joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419626
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
test eax, eax
push esi
push edi
je 0x419666
cdq
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.0044dd00
push edi
push esi
push edx
push eax
call fcn.0044dc00
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.004194c7
test eax, eax
pop ecx
pop ecx
jne 0x41968f
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x419696
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4196c2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4196f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4196f2
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x419712
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.0044dc00
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x41a0ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45ebcc]
sub esp, 0x310
test eax, eax
push ebx
push esi
je 0x41a11c
push eax
push 0x455e58
lea ecx, [ebp - 0x108]
mov edx, 0xe6
call fcn.0041860c
pop ecx
pop ecx
jmp 0x41a18a
call fcn.004192f2
test eax, eax
mov esi, 0xe6
je 0x41a152
lea eax, [ebp - 0x310]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x310]
push eax
call fcn.0041938b
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x41a16e
push 7
pop eax
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
call fcn.0041944c
jmp 0x41a144
push ebx
push 0x455e58
lea ecx, [ebp - 0x108]
mov edx, esi
call fcn.0041860c
push ebx
call sub.msvcrt.dll_free
add esp, 0xc
mov ecx, str.etilqs_
call fcn.00418872
lea ecx, [ebp - 0x108]
mov edx, eax
call fcn.00418872
lea eax, [edx + eax + 0x11]
cmp eax, 0x105
jl 0x41a1b1
xor eax, eax
inc eax
jmp 0x41a14e
lea ecx, [ebp - 0x108]
call fcn.00418872
test eax, eax
jbe 0x41a1ca
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x41a1ca
dec eax
jne 0x41a1c1
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x108]
push eax
push str._setilqs_
mov ecx, edi
mov edx, 0xf4
call fcn.0041860c
mov ecx, edi
call fcn.00418872
mov esi, eax
lea eax, [esi + edi]
push 0xf
call fcn.004187b0
add esp, 0xc
push 0xf
pop ecx
movzx eax, byte [esi + edi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + edi], al
inc esi
dec ecx
jne 0x41a203
mov byte [esi + edi], cl
xor eax, eax
jmp 0x41a14e
Function at 0x41a475
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push ebp
push edi
push dword [esp + 0x14]
xor ebp, ebp
xor ebx, ebx
call fcn.0041a0b7
mov edi, eax
test edi, edi
pop ecx
jne 0x41a494
push 7
pop eax
jmp 0x41a51d
push esi
call fcn.004192f2
test eax, eax
je 0x41a4d0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a4c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x41a502
inc ebp
cmp ebp, 5
jge 0x41a502
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41a49e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a4f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x41a502
inc ebp
cmp ebp, 5
jge 0x41a502
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41a4d0
push edi
call sub.msvcrt.dll_free
pop ecx
cmp esi, 0xffffffff
pop esi
jne 0x41a518
cmp ebx, 2
jne 0x41a518
xor eax, eax
jmp 0x41a51d
mov eax, 0xa0a
pop edi
pop ebp
pop ebx
ret

Function at 0x41a6af
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
push eax
push 0x104
push dword [ebp + 0xc]
mov dword [ebp - 8], 0x200
push dword [ebp + 8]
call fcn.0041a5d7
add esp, 0x10
test eax, eax
jne 0x41a76b
lea eax, [ebp - 0x110]
push eax
call fcn.0041a0b7
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x41a764
call fcn.004192f2
test eax, eax
mov eax, esi
je 0x41a731
cmp word [esi], bx
je 0x41a71b
cmp word [eax], 0x5c
je 0x41a718
inc eax
inc eax
cmp word [eax], bx
jne 0x41a709
jmp 0x41a71b
mov word [eax], bx
lea eax, [ebp - 4]
push eax
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x41a757
cmp byte [esi], bl
je 0x41a743
cmp byte [eax], 0x5c
je 0x41a741
inc eax
cmp byte [eax], bl
jne 0x41a735
jmp 0x41a743
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call sub.msvcrt.dll_free
cmp edi, ebx
pop ecx
jne 0x41a76b
mov dword [ebp - 8], 0x200
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a8d8
Capabilities:
Get system information on windows

Disassembly:
push esi
push 0x24
push 0
mov esi, 0x4735c0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.0044529f
test eax, eax
jne 0x41a92d
push 2
call fcn.00417357
mov esi, eax
push esi
call fcn.00417369
