joyce8/EMBER2024-capa huggingface dataset:
Function at 0x112a4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [eax], ebx
mov edi, 0x104
lea eax, [ebp - 0x208]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x112af8
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x112ace
mov esi, 0x153080
push dword [esi]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x112ac2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x112ae3
add esi, 8
inc ebx
cmp esi, str.rundll32.exe
jb 0x112a90
lea eax, [ebp - 0x208]
push eax
push edi
push dword [ebp + 0x10]
call fcn.00109b89
push 1
pop eax
jmp 0x112afa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [ebx*8 + 0x153084]
add esp, 0xc
jmp 0x112afa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x113c6f
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x113d97
cmp dword [ebp + 0x14], edi
je 0x113d97
cmp dword [ebp + 0x18], edi
je 0x113d97
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x113d97
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
jne 0x113cc8
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], ecx
mov ebx, ecx
cmp dword [ebp + 0x10], edi
jne 0x113cd6
lea ecx, [ebp - 0x13c]
mov dword [ebp + 0x10], ecx
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 4]
push edi
push ecx
push 0x40
push ebx
push eax
call esi
test eax, eax
je 0x113d8e
cmp dword [ebp - 4], 0x40
jne 0x113d8e
cmp word [ebx], 0x5a4d
jne 0x113d8e
push edi
push edi
push dword [ebx + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
call ebx
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x3c]
jne 0x113d8e
lea eax, [ebp - 4]
push edi
push eax
push 0xf8
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
je 0x113d8e
cmp dword [ebp - 4], 0xf8
jne 0x113d8e
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
jne 0x113d8e
cmp word [eax + 6], di
je 0x113d8e
movzx eax, word [eax + 0x14]
push 1
sub eax, 0xe0
push edi
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [ebp + 0x18]
lea eax, [eax + eax*4]
shl eax, 3
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
call esi
test eax, eax
je 0x113d8e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push 0x28
xor edx, edx
pop ecx
div ecx
jmp 0x113d99
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x113e29
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x113ebe
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x48]
push 0x40
push eax
push ebx
call esi
test eax, eax
je 0x113eb6
cmp dword [ebp + 8], 0x40
jne 0x113eb6
cmp word [ebp - 0x48], 0x5a4d
jne 0x113eb6
push edi
push edi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x113eb6
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 8]
push 4
push eax
push ebx
call esi
test eax, eax
je 0x113eb6
cmp dword [ebp + 8], 4
jne 0x113eb6
cmp dword [ebp - 8], 0x4550
jne 0x113eb6
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x1141db
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push esi
push eax
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x114227
push edi
push esi
push str.ProgramFiles
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x114264
push esi
call fcn.0013665c
test eax, eax
pop ecx
mov dword [ebp + 0xc], eax
jbe 0x114248
add eax, esi
cmp byte [eax - 1], 0x5c
je 0x114248
mov byte [eax], 0x5c
mov eax, dword [ebp + 0xc]
and byte [eax + esi + 1], 0
push esi
call fcn.0013665c
cmp eax, 3
pop ecx
mov dword [ebp + 0xc], eax
jb 0x114264
push esi
call dword [sym.imp.MSVCRT.dll__mbslwr]
pop ecx
push 1
pop eax
jmp 0x114266
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x11440d
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [0x16cdd4], 0
jne 0x114464
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x24]
mov dword [ebp - 0x64], 0x40
mov word [0x16cdd8], ax
mov eax, dword [ebp - 0xc]
mov dword [0x16cde0], eax
mov eax, dword [ebp - 0x10]
mov dword [0x16cde4], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
push 0x14
pop ecx
call fcn.00136900
mov dword [0x16cddc], eax
push 1
pop eax
leave
ret
Function at 0x11481b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
and dword [ebp - 4], 0
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.netCheck
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
leave
ret

Function at 0x114a16
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x114ac7
cmp byte [esi], 0
je 0x114ac7
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
cmp byte [esi + 1], 0x3a
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
jne 0x114a59
cmp byte [esi + 2], 0x5c
je 0x114a9f
test byte [ebp + 0xc], 1
je 0x114a80
push 0
lea eax, [ebp - 0x104]
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x114ac7
lea eax, [ebp - 0x104]
push esi
push eax
jmp 0x114a8c
test byte [ebp + 0xc], 2
je 0x114ac7
push esi
push 0x16cf30
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea esi, [ebp - 0x104]
test esi, esi
je 0x114ac7
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x114ac7
test byte [ebp + 0xd], 1
je 0x114abf
push esi
call fcn.0010cf93
test eax, eax
pop ecx
je 0x114ac7
push esi
call fcn.0010ca00
jmp 0x114ac9
xor eax, eax
pop esi
leave
ret

Function at 0x1150ed
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x155514], 0
push ebx
je 0x1151db
push 1
pop ebx
cmp dword [0x16ce10], 0
jne 0x1151c4
and byte [ebp - 0x10c], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 4]
push eax
push 0x1595d8
push str.CLSID2AB1C516_6654_4D3A_B3D6_2185BBCEB409
push SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x1151a9
lea eax, [ebp - 0x10c]
push esi
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x1151af
cmp eax, esi
jae 0x1151af
lea eax, [ebp - 0x10c]
push str.csvrelay32.dll
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
test eax, eax
je 0x1151af
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1151af
mov dword [0x16ce10], ebx
pop edi
pop esi
cmp dword [0x16ce10], 0
jne 0x1151c4
mov dword [0x16ce10], 2
cmp dword [0x16ce10], ebx
jne 0x1151db
push str._safemon__Compatible_cisco_vpn
call fcn.00103418
pop ecx
mov eax, ebx
jmp 0x1151dd
xor eax, eax
pop ebx
leave
ret
Function at 0x11604a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x10c]
mov esi, ecx
push eax
lea eax, [ebp - 4]
push eax
push 0x153238
push 0x1531f8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1160c8
lea edi, [esi + 4]
mov esi, 0x153618
push dword [esi]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1160ce
add esi, 4
cmp esi, 0x153620
jb 0x116095
xor eax, eax
pop edi
pop esi
leave
ret
push 1
pop eax
jmp 0x1160ca

Function at 0x1164a5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
push 0
push eax
push 0x1164f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x1164f2
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x11935a
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x11aa69
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 1
pop edi
mov esi, ecx
cmp eax, edi
jne 0x11aaff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0xf0]
test edx, edx
je 0x11aad9
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x11aad9
cmp eax, ecx
jbe 0x11aad9
sub eax, ecx
cmp eax, 0xbb8
jb 0x11abcb
push str.CNavigatMon::OnTimer_QuerySE_Timeout
call fcn.00103418
and dword [esi + 0xe0], 0
and dword [esi + 0xf0], 0
pop ecx
push edi
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
call fcn.0011dadf
jmp 0x11abcb
push dword [esi + 0xe0]
push edx
push str.CNavigatMon::OnTimer_QuerySE_Timer_none_searchID_OR_time_error__d___d_
call fcn.00103418
add esp, 0xc
push edi
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x11abcb
cmp eax, 2
jne 0x11ab1a
push str.CNavigatMon::OnTimer_Remove_Mask
call fcn.00103418
pop ecx
mov ecx, esi
call fcn.0011e6f3
push 2
jmp 0x11aaee
cmp eax, 3
jne 0x11ab46
push str.CNavigatMon::OnTimer_Continue_Download
call fcn.00103418
mov eax, dword [esi + 0x84]
pop ecx
cmp dword [eax - 8], 0
jle 0x11ab42
push 0
push 0
push eax
mov ecx, esi
call int.0011cea7
push 3
jmp 0x11aaee
cmp eax, 4
jne 0x11ab91
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0xe4]
lea ecx, [esi + 0xe4]
cmp eax, edx
jb 0x11ab6a
sub eax, edx
cmp eax, 0x7d0
jb 0x11ab7e
push 3
and dword [ecx], 0
pop edi
push 4
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_KillTimer]
push edi
mov ecx, esi
push dword [esi + 0x70]
push dword [esi + 0xc0]
call fcn.0011d98a
jmp 0x11abcb
cmp eax, 6
jne 0x11abbd
push str._safemon__OnTimer___TIMER_BHO_WAITQQEMAIL__JS_loaded_ok__Start_to_query_url
call fcn.00103418
pop ecx
push 0
mov ecx, esi
push dword [esi + 0xcc]
push dword [esi + 0xc4]
call fcn.0011dce7
push 6
jmp 0x11aaee
cmp eax, 7
jne 0x11abcb
push 0
mov ecx, esi
call int.0011e8ef
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41635b
Capabilities:
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov edi, dword [eax]
mov esi, dword [edi + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x416398
dec eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
push 0x18
push edi
call fcn.00414130
add esp, 0xc
mov eax, dword [esi]
test eax, eax
je 0x4163a3
dec eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
pop edi
ret
push esi
call fcn.004b3f30
add esp, 4
jmp 0x41636d
push esi
call fcn.004b3f30
add esp, 4
jmp 0x41638a

Function at 0x416a51
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x416a2d
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4169ed
mov esi, eax
cmp eax, 1
jne 0x416a1d
xor eax, eax
jmp 0x416a2a
mov al, byte [0x519171]
push 8
push 0x18
call fcn.00414120
add esp, 8
test eax, eax
je 0x416a43
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
mov eax, dword [edi]
test eax, eax
je 0x416a38
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x10]
push esi
call fcn.00416670
add esp, 8
pop esi
pop edi
ret
push edi
call fcn.004b3f30
add esp, 4
jmp 0x4169d7
push edi
call fcn.004b3f30
add esp, 4
jmp 0x416a15
push 0x18
push 8
call fcn.004b45c0
add esp, 8
ud2
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
test eax, eax
je 0x416a78
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x416a73
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x416a73
add eax, 8
ret
jmp 0x4169ca
push ecx
call fcn.004b3f30
add esp, 4
jmp 0x416a5c
Function at 0x42feec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edx, dword [edi + 0x20]
cmp edx, dword [esi + 0x20]
jne 0x42ff23
test edx, edx
je 0x42ff27
lea eax, [edx - 0x21]
cmp eax, 0xffffffe0
jb 0x42ff2d
xor ebx, ebx
xor eax, eax
mov cl, byte [esi + eax]
xor cl, byte [edi + eax]
inc eax
or bl, cl
cmp edx, eax
jne 0x42ff0f
test bl, bl
sete al
jmp 0x42ff29
xor eax, eax
jmp 0x42ff29
mov al, 1
pop esi
pop edi
pop ebx
ret
mov eax, 0x20
push 0x4cc13c
push eax
push eax
call fcn.004b4860
add esp, 0xc
ud2

Function at 0x43e1c2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
mov dword [eax - 0xc], 0
mov ebx, ecx
shr ebx, 0x18
mov byte [eax - 8], bl
mov ebx, ecx
shr ebx, 0x10
mov byte [eax - 7], bl
mov byte [eax - 6], ch
mov byte [eax - 5], cl
mov ecx, edi
mov ebx, edi
mov edi, esp
shr ecx, 0x18
mov byte [eax - 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax - 3], cl
lea ecx, [edx + 0xc]
mov byte [eax - 2], bh
mov byte [eax - 1], bl
lea ebx, [esp + 0xc]
push ecx
push edx
push eax
push edi
push ebx
call fcn.00448bf0
add esp, 0x14
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jae 0x43e23e
mov edx, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
mov bl, byte [edi + ecx]
xor byte [edx + ecx], bl
inc ecx
cmp eax, ecx
jne 0x43e233
mov eax, dword [esp + 8]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], edx
mov dword [esi], ecx
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
ret
Function at 0x448f11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edx, dword [ebp + 0xc]
mov eax, edx
sub eax, dword [ebp + 0x10]
jb 0x449096
mov ecx, eax
xor ebx, ebx
shr ecx, 4
test al, 0xf
setne bl
add ebx, ecx
je 0x44905d
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
xor edi, edi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
lea esi, [edi + eax]
cmp esi, edx
ja 0x449065
mov eax, edx
sub eax, esi
cmp eax, 0xf
jbe 0x44906e
mov ecx, dword [esp + 0x1c]
add esi, dword [ebp + 8]
mov edx, 1
movdqu xmm0, xmmword [ecx]
pshufd xmm1, xmm0, 0xff
movd eax, xmm1
bswap eax
inc eax
bswap eax
mov dword [ecx + 0xc], eax
xor eax, eax
mov ecx, dword [0x5195f4]
bt ecx, 9
setae al
or eax, 2
bt ecx, 0x19
cmovb eax, edx
cmp eax, 1
je 0x448fcd
cmp eax, 2
jne 0x448fe8
movdqu xmmword [esp + 8], xmm0
push dword [esp + 4]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00450440
jmp 0x449001
movdqu xmmword [esp + 8], xmm0
push dword [esp + 4]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00450480
jmp 0x449001
movdqu xmmword [esp + 8], xmm0
push dword [esp + 4]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004acec0
add esp, 0xc
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
lea eax, [edi + 0x10]
dec ebx
mov ecx, 0xfffffff0
movsd qword [esp + 0x10], xmm1
movsd qword [esp + 8], xmm0
mov edx, dword [esp + ecx + 0x18]
mov esi, dword [esp + ecx + 0x1c]
xor dword [esp + ecx + 0x30], edx
xor dword [esp + ecx + 0x34], esi
add ecx, 8
jne 0x449022
mov edx, dword [ebp + 0xc]
cmp edi, edx
ja 0x449076
mov ecx, edx
sub ecx, edi
cmp ecx, 0xf
jbe 0x449084
movups xmm0, xmmword [esp + 0x20]
mov ecx, dword [ebp + 8]
test ebx, ebx
movups xmmword [ecx + edi], xmm0
mov edi, eax
jne 0x448f53
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4d3934
push edx
push esi
jmp 0x44907d
push 0x4d3934
push eax
jmp 0x44908a
push 0x4d3944
push edx
push edi
call fcn.004b4ba0
jmp 0x449091
push 0x4d3944
push ecx
push 0x10
call fcn.004b4c10
add esp, 0xc
ud2
push 0x4d3924
push 0x2b
push 0x4d3719
call fcn.004b47c0
jmp 0x449091
Function at 0x4490a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov esi, dword [ecx + 8]
cmp esi, eax
jb 0x44922f
sub esi, eax
je 0x449227
mov edi, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
xorps xmm0, xmm0
cmp esi, 0x11
movups xmmword [esp], xmm0
mov ebx, dword [edi]
mov edx, dword [edi + 4]
mov edi, dword [edi + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jae 0x44923d
mov dword [esp + 0x18], ecx
add eax, ecx
mov edi, esp
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [edi]
cmp dword [ebx], 0
mov dword [esp + 0x10], ebx
movaps xmmword [esp + 0x30], xmm0
jne 0x44912f
movaps xmm0, xmmword [esp + 0x30]
mov eax, esp
movups xmmword [esp], xmm0
push eax
push dword [esp + 0x18]
call fcn.0044d1d3
add esp, 8
mov ecx, dword [ebp + 0xc]
mov edi, dword [0x5195f4]
mov eax, dword [esp + 0x1c]
movups xmm0, xmmword [ecx + 0xc]
xor ecx, ecx
bt edi, 9
mov eax, dword [eax]
setae cl
or ecx, 2
xor edx, edx
inc edx
bt edi, 0x19
cmovae edx, ecx
cmp edx, 1
je 0x44917a
mov ebx, dword [esp + 0x10]
cmp edx, 2
mov edi, esp
jne 0x449197
movups xmmword [esp], xmm0
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
call fcn.00450440
jmp 0x4491a7
movups xmmword [esp], xmm0
lea ecx, [esp + 0x20]
push eax
push ecx
lea edi, [esp + 8]
push edi
call fcn.00450480
add esp, 0xc
mov ebx, dword [esp + 0x10]
jmp 0x4491aa
movups xmmword [esp], xmm0
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
call fcn.004acec0
add esp, 0xc
movaps xmm0, xmmword [esp + 0x30]
mov eax, 0xfffffff0
movups xmmword [esp], xmm0
mov ecx, dword [esp + eax + 0x10]
mov edx, dword [esp + eax + 0x14]
xor dword [esp + eax + 0x30], ecx
xor dword [esp + eax + 0x34], edx
add eax, 8
jne 0x4491b8
movups xmm0, xmmword [esp + 0x20]
cmp dword [ebx], 0
je 0x449215
cmp esi, 0x10
movups xmmword [esp], xmm0
je 0x4491fa
mov ecx, 0x10
lea eax, [esp + esi]
sub ecx, esi
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
movups xmm0, xmmword [esp]
movaps xmmword [esp + 0x30], xmm0
movups xmmword [esp], xmm0
push edi
push dword [esp + 0x18]
call fcn.0044d1d3
movaps xmm0, xmmword [esp + 0x38]
add esp, 8
movaps xmmword [esp], xmm0
push esi
push edi
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4d3954
push esi
push eax
call fcn.004b4ba0
jmp 0x44924a
push 0x4d38ac
push 0x10
push esi
call fcn.004b4c10
add esp, 0xc
ud2
Function at 0x449b4f
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1c0
mov ebx, dword [ebp + 0x10]
push 0x519174
call fcn.0044caa0
add esp, 4
lea eax, [esp + 0x80]
xorps xmm0, xmm0
mov ecx, 0x10
mov esi, 0x4d4740
movaps xmmword [eax - 0x80], xmm0
movaps xmmword [eax - 0x70], xmm0
movaps xmmword [eax - 0x60], xmm0
movaps xmmword [eax - 0x50], xmm0
movaps xmmword [eax - 0x40], xmm0
movaps xmmword [eax - 0x30], xmm0
movaps xmmword [eax - 0x20], xmm0
movaps xmmword [eax - 0x10], xmm0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, esp
xor ecx, ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], 0x4d4740
mov dword [eax + 0x50], ecx
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0044aea7
add esp, 0xc
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
call fcn.0044aea7
add esp, 0xc
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push esi
call fcn.0044aea7
add esp, 0xc
lea edi, [esp + 0xe0]
push 0xd8
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.0044b0f5
add esp, 8
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret