joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x59d350]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3f04]
mov esi, 4
mov eax, dword [edi + 0xfc]
add edi, 0xfc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x46d9c0]
sub esi, 1
jne 0x4257b7
mov eax, dword [0x59d350]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x4257f1
push ecx
push dword [ebp - 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004374d0
add esp, 8
mov esi, dword [edi + 4]
mov ecx, dword [edi]
cmp ecx, esi
jne 0x42581e
inc ecx
test esi, esi
je 0x42580a
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x42580f
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.004382b0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x426c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x47400c]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov esi, dword [0x59d350]
mov ebx, ecx
cmp byte [esi + 0x4291], 0
jne 0x426cc4
cmp byte [esi + 0x4292], 0
je 0x426d48
movss xmm1, dword [esi + 0x390c]
mov ebx, 1
movaps xmm0, xmm1
mulss xmm1, dword [0x46e4f8]
mulss xmm0, dword [0x46e50c]
addss xmm1, dword [esi + 0xd5c]
addss xmm0, dword [esi + 0xd58]
mov dword [esi + 0x4008], 0
mov dword [esi + 0x400c], 0
movss dword [esi + 0x4004], xmm1
mov dword [esi + 0x3ff0], 1
movss dword [esi + 0x4000], xmm0
mov byte [esi + 0x4028], 1
movss xmm0, dword [esi + 0x3968]
mulss xmm0, dword [0x46e43c]
or dword [esi + 0x3fec], 0x41
movss dword [esi + 0x4044], xmm0
movaps xmm0, xmmword [0x46e6f0]
xor ecx, ecx
movups xmmword [esp + 0xc], xmm0
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0xe
jb 0x426d56
movsx eax, word [esi + 0x52fa]
push eax
lea eax, [esp + 0x11]
mov byte [esp + 0x1f], 0
push eax
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004171e0
add esp, 0x10
test bl, 1
je 0x426dfb
lea ecx, [esp + 0x1c]
call fcn.0041f330
test eax, eax
je 0x426dfb
cmp byte [eax + 0xc3], 0
je 0x426dfb
movaps xmm0, xmmword [str._n1127.]
mov byte [eax + 0xca], 1
mov byte [eax + 0xe4], 1
mov ax, word [esi + 0x52fa]
inc ax
xor ecx, ecx
movzx edx, ax
mov word [esi + 0x52fa], dx
movups xmmword [esp + 0xc], xmm0
nop
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0xe
jb 0x426dd0
movsx eax, dx
push eax
lea eax, [esp + 0x11]
mov byte [esp + 0x1f], 0
push eax
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004171e0
add esp, 0x10
push 0x22c0347
xor edx, edx
lea ecx, [esp + 0x20]
call fcn.00421ef0
mov ecx, dword [esp + 0x30]
add esp, 4
pop esi
pop ebx
xor ecx, esp
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
Function at 0x4273c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
mov esi, dword [0x59d350]
mov ebx, ecx
push edi
mov eax, dword [esi + 0x40bc]
cmp eax, dword [esi + 0x40c8]
jg 0x4273e9
mov dword [esi + 0x3fec], 0
xor al, al
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3f04]
xor edx, edx
mov ecx, dword [eax + 0xfc]
mov eax, dword [eax + 0x104]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.00417220
mov edi, eax
add esp, 4
cmp dword [esi + 0x3f28], edi
jne 0x427426
push ecx
push ebx
mov edx, 0xb
mov ecx, edi
call fcn.004374d0
add esp, 8
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.004272a0
Function at 0x42bc50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x42bcd2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x42bc8c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00438050
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.004179b0
mov edx, dword [esi]
mov ecx, 0x59d321
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.004179b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c0c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x42c108
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x42c0ef
cmp byte [esi], bl
jne 0x42c0ef
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x46d9c0]
test bl, bl
jne 0x42c0e0
mov ebx, dword [0x59d350]
mov edi, dword [ebx + 0x5390]
test edi, edi
je 0x42c140
lea esi, [edi + 4]
test esi, esi
je 0x42c140
not eax
cmp dword [esi], eax
je 0x42c14f
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x42c121
mov ecx, dword [ebp - 4]
call fcn.0042bfe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c160
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x59d350]
test bl, bl
je 0x42c1a6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x42c187
cmp byte [esi], bl
jne 0x42c187
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x46d9c0]
test bl, bl
jne 0x42c178
mov edi, dword [0x59d350]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x42c1cc
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x42c1d2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x42c1c0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x42f610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x1c], eax
push esi
push edi
test ebx, ebx
jle 0x42f78f
lea edi, [edx + 0x18]
nop word [eax + eax]
mov edx, dword [edi - 0x18]
test edx, edx
je 0x42f783
mov ecx, eax
call fcn.0042efe0
mov esi, eax
mov eax, dword [edi - 0x14]
test eax, eax
je 0x42f66e
mov ecx, dword [ebp - 0x1c]
push eax
add ecx, 0x5340
call fcn.00417770
mov ecx, eax
jmp 0x42f670
xor ecx, ecx
mov dword [esi + 0x18], ecx
movsx eax, word [edi]
movd xmm1, eax
movsx eax, word [edi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x34], xmm1
movss dword [esi + 0x38], xmm0
movsx eax, word [edi + 4]
movd xmm1, eax
movsx eax, word [edi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x3c], xmm1
movss dword [esi + 0x40], xmm0
movsx eax, word [edi + 8]
movd xmm1, eax
movsx eax, word [edi + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [esi + 0x9c]
cvtdq2ps xmm0, xmm0
and eax, 0xfffffe49
or eax, 0x49
mov dword [esi + 0x9c], eax
movss dword [esi + 0x44], xmm1
movss dword [esi + 0x48], xmm0
test ecx, ecx
je 0x42f6fe
cmp dword [ecx + 0x1c], 0
jne 0x42f6f5
mov dword [ecx + 0x1c], esi
jmp 0x42f6fe
cmp dword [ecx + 0x20], 0
jne 0x42f6fe
mov dword [ecx + 0x20], esi
mov eax, dword [edi - 0xc]
mov edx, esi
mov dword [esi + 0x94], eax
movsx eax, byte [edi - 8]
mov dword [esi + 0x4c], eax
mov ecx, dword [edi - 4]
mov eax, dword [esi + 0xc]
and ecx, 0xc1fc20
or eax, dword [esi + 4]
or eax, ecx
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42f739
nop
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x42f730
movaps xmm0, xmmword [0x46e950]
xor ecx, ecx
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], 0
nop word [eax + eax]
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xf
jb 0x42f750
push dword [edx]
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.004171e0
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.0041f330
mov dword [esi + 0x70], eax
mov eax, dword [ebp - 0x1c]
add edi, 0x24
sub ebx, 1
jne 0x42f640
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
Function at 0x431690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x59d350]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
movss xmm0, dword [eax + 0x3894]
addss xmm0, xmm0
mov dword [ebp - 8], ebx
push edi
mov edi, edx
movss xmm2, dword [esi + 0x34]
addss xmm0, dword [eax + 0x3c98]
addss xmm0, dword [esi + 0x38]
cmp dword [eax + 0x387c], ebx
jne 0x4316dd
movss dword [eax + 0x4000], xmm2
mov dword [eax + 0x4008], ebx
jmp 0x4316f8
movss xmm1, dword [esi + 0x3c]
addss xmm1, xmm2
mov dword [eax + 0x4008], 0x3f800000
movss dword [eax + 0x4000], xmm1
or dword [eax + 0x3fec], 1
mov cl, 0x3c
mov byte [eax + 0x4028], 1
mov dword [eax + 0x3ff0], 1
mov dword [eax + 0x400c], ebx
movss dword [eax + 0x4004], xmm0
xor eax, eax
mov dword [ebp - 0x28], 0x556b1f3c
mov dword [ebp - 0x24], 0x4b535852
mov dword [ebp - 0x20], 0x49525971
mov byte [ebp - 0x1c], bl
nop word [eax + eax]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xb
jae 0x43174f
mov cl, byte [ebp - 0x28]
jmp 0x431740
lea ecx, [ebp - 0x27]
mov byte [ebp - 0x1c], bl
call fcn.004273c0
test al, al
je 0x4318ba
or byte [esi + 0xa0], 2
mov eax, dword [edi]
cmp eax, 1
jne 0x4317d6
mov eax, dword [esi + 0x10]
mov cl, 0x58
shr eax, 0xd
and al, 1
mov dword [ebp - 0x18], 0x3c311058
mov byte [ebp - 8], al
xor eax, eax
mov dword [ebp - 0x14], 0x392c783d
mov dword [ebp - 0x10], 0x393a783a
mov word [ebp - 0xc], 0x2a
nop word [eax + eax]
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x4317af
mov cl, byte [ebp - 0x18]
jmp 0x4317a0
push ecx
push dword [ebp - 8]
mov byte [ebp - 0xb], bl
push ecx
lea ecx, [ebp - 0x17]
call fcn.00458bb0
add esp, 0xc
test al, al
je 0x431871
or byte [esi + 0xa1], 4
jmp 0x431871
xor ebx, ebx
test eax, eax
jle 0x43186f
xor eax, eax
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, dword [edi + 8]
add esi, eax
test dword [esi + 4], 0x200000
jne 0x43185f
mov ecx, dword [esi + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x431817
mov ecx, dword [ecx]
jmp 0x431820
mov ecx, dword [esi + 0x20]
add ecx, dword [edi + 0x8c]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi]
cmp eax, dword [edi + 0x14]
push 0
sete dl
call fcn.00457a80
add esp, 8
test al, al
je 0x43183f
mov eax, dword [esi]
mov dword [ebp - 8], eax
movss xmm1, dword [0x46e5d0]
xorps xmm0, xmm0
call fcn.00426240
push 0x46e1b8
call fcn.0044dc20
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, 0x2c
mov dword [ebp - 4], eax
cmp ebx, dword [edi]
jl 0x4317f0
mov ebx, dword [ebp - 8]
jmp 0x431871
xor ebx, ebx
mov esi, dword [0x59d350]
mov ecx, dword [esi + 0x3f04]
cmp dword [esi + 0x4120], ecx
jne 0x43189e
cmp byte [esi + 0x4179], 0
je 0x43189e
cmp dword [esi + 0x4158], 0
jne 0x43189e
or dword [esi + 0x417c], 2
test dword [ecx + 8], 0x1000000
je 0x4318ae
mov byte [esi + 0x3eb2], 1
call fcn.00424e40
mov byte [esi + 0x3eb2], 0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4372e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x59d350]
sub esp, 0x44
cmp byte [ecx + 0x53e4], 0
push esi
mov dword [ecx + 0x53e8], 0
je 0x4374be
mov esi, dword [ecx + 0x3f30]
xorps xmm4, xmm4
mov dword [ecx + 0x428c], 7
movss xmm0, dword [ecx + 0x2eb0]
ucomiss xmm0, xmm4
lahf
test ah, 0x44
jnp 0x4373a0
movss xmm2, dword [ecx + 0x34]
comiss xmm0, xmm2
jbe 0x4373a7
movss xmm3, dword [ecx + 0x38]
movaps xmm1, xmm0
subss xmm1, dword [ecx + 0x18]
ucomiss xmm0, xmm4
lahf
test ah, 0x44
jp 0x43734f
mov eax, 1
jmp 0x43739c
comiss xmm1, xmm0
jb 0x437358
xor eax, eax
jmp 0x43739c
comiss xmm4, xmm3
jb 0x43736e
comiss xmm2, xmm1
jbe 0x437354
comiss xmm0, xmm2
jb 0x437354
mov eax, 1
jmp 0x43739c
comiss xmm2, xmm1
jbe 0x437378
or edx, 0xffffffff
jmp 0x437384
subss xmm1, xmm2
divss xmm1, xmm3
cvttss2si edx, xmm1
comiss xmm2, xmm0
jbe 0x43738e
or eax, 0xffffffff
jmp 0x43739a
subss xmm0, xmm2
divss xmm0, xmm3
cvttss2si eax, xmm0
sub eax, edx
test eax, eax
jle 0x4373a7
mov byte [ecx + 0x53e4], 0
movss xmm0, dword [ecx + 0x36a8]
ucomiss xmm0, xmm4
lahf
test ah, 0x44
jp 0x4373c9
test esi, esi
je 0x4373c9
mov dword [ecx + 0x53e8], esi
mov byte [ecx + 0x53e4], 0
or dword [ecx + 0x3fec], 0x40
mov dword [ecx + 0x4044], 0x3f19999a
xor ecx, ecx
call fcn.00426c90
movaps xmm0, xmmword [0x46ed50]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x4c2c
mov byte [ebp - 6], 0
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x11
jb 0x4373f8
lea eax, [ebp - 0x17]
mov byte [ebp - 6], 0
push esi
push eax
call fcn.0044dc20
movaps xmm0, xmmword [0x46e960]
add esp, 8
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x481c1a07
xor ecx, ecx
mov dword [ebp - 0xc], 0x30b0118
mov dword [ebp - 8], 0x460f0601
mov byte [ebp - 4], 0
nop dword [eax]
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x1b
jb 0x437440
lea eax, [ebp - 0x1f]
mov byte [ebp - 4], 0
push eax
call fcn.0044dc20
movaps xmm0, xmmword [0x46fb60]
add esp, 4
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x2266282f
xor ecx, ecx
mov dword [ebp - 0x2c], 0x21332423
mov dword [ebp - 0x28], 0x67342321
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x1b
jb 0x437483
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x24], 0
push eax
xor ecx, ecx
mov eax, 0x10
test esi, esi
cmove ecx, eax
mov eax, dword [0x59d350]
add eax, 0x391c
add eax, ecx
push eax
call fcn.0044dcb0
add esp, 8
call fcn.00424e40
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43fc50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43fc8a
mov eax, dword [0x59d350]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x43fc7d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x43fcbb
mov eax, dword [0x59d350]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x43fcae
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43fcec
mov eax, dword [0x59d350]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x43fcdf
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x43fd39
mov eax, dword [0x59d350]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x43fd2c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x43fd6a
mov eax, dword [0x59d350]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x43fd5d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x43fd9b
mov eax, dword [0x59d350]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x43fd8e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00442680
Function at 0x442e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebx + 0x18], 0
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x84], esi
jne 0x44305f
cmp dword [ebx + 0x14], 0
jne 0x442fff
cmp dword [ebx + 0x4c], 0
jne 0x442fde
push 0x78
lea eax, [ebp - 0x120]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0xffff
mov byte [ebp - 0x118], 1
mov ecx, 0x1e
mov dword [ebp - 0x10c], 3
lea esi, [ebp - 0x120]
mov dword [ebp - 0x108], 1
lea edi, [ebp - 0x80]
mov dword [ebp - 0xe8], 0x7f7fffff
mov dword [ebp - 0xdc], 0x3f800000
xorps xmm0, xmm0
mov word [ebp - 0xd8], ax
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
movss xmm2, dword [ebp - 0x70]
comiss xmm0, xmm2
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x6c], 1
mov byte [ebp - 0x64], 1
jb 0x442f24
movss xmm2, dword [0x46e504]
movss dword [ebp - 0x70], xmm2
cmp byte [ebp - 0x36], 0
jne 0x442f99
movaps xmm0, xmmword [0x46ec00]
xor ecx, ecx
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x8c], 0x1e5f5a56
mov word [ebp - 0x88], 0x20a
mov byte [ebp - 0x86], 0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x9c]
xor byte [ebp + ecx - 0x9b], al
inc ecx
cmp ecx, 0x15
jb 0x442f60
cvttss2si eax, xmm2
mov byte [ebp - 0x86], 0
push eax
lea eax, [ebp - 0x9b]
push eax
lea eax, [ebp - 0x36]
push 0x28
push eax
call fcn.004171e0
movss xmm2, dword [ebp - 0x70]
add esp, 0x10
movaps xmm0, xmm2
mov eax, 0x85
divss xmm0, dword [0x46e504]
mov word [ebp - 0x38], ax
mov ecx, 0x46e25c
cvttss2si eax, xmm0
movd xmm0, eax
mov eax, dword [ebp - 0x50]
test eax, eax
cvtdq2ps xmm0, xmm0
cmovne ecx, eax
lea eax, [ebp - 0x80]
push ecx
push eax
push 0
mov ecx, ebx
movss dword [ebp - 0x54], xmm0
call fcn.00443280
mov edi, dword [ebp - 0xa0]
mov eax, dword [ebx + 0x458]
test eax, eax
jne 0x442ff7
mov dword [0x59d3cc], 0x4434c0
mov eax, 0x59d3cc
mov eax, dword [eax]
push ebx
call eax
add esp, 4
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x443059
mov eax, dword [ebx + 0x1c]
imul eax, dword [ebx + 0x20]
mov ecx, dword [0x59d350]
shl eax, 2
test ecx, ecx
je 0x443020
inc dword [ecx + 0xb0]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebx + 0x1c]
add esp, 4
imul ecx, dword [ebx + 0x20]
mov edx, eax
mov dword [ebx + 0x18], edx
test ecx, ecx
jle 0x443059
nop word [eax + eax]
movzx eax, byte [esi]
lea edx, [edx + 4]
shl eax, 0x18
lea esi, [esi + 1]
or eax, 0xffffff
dec ecx
mov dword [edx - 4], eax
test ecx, ecx
jg 0x443040
mov esi, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebx + 0x18]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x443079
mov eax, dword [ebx + 0x1c]
mov dword [ecx], eax
test edi, edi
je 0x443082
mov eax, dword [ebx + 0x20]
mov dword [edi], eax
test esi, esi
je 0x44308c
mov dword [esi], 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466a4b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x448620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x47400c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x59d350]
mov dword [esp + 0x28], ebx
push esi
push edi
test ebx, ebx
je 0x44864a
mov esi, dword [ebx + 0x78]
jmp 0x44864c
xor esi, esi
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], esi
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00442e40
mov eax, dword [ebx + 0x40]
mov ebx, dword [esp + 0x20]
cmp byte [eax + 0x12], 0
je 0x4486f5
mov eax, ebx
imul eax, dword [esp + 0x10]
mov ecx, eax
mov dword [esp + 0x1c], eax
imul ecx, dword [esp + 0x28]
mov eax, dword [0x59d350]
test eax, eax
je 0x44869a
inc dword [eax + 0xb0]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [esp + 0x1c]
mov esi, edi
mov dword [esp + 0x18], edi
lea eax, [edi + eax*4]
mov dword [esp + 0x2c], eax
cmp edi, eax
jae 0x4486fd
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
sub eax, edi
mov edi, eax
mov edx, dword [edi + esi]
mov eax, edx
shr eax, 0x10
movzx ecx, al
movzx eax, dl
and edx, 0xff00ff00
shl eax, 0x10
or ecx, eax
or ecx, edx
mov dword [esi], ecx
add esi, 4
cmp esi, ebx
jb 0x4486c7
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
jmp 0x4486fd
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x14]
push 0
lea esi, [eax + 0xc]
mov dword [esi], 0
mov eax, dword [eax]
push esi
push 0
push 0x15
mov ecx, dword [eax]
push 0x200
push 1
push dword [esp + 0x28]
push ebx
push eax
call dword [ecx + 0x5c]
test eax, eax
js 0x4487cf
mov eax, dword [esi]
lea edx, [esp + 0x34]
push 0
push 0
push edx
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x4c]
test eax, eax
jne 0x4487cf
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x448774
imul ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
imul eax, esi
push ebx
push edi
add eax, dword [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memcpy
inc esi
add esp, 0xc
add edi, ebx
cmp esi, dword [esp + 0x10]
jl 0x448755
mov esi, dword [esp + 0x14]
push 0
mov eax, dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 0xc]
mov ecx, dword [edx + 0x40]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x40]
cmp byte [eax + 0x12], 0
je 0x4487bb
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4487b1
mov ecx, dword [0x59d350]
test ecx, ecx
je 0x4487b1
dec dword [ecx + 0xb0]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x3c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00466a4b
mov esp, ebp
pop ebp
ret