mov edx, 0x45a198
call fcn.0041721c
mov eax, dword [0x45eae0]
push esi
mov dword [0x45a1a4], eax
mov dword [0x45eae0], edx
call fcn.00417377
add esp, 0xc
xor eax, eax
pop esi
ret
Function at 0x41d4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebx + 0x3c]
push esi
push edi
xor edi, edi
cmp dword [edx], edi
mov esi, eax
mov dword [ebp - 4], edi
jne 0x41d4e9
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx]
or eax, 0x1e
push edi
and eax, 0x87f3f
push eax
push edx
push edi
push ecx
call dword [ecx + 0x18]
add esp, 0x14
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x41d5b7
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x41d523
mov eax, dword [ebx + 0x80]
push edi
cdq
push ecx
push edx
push eax
call fcn.0044dc00
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], eax
jmp 0x41d523
xor edi, edi
cmp esi, edi
je 0x41d5b7
mov edi, dword [esi + 0xc]
cmp edi, dword [ebx + 0x18]
ja 0x41d5aa
test byte [esi + 0x14], 0x20
jne 0x41d5aa
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.0044dc00
cmp edi, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jne 0x41d55d
call fcn.0041cce4
push dword [ebp - 0xc]
mov eax, dword [esi]
push dword [ebp - 0x10]
mov dword [ebp - 8], eax
push dword [ebx + 0x80]
push eax
mov eax, dword [ebx + 0x3c]
call fcn.0041711d
add esp, 0x10
cmp edi, 1
mov dword [ebp - 4], eax
jne 0x41d597
mov eax, dword [ebp - 8]
add eax, 0x18
push 0x10
push eax
lea eax, [ebx + 0x64]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp edi, dword [ebx + 0x20]
jbe 0x41d59f
mov dword [ebx + 0x20], edi
push dword [esi]
mov eax, dword [ebx + 0x58]
call fcn.0042445e
pop ecx
cmp dword [ebp - 4], 0
mov esi, dword [esi + 8]
je 0x41d521
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x42dd98
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x42ddaa
xor eax, eax
jmp 0x42de95
push esi
mov esi, dword [ebp + 8]
push 0x50
call fcn.00417a38
mov esi, eax
test esi, esi
pop ecx
je 0x42de94
push ebx
push dword [ebp + 0x10]
mov ebx, dword [edi]
push dword [ebp + 8]
call fcn.0042db21
push dword [ebp + 0x10]
mov dword [esi], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.0042dbe4
push 0
push dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push eax
push dword [ebp + 8]
call fcn.0042d909
push dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x10]
call fcn.0042db21
push 0
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push eax
push dword [ebp + 8]
call fcn.0042d909
push dword [ebp + 0x10]
mov dword [esi + 0x14], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x18]
call fcn.0042db21
add esp, 0x44
push dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.0042dd98
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x28]
push eax
push dword [ebp + 8]
call fcn.0042d909
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
push eax
push dword [ebp + 8]
call fcn.0042d909
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov ax, word [edi + 6]
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x3c], 0xffffffff
and ax, 0xfff7
add esp, 0x2c
or dword [esi + 0x40], 0xffffffff
mov word [esi + 6], ax
mov dword [esi + 0x24], ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x44653e
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x14]
call fcn.00409c82
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x4465a8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xf1b30
jae 0x4465a1
lea eax, [esi + 0xa]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
lea eax, [esi + 5]
push eax
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push edi
push ebx
call fcn.0040a8ae
add esp, 0xc
test eax, eax
je 0x44659a
push esi
push edi
push dword [esp + 0x18]
call fcn.0044632f
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret 8
Function at 0x446665
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x4467f7
push ebx
mov eax, edi
call fcn.0040d508
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x453e4c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4466e8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov dword [edi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov ecx, dword [eax + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [edi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [edi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x446737
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x38]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x44f4cc
lea eax, [ebp - 0x38]
push eax
push ebx
lea esi, [ebp - 0x238]
call fcn.004465d6
test eax, eax
jne 0x446747
lea eax, [ebp - 0x38]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push str.ProductName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x18]
push ebx
call fcn.004465d6
push str.FileDescription
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x218]
push ebx
call fcn.004465d6
push str.FileVersion
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x418]
push ebx
call fcn.004465d6
push str.ProductVersion
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x618]
push ebx
call fcn.004465d6
push str.CompanyName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x818]
push ebx
call fcn.004465d6
push str.InternalName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xa18]
push ebx
call fcn.004465d6
push str.LegalCopyright
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xc18]
push ebx
call fcn.004465d6
push str.OriginalFileName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xe18]
push ebx
call fcn.004465d6
xor esi, esi
push ebx
inc esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, esi
pop esi
leave
ret 4
Function at 0x44692c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x44f4c0
call fcn.00446b3c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x446967
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x446967
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x44697f
cmp eax, 0x20b
je 0x44696c
mov dword [ebp - 0x1c], edi
jmp 0x446993
cmp dword [ecx + 0x84], 0xe
jbe 0x446967
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x44698d
cmp dword [ecx + 0x74], 0xe
jbe 0x446967
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x47359c], 0xffffffff
or dword [0x4735a0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x45b52c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x45b528]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x473598], eax
call fcn.00402f19
cmp dword [section..data], edi
jne 0x4469f0
push fcn.00402f19
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00446b28
push 0x44f49c
push 0x44f498
call sub.msvcrt.dll__initterm
mov eax, dword [0x45b524]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x45b520]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x44f494
push 0x44f470
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x446a56
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x446b10
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x446aa4
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x446a72
cmp ax, 0x22
jne 0x446a5f
cmp word [esi], 0x22
jne 0x446a7d
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x446a8b
cmp ax, 0x20
jbe 0x446a78
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x446ab1
movzx eax, word [ebp - 0x48]
jmp 0x446ab4
cmp word [esi], 0x20
jbe 0x446a7d
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x446aa4
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x446ad5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x446b0a
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00446b75
ret
Function at 0x449910
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
test ecx, ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0xe8], ecx
jne 0x449960
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
ret

Function at 0x449c90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebp
push edi
push 0x40
lea ebp, [esi + 0x68]
push 0x36
push ebp
call sub.msvcrt.dll_memset
push 0x40
lea edi, [esi + 0xa8]
push 0x5c
push edi
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x28]
mov eax, edi
add esp, 0x18
mov edi, 0x14
mov edi, edi
movzx edx, byte [ecx]
xor byte [eax - 0x40], dl
movzx edx, byte [ecx]
xor byte [eax], dl
add ecx, 1
add eax, 1
sub edi, 1
jne 0x449cc0
push ebx
xor ecx, ecx
mov eax, esi
call fcn.00449910
lea edi, [ecx + 0x40]
mov ecx, dword [esi]
mov eax, ecx
and eax, 0x3f
mov ebx, edi
add ecx, edi
sub ebx, eax
cmp ecx, edi
mov dword [esp + 0xc], eax
mov dword [esi], ecx
jae 0x449cfe
add dword [esi + 4], 1
test eax, eax
je 0x449d2f
cmp ebx, edi
ja 0x449d2f
push ebx
lea eax, [eax + esi + 0x28]
push ebp
push eax
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x28]
push esi
call fcn.00446f70
sub edi, ebx
add esp, 0x10
add ebp, ebx
cmp edi, 0x40
mov dword [esp + 0xc], 0
jb 0x449d4a
mov ebx, edi
shr ebx, 6
push esi
mov eax, ebp
call fcn.00446f70
add esp, 4
add ebp, 0x40
sub edi, 0x40
sub ebx, 1
jne 0x449d34
test edi, edi
pop ebx
jbe 0x449d62
mov ecx, dword [esp + 8]
push edi
lea edx, [ecx + esi + 0x28]
push ebp
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
pop edi
pop ebp
pop ecx
ret
Function at 0x44abc0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x800
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
mov edx, eax
and dl, 0x80
neg dl
lea esi, [eax + eax]
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
sbb edx, edx
and edx, 0x1b
xor edx, esi
xor edx, eax
and edx, 0xff
add ecx, 1
cmp ecx, 0x100
mov eax, edx
jl 0x44abd0
mov eax, 1
mov ecx, 0x45c770
jmp 0x44ac10
mov edx, eax
and dl, 0x80
neg dl
mov dword [ecx], eax
sbb edx, edx
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, 0xff
add ecx, 4
cmp ecx, 0x45c798
mov eax, edx
jl 0x44ac10
mov byte [0x45be70], 0x63
mov byte [0x45dffb], 0
mov ebx, 1
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x45be70], al
mov byte [eax + 0x45df98], bl
add ebx, 1
cmp ebx, 0x100
jl 0x44ac48
xor ecx, ecx
lea esp, [esp]
movzx edx, byte [ecx + 0x45be70]
mov eax, edx
and al, 0x80
neg al
lea esi, [edx + edx]
sbb eax, eax
and eax, 0x1b
xor eax, esi
and eax, 0xff
mov esi, eax
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
mov dword [ecx*4 + 0x45db98], eax
rol eax, 8
mov dword [ecx*4 + 0x45d798], eax
rol eax, 8
mov dword [ecx*4 + 0x45d398], eax
rol eax, 8
mov dword [ecx*4 + 0x45cf98], eax
movzx eax, byte [ecx + 0x45df98]
test eax, eax
je 0x44ad71
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x44ad79
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x45cb98], edx
rol edx, 8
mov dword [ecx*4 + 0x45c798], edx
rol edx, 8
mov dword [ecx*4 + 0x45c370], edx
rol edx, 8
mov dword [ecx*4 + 0x45bf70], edx
add ecx, 1
cmp ecx, 0x100
jl 0x44acc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x44b3b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
test cl, 0xf
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov esi, eax
mov edi, edx
je 0x44b3cf
pop edi
pop esi
mov eax, 0xffffffde
pop ebp
add esp, 0x28
ret
cmp dword [esp + 0x3c], 0
push ebx
jne 0x44b47e
test ecx, ecx
jbe 0x44b560
lea eax, [ecx - 1]
mov ebx, ebp
shr eax, 4
sub ebx, esi
add eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
mov ecx, edi
mov dword [esp + 0x30], edx
call fcn.0044a030
mov eax, esi
lea ecx, [ebp + 2]
mov esi, 4
movzx edx, byte [ebx + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub esi, 1
jne 0x44b424
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x30]
mov dword [ebp + 4], edx
mov edx, dword [esp + 0x34]
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x14], 1
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov esi, eax
jne 0x44b3f4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x28
ret
test ecx, ecx
jbe 0x44b560
mov eax, ebp
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, edi
mov dword [esp + 0x10], eax
lea eax, [ecx - 1]
shr eax, 4
add eax, 1
mov dword [esp + 0x20], eax
lea eax, [ebp + 3]
mov edx, esi
sub edx, edi
mov dword [esp + 0x18], eax
lea ecx, [esi + 1]
mov eax, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 4
jmp 0x44b4c5
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
movzx ebx, byte [eax + ebx]
xor bl, byte [eax]
add eax, 4
mov byte [edx + eax - 4], bl
mov edx, dword [esp + 0x14]
mov dl, byte [ecx + edx]
xor dl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], dl
movzx ebx, byte [eax - 2]
mov edx, dword [esp + 0x18]
xor bl, byte [edx - 1]
add edx, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [edx - 4]
mov dword [esp + 0x18], edx
mov byte [ecx - 2], bl
mov ebx, 1
sub dword [esp + 0x1c], ebx
jne 0x44b4c1
cmp dword [esp + 0x40], ebx
mov eax, dword [esp + 0x3c]
jne 0x44b527
push eax
mov eax, esi
call fcn.0044a5f0
add esp, 4
jmp 0x44b52e
mov ecx, esi
call fcn.0044a030
mov ecx, dword [esi]
mov dword [ebp], ecx
mov edx, dword [esi + 4]
mov dword [ebp + 4], edx
mov eax, dword [esi + 8]
mov dword [ebp + 8], eax
mov ecx, dword [esi + 0xc]
mov eax, 0x10
sub dword [esp + 0x10], eax
sub dword [esp + 0x14], eax
add edi, eax
add esi, eax
sub dword [esp + 0x20], ebx
mov dword [ebp + 0xc], ecx
jne 0x44b4a3
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x28
ret