
mov edx, dword [ebp + 0x10]
mov ecx, ebx
mov esi, dword [esi + 0x10]
mov dword [ecx], eax
dec edx
add ecx, esi
test edx, edx
jg 0x44f888
mov ecx, dword [ebp - 4]
mov esi, dword [ecx]
add ebx, dword [esi + 0xc]
sub edi, 1
jns 0x44f880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test edi, edi
js 0x44f99a
mov ecx, eax
shr ecx, 8
and ecx, 0xff00ff
and eax, 0xff00ff
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0xc], edx
mov ebx, ecx
mov edx, 0x100
shr ecx, 0x10
mov esi, 0x100
sub edx, ecx
mov ecx, dword [edi]
mov edi, ecx
shr ecx, 8
and ecx, 0xff00ff
and edi, 0xff00ff
imul ecx, edx
imul edi, edx
shr ecx, 8
and ecx, 0xff00ff
shr edi, 8
add ebx, ecx
and edi, 0xff00ff
mov ecx, ebx
add edi, eax
shr ecx, 8
mov edx, edi
and ecx, 0xff00ff
shr edx, 8
sub esi, ecx
and edx, 0xff00ff
shl esi, 8
mov ecx, ebx
shl ecx, 8
or esi, ecx
mov ecx, 0x100
sub ecx, edx
mov edx, 0x100
or ecx, edi
mov edi, dword [ebp + 0x18]
xor esi, ecx
mov ecx, ebx
shr ecx, 8
and esi, 0xff00ff
and ecx, 0xff00ff
shl ebx, 8
sub edx, ecx
mov ecx, dword [ebp + 0xc]
shl edx, 8
dec ecx
or edx, ebx
mov dword [ebp + 0xc], ecx
xor esi, edx
mov dword [edi], esi
add edi, dword [ebp - 0xc]
test ecx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x18], edi
jg 0x44f8d3
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov esi, dword [ecx]
mov ecx, dword [ebp - 8]
add ebx, dword [esi + 0xc]
sub dword [ebp + 0x14], 1
mov dword [ebp + 8], ebx
jns 0x44f8c2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4507c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp esi, dword [edi + 0x6c]
jle 0x4507e8
mov dword [edi + 0x6c], esi
push dword [edi + 0x68]
call fcn.004c2bdc
push esi
call fcn.004c2f64
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
push esi
mov esi, dword [ebp + 8]
push esi
push eax
mov dword [ebp - 4], eax
call fcn.0043aff0
mov eax, dword [edi + 0x48]
mov edx, dword [edi + 0x50]
imul edx, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [ebp + 8], eax
sar edx, 8
mov dword [ebp + 0x10], edx
add ebx, dword [edi + 0x64]
cmp edx, 0xfe
jge 0x4508f0
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [ebp - 4], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
imul edi, edx
mov edx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
test eax, eax
jg 0x450825
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov edx, 0x100
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [ebp - 4], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp + 8]
test eax, eax
jg 0x4508f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc