joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420c10
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4ac358
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d25ac]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
cmp byte [esi + 0x24], 0
je 0x420dcb
cmp dword [esi + 0x1c], 8
jb 0x420c50
mov eax, dword [esi + 8]
jmp 0x420c53
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420dcb
mov esi, dword [esi + 0x20]
xor ebx, ebx
cmp esi, ebx
je 0x420dcb
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x420dcb
mov eax, dword [0x4d4934]
mov edx, dword [eax + 0xc]
mov ecx, 0x4d4934
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x2c], ebx
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x18], ebx
cmp esi, dword [ebp + 0x10]
jbe 0x420caf
call fcn.00492a5a
mov ebx, dword [ebp]
mov dword [esp + 0x20], esi
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], esi
jbe 0x420cc3
call fcn.00492a5a
mov eax, dword [ebp]
test ebx, ebx
je 0x420cce
cmp ebx, eax
je 0x420cd3
call fcn.00492a5a
cmp dword [esp + 0x20], esi
je 0x420d95
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x40]
call fcn.00401c10
push eax
push str._s_d
lea edi, [esp + 0x20]
call fcn.00408d60
mov ebp, dword [esp + 0x40]
add esp, 0xc
cmp dword [ebp + 0x1c], 8
jb 0x420d0c
mov ebp, dword [ebp + 8]
jmp 0x420d0f
add ebp, 8
test ebx, ebx
jne 0x420d8d
call fcn.00492a5a
xor eax, eax
mov esi, dword [esp + 0x20]
cmp esi, dword [eax + 0x10]
jb 0x420d28
call fcn.00492a5a
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x420d33
mov esi, dword [esi]
mov edi, dword [esp + 0x14]
cmp dword [edi - 4], 1
jle 0x420d4f
mov ecx, dword [edi - 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00407d00
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
push ebp
push esi
push edi
call fcn.00401c10
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc dword [esp + 0x18]
test ebx, ebx
jne 0x420d91
call fcn.00492a5a
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x10]
jb 0x420d7f
call fcn.00492a5a
add dword [esp + 0x20], 0x1c
mov ebp, dword [esp + 0x40]
jmp 0x420cb6
mov eax, dword [ebx]
jmp 0x420d1a
mov eax, dword [ebx]
jmp 0x420d71
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x20]
test eax, eax
je 0x420da7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420dcb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x4267a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x4267cd
push esi
push edi
jmp 0x4267b0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4ba8f0]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x4267b0
pop edi
pop esi
ret
Function at 0x426830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x42684d
mov esi, 0x80
cmp esi, dword [edi]
jne 0x42685a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x4d583c]
test eax, eax
je 0x426865
call eax
lea ecx, [esi*8]
push ecx
call fcn.00423680
mov ebp, eax
mov eax, dword [0x4d5840]
add esp, 4
mov dword [esp + 0x10], ebp
test eax, eax
je 0x426886
call eax
test ebp, ebp
je 0x426851
mov edx, dword [edi + 0xc]
push edx
call fcn.00423940
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x4d3644]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call fcn.004957a0
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x42696f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x426903
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x4ba8f0]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc esi
test edx, edx
jg 0x4268e0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x42694a
mov esi, dword [eax]
test esi, esi
je 0x426920
mov edx, dword [eax + 4]
jmp 0x426922
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x42694a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x426942
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x426963
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x426963
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x426959
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x4268d3
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x427030
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x427061
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x427061
mov dword [edi + 0x10], eax
pop edi
mov eax, 0x70a
pop esi
ret
mov edx, dword [esp + 0xc]
push 1
push 0
push 0
push edx
call fcn.004a6160
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret
Function at 0x427ec0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x320
mov eax, dword [0x4d25ac]
xor eax, esp
mov dword [esp + 0x31c], eax
mov eax, dword [0x4d5930]
push ebx
push ebp
mov ebp, dword [esp + 0x32c]
push esi
push edi
test eax, eax
je 0x427f05
push eax
push 0x4c1ee8
lea eax, [esp + 0x20]
push eax
push 0xe6
call fcn.00424fc0
add esp, 0x10
jmp 0x427fac
call fcn.00426bb0
test eax, eax
je 0x427f51
lea ecx, [esp + 0x120]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x120]
call fcn.00426c70
mov esi, eax
test esi, esi
jne 0x427f8e
mov eax, 7
mov ecx, dword [esp + 0x32c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049110c
add esp, 0x320
ret
lea eax, [esp + 0x120]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x120]
push ecx
call fcn.00426cd0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x427f33
call fcn.00426c70
push ebx
mov esi, eax
call fcn.0049227f
add esp, 4
test esi, esi
je 0x427f33
push esi
push 0x4c1ee8
lea edx, [esp + 0x20]
push edx
push 0xe6
call fcn.00424fc0
push esi
call fcn.0049227f
add esp, 0x14
mov dl, byte [esp + 0x18]
lea eax, [esp + 0x18]
test dl, dl
je 0x427fbe
inc eax
cmp byte [eax], 0
jne 0x427fb8
lea ecx, [esp + 0x18]
sub eax, ecx
and eax, 0x3fffffff
mov ecx, str.etilqs_
mov edi, edi
inc ecx
cmp byte [ecx], 0
jne 0x427fd0
sub ecx, str.etilqs_
and ecx, 0x3fffffff
lea eax, [ecx + eax + 0x11]
cmp eax, 0x105
jl 0x427ff7
mov eax, 1
jmp 0x427f38
lea eax, [esp + 0x18]
test dl, dl
je 0x428006
nop
inc eax
cmp byte [eax], 0
jne 0x428000
lea ecx, [esp + 0x18]
sub eax, ecx
and eax, 0x3fffffff
jbe 0x42801f
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x42801f
sub eax, 1
jne 0x428014
lea edx, [esp + 0x18]
push edx
push str._setilqs_
push ebp
push 0xf4
mov byte [esp + eax + 0x28], 0
call fcn.00424fc0
add esp, 0x10
mov eax, ebp
test ebp, ebp
je 0x428055
cmp byte [ebp], 0
je 0x42804e
inc eax
cmp byte [eax], 0
jne 0x428048
sub eax, ebp
and eax, 0x3fffffff
cmp dword [0x4d3624], 0
mov esi, eax
mov edi, 0xf
lea ebx, [eax + ebp]
jne 0x428072
mov dword [esp + 0x14], 0
jmp 0x428090
push 5
call dword [0x4d3660]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x428090
push eax
call dword [0x4d3668]
add esp, 4
nop
dec edi
call fcn.00425100
mov byte [ebx], al
inc ebx
test edi, edi
jne 0x428090
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4280af
push eax
call dword [0x4d3670]
add esp, 4
mov ecx, 0xf
movzx eax, byte [esi + ebp]
xor edx, edx
mov edi, 0x3e
div edi
inc esi
sub ecx, 1
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + ebp - 1], dl
jne 0x4280b4
mov byte [esi + ebp], cl
xor eax, eax
jmp 0x427f38
Function at 0x428450
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call fcn.00426bb0
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x428477
call fcn.00426c10
mov edi, eax
jmp 0x428493
call fcn.00426c10
mov esi, eax
cmp esi, ebp
je 0x428497
push esi
call fcn.00426d40
push esi
mov edi, eax
call fcn.0049227f
add esp, 8
cmp edi, ebp
jne 0x4284a4
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 8
ret
call fcn.00426bb0
test eax, eax
je 0x4284f4
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esp, [esp]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x4284dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 5
jne 0x428534
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x428534
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4284c0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x42851c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 5
jne 0x428534
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x428534
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x428500
push edi
call fcn.0049227f
add esp, 4
cmp esi, 0xffffffff
jne 0x428553
cmp dword [esp + 0x14], 2
jne 0x428553
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 0xa0a
pop ebx
add esp, 8
ret
Function at 0x4287c0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4d25ac]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x120]
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
push ecx
push 0x104
push eax
push edx
mov dword [esp + 0x24], 0x200
call fcn.00428690
add esp, 0x10
test eax, eax
jne 0x428936
call fcn.00426bb0
test eax, eax
je 0x42881b
lea ebx, [esp + 0x18]
call fcn.00426c10
mov esi, eax
jmp 0x42889e
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 0
push 0xfde9
call ebx
mov edi, eax
lea ecx, [edi + edi]
push ecx
call fcn.00493e05
mov esi, eax
add esp, 4
test esi, esi
je 0x428919
push edi
push esi
push 0xffffffffffffffff
lea edx, [esp + 0x24]
push edx
push 0
push 0xfde9
call ebx
push esi
test eax, eax
jne 0x428889
call fcn.0049227f
add esp, 4
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0049110c
add esp, 0x11c
ret
call fcn.00426d40
add esp, 4
push esi
mov edi, eax
call fcn.0049227f
add esp, 4
mov esi, edi
test esi, esi
je 0x428919
call fcn.00426bb0
test eax, eax
mov eax, esi
je 0x4288e0
cmp word [esi], 0
je 0x4288c9
cmp word [eax], 0x5c
je 0x4288c4
add eax, 2
cmp word [eax], 0
jne 0x4288b3
jmp 0x4288c9
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0x10]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x42890a
cmp byte [esi], 0
je 0x4288f5
cmp byte [eax], 0x5c
je 0x4288f2
inc eax
cmp byte [eax], 0
jne 0x4288e5
jmp 0x4288f5
mov byte [eax], 0
lea eax, [esp + 0x10]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.0049227f
add esp, 4
test edi, edi
jne 0x428936
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0049110c
add esp, 0x11c
ret
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049110c
add esp, 0x11c
ret

Function at 0x428bc0
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
push 0x4d6b60
mov dword [0x4d6b60], eax
mov dword [0x4d6b64], eax
mov dword [0x4d6b68], eax
mov dword [0x4d6b6c], eax
mov dword [0x4d6b70], eax
mov dword [0x4d6b74], eax
mov dword [0x4d6b78], eax
mov dword [0x4d6b7c], eax
mov dword [0x4d6b80], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.0047a7c0
test eax, eax
jne 0x428c5b
push esi
cmp dword [0x4d3624], eax
jne 0x428c10
xor esi, esi
jmp 0x428c2b
push 2
call dword [0x4d3660]
mov esi, eax
add esp, 4
test esi, esi
je 0x428c2b
push esi
call dword [0x4d3668]
add esp, 4
mov edx, 0x4d3860
call fcn.00422da0
mov eax, dword [0x4d5838]
mov dword [0x4d386c], eax
mov dword [0x4d5838], 0x4d3860
test esi, esi
je 0x428c57
push esi
call dword [0x4d3670]
add esp, 4
xor eax, eax
pop esi
ret
xor eax, eax
ret
Function at 0x42ce90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + 0x3c]
sub esp, 0x14
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [edx], ebx
jne 0x42cec3
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f3f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
add esp, 0x14
test eax, eax
jne 0x42cf9f
mov ebx, eax
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x42ceff
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.004a6160
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 5
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], ecx
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x42cf9d
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x18]
ja 0x42cf8e
test byte [ebp + 0x14], 0x20
jne 0x42cf8e
mov ebx, dword [esi + 0x80]
mov eax, ebx
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.004a6160
mov ecx, dword [esi + 0x3c]
mov ebp, dword [ebp]
push edx
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
push ebx
push ebp
push ecx
call eax
add esp, 0x14
mov dword [esp + 0x10], eax
cmp edi, 1
jne 0x42cf70
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 0x18]
mov dword [esi + 0x64], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x68], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x6c], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x70], edx
cmp edi, dword [esi + 0x20]
jbe 0x42cf78
mov dword [esi + 0x20], edi
mov eax, dword [esp + 0x24]
mov ebx, dword [eax]
mov eax, dword [esi + 0x58]
call fcn.0043b850
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x24], ecx
test ebx, ebx
je 0x42ceff
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x44aa70
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x44aa8a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x44
call fcn.00423c10
mov edi, eax
test edi, edi
je 0x44aa81
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
push eax
push ecx
push esi
call fcn.0044a5b0
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.0044a720
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.0044a330
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.0044a5b0
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.0044a330
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.0044a5b0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.0044aa70
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.0044a330
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.0044a330
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
add esp, 0x20
and cx, dx
mov dword [edi + 0x24], eax
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4522a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
xor eax, eax
push edi
mov ecx, ebx
test ebx, ebx
jne 0x4522b6
xor ebp, ebp
jmp 0x4522cf
cmp byte [ebx], al
je 0x4522c5
lea ebx, [ebx]
inc ecx
cmp byte [ecx], al
jne 0x4522c0
sub ecx, ebx
and ecx, 0x3fffffff
mov ebp, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 4]
xor edi, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x4523d2
push esi
lea esp, [esp]
cmp edi, 2
mov esi, edi
jge 0x4522fa
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x45235d
mov edi, dword [esp + 0x1c]
mov edi, dword [edi + 8]
mov edx, esi
shl edx, 4
mov edi, dword [edx + edi]
mov edx, ecx
mov dl, byte [edx]
test dl, dl
je 0x452341
lea esp, [esp]
movzx ebx, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x4ba8f0]
cmp dl, byte [ebx + 0x4ba8f0]
jne 0x45233d
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x452320
mov ebx, dword [esp + 0x20]
movzx edx, byte [edi]
movzx ecx, byte [ecx]
movzx edx, byte [edx + 0x4ba8f0]
movzx ecx, byte [ecx + 0x4ba8f0]
sub ecx, edx
mov edi, dword [esp + 0x10]
jne 0x4523c2
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
shl esi, 4
mov esi, dword [esi + eax + 0xc]
add esi, 4
cmp dword [esi + 0xc], 0
je 0x4523a9
xor eax, eax
mov edx, ebp
mov ecx, ebx
test ebp, ebp
jle 0x4523a3
mov edi, edi
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4ba8f0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x452380
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
xor edx, edx
div dword [esi]
jmp 0x4523ab
xor edx, edx
push ebp
push ebx
mov eax, esi
call fcn.00426980
add esp, 8
test eax, eax
je 0x4523d9
mov eax, dword [eax + 8]
test eax, eax
jne 0x4523d1
inc edi
cmp edi, dword [esp + 0x14]
mov dword [esp + 0x10], edi
jl 0x4522f0
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret
xor eax, eax
jmp 0x4523c2
Function at 0x452470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
mov dword [esp + 0x10], esi
mov ecx, ebp
test ebp, ebp
jne 0x45248a
xor ebx, ebx
jmp 0x4524a0
cmp byte [ebp], 0
je 0x452496
inc ecx
cmp byte [ecx], 0
jne 0x452490
sub ecx, ebp
and ecx, 0x3fffffff
mov ebx, ecx
mov ecx, dword [edx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ecx
test ecx, ecx
jle 0x45259a
mov ecx, dword [edx + 8]
mov dword [esp + 0x14], ecx
push edi
lea ecx, [ecx]
cmp eax, 2
mov ecx, eax
jge 0x4524ca
xor ecx, 1
mov edx, dword [esp + 0x18]
shl ecx, 4
mov edi, dword [ecx + edx + 0xc]
add ecx, edx
mov edx, dword [esp + 0x28]
test edx, edx
je 0x452529
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x452511
jmp 0x4524f0
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4ba8f0]
cmp cl, byte [eax + 0x4ba8f0]
jne 0x45250d
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x4524f0
mov eax, dword [esp + 0x10]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x4ba8f0]
movzx edx, byte [edx + 0x4ba8f0]
sub edx, ecx
jne 0x452586
cmp dword [edi + 0x20], 0
lea esi, [edi + 0x14]
je 0x452565
xor eax, eax
mov edx, ebx
mov ecx, ebp
test ebx, ebx
jle 0x45255f
lea esp, [esp]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4ba8f0]
lea ebp, [eax*8]
xor edi, ebp
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x452540
mov ebp, dword [esp + 0x24]
xor edx, edx
div dword [esi]
jmp 0x452567
xor edx, edx
push ebx
push ebp
mov eax, esi
call fcn.00426980
add esp, 8
test eax, eax
je 0x4525a1
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x452599
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jl 0x4524c0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov dword [esp + 0x14], 0
jmp 0x452582
Function at 0x456ce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [ecx]
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
test ebx, ebx
je 0x456d7c
cmp byte [ebx], 0
mov eax, ebx
je 0x456d0c
inc eax
cmp byte [eax], 0
jne 0x456d06
mov edi, dword [esp + 0x20]
sub eax, ebx
and eax, 0x3fffffff
add edi, 0x190
cmp dword [edi + 0xc], 0
mov esi, eax
je 0x456d59
xor eax, eax
mov edx, esi
mov ecx, ebx
test esi, esi
jle 0x456d53
nop
movzx ebx, byte [ecx]
movzx ebx, byte [ebx + 0x4ba8f0]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc ecx
test edx, edx
jg 0x456d30
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
xor edx, edx
div dword [edi]
jmp 0x456d5b
xor edx, edx
push esi
push ebx
mov eax, edi
call fcn.00426980
add esp, 8
test eax, eax
je 0x456d74
mov eax, dword [eax + 8]
mov ecx, dword [esp + 0x24]
jmp 0x456d83
mov ecx, dword [esp + 0x24]
xor eax, eax
jmp 0x456d83
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x456d99
movzx ecx, byte [ebp + 0x4bb168]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ecx, dword [esp + 0x24]
cmp dword [eax + 0xc], 0
jne 0x456dba
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x456cf7
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
pop edi
pop esi
mov dword [ecx + 0xc], edx
mov eax, dword [eax + 0x10]
pop ebp
mov dword [ecx + 0x10], 0
xor eax, eax
pop ebx
add esp, 0xc
ret