joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movups xmm0, xmmword [0x4ce3cc]
push esi
push edi
movups xmmword [ebp - 0x28], xmm0
mov edi, ecx
movups xmm0, xmmword [0x4ce3dc]
mov dword [ebp - 4], edi
pextrw eax, xmm0, 7
movups xmmword [ebp - 0x18], xmm0
test ax, ax
je 0x427dcc
xor ecx, ecx
cmp dword [0x4e3300], 2
jl 0x427da3
movaps xmm4, xmmword [0x4cfc60]
movaps xmm3, xmmword [0x4cfd40]
movaps xmm5, xmmword [0x4cfc90]
movaps xmm6, xmmword [0x4cfd30]
nop dword [eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm6
paddw xmm1, xmm0
movq xmm0, qword [ebp + ecx*2 - 0x28]
xorps xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movq qword [ebp + ecx*2 - 0x28], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm6
paddw xmm1, xmm0
movq xmm0, qword [ebp + ecx*2 - 0x20]
xorps xmm1, xmm0
movq qword [ebp + ecx*2 - 0x20], xmm1
add ecx, 8
cmp ecx, 0x10
jl 0x427cc0
jmp 0x427dcc
mov eax, 0x29e4129f
mov esi, ecx
mul ecx
mov eax, 1
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
sub eax, esi
imul eax, eax, 0x37
add eax, ecx
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 0x10
jl 0x427da3
xorps xmm0, xmm0
lea ecx, [ebp - 0x28]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea edx, [ecx + 2]
mov dword [edi + 0x14], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427de6
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0041f8a0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x429210
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 4], esi
mov eax, dword fs:[0x2c]
push edi
mov ecx, dword [eax]
mov eax, dword [0x4e44a8]
cmp eax, dword [ecx + 4]
jle 0x42928c
push 0x4e44a8
call fcn.0045921f
add esp, 4
cmp dword [0x4e44a8], 0xffffffff
jne 0x42928c
xorps xmm0, xmm0
mov dword [0x4e44d4], 0
xor eax, eax
mov dword [0x4e44d8], 7
movups xmmword [0x4e44c4], xmm0
push 0x4b42d0
mov word [0x4e44c4], ax
call fcn.00459603
add esp, 4
push 0x4e44a8
call fcn.004591ce
add esp, 4
mov edx, dword [0x4e44d8]
mov ecx, dword [0x4e44c4]
cmp edx, 7
jbe 0x4292a1
test ecx, ecx
je 0x4292cc
cmp edx, 7
mov eax, 0x4e44c4
cmova eax, ecx
cmp word [eax], 0
je 0x4292cc
cmp edx, 7
mov eax, 0x4e44c4
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42939c
lea ecx, [ebp - 0x20]
call fcn.0042c4b0
mov edi, eax
cmp edi, 0x4e44c4
je 0x429362
mov ecx, dword [0x4e44d8]
cmp ecx, 7
jbe 0x429322
mov edx, dword [0x4e44c4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429318
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42943f
push ecx
push edx
call fcn.00459618
add esp, 8
mov dword [0x4e44d4], 0
xor eax, eax
mov dword [0x4e44d8], 7
mov word [0x4e44c4], ax
movups xmm0, xmmword [edi]
movups xmmword [0x4e44c4], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x4e44d4], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov ecx, dword [ebp - 0xc]
cmp ecx, 7
jbe 0x42939c
mov edx, dword [ebp - 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429392
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42943f
push ecx
push edx
call fcn.00459618
add esp, 8
xorps xmm0, xmm0
mov ebx, 0x4e44c4
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp dword [0x4e44d8], 7
mov edi, dword [0x4e44d4]
cmova ebx, dword [0x4e44c4]
cmp edi, 0x7ffffffe
ja 0x429444
cmp edi, 7
ja 0x4293ef
mov dword [esi + 0x10], edi
mov eax, esi
mov dword [esi + 0x14], 7
movups xmm0, xmmword [ebx]
movups xmmword [esi], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x429402
mov eax, 0x7ffffffe
jmp 0x42940c
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.004024e0
mov ecx, dword [ebp - 4]
mov dword [esi + 0x14], ecx
lea ecx, [edi*2 + 2]
push ecx
push ebx
push eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
call fcn.00473360
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0047d27c
call fcn.00401840
int3
Function at 0x429450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 4], esi
mov eax, dword fs:[0x2c]
push edi
mov ecx, dword [eax]
mov eax, dword [0x4e44a4]
cmp eax, dword [ecx + 4]
jle 0x4294cc
push 0x4e44a4
call fcn.0045921f
add esp, 4
cmp dword [0x4e44a4], 0xffffffff
jne 0x4294cc
xorps xmm0, xmm0
mov dword [0x4e44bc], 0
xor eax, eax
mov dword [0x4e44c0], 7
movups xmmword [0x4e44ac], xmm0
push 0x4b4330
mov word [0x4e44ac], ax
call fcn.00459603
add esp, 4
push 0x4e44a4
call fcn.004591ce
add esp, 4
mov edx, dword [0x4e44c0]
mov ecx, dword [0x4e44ac]
cmp edx, 7
jbe 0x4294e1
test ecx, ecx
je 0x42950c
cmp edx, 7
mov eax, 0x4e44ac
cmova eax, ecx
cmp word [eax], 0
je 0x42950c
cmp edx, 7
mov eax, 0x4e44ac
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4295dc
lea ecx, [ebp - 0x20]
call fcn.0042c740
mov edi, eax
cmp edi, 0x4e44ac
je 0x4295a2
mov ecx, dword [0x4e44c0]
cmp ecx, 7
jbe 0x429562
mov edx, dword [0x4e44ac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429558
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42967f
push ecx
push edx
call fcn.00459618
add esp, 8
mov dword [0x4e44bc], 0
xor eax, eax
mov dword [0x4e44c0], 7
mov word [0x4e44ac], ax
movups xmm0, xmmword [edi]
movups xmmword [0x4e44ac], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x4e44bc], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov ecx, dword [ebp - 0xc]
cmp ecx, 7
jbe 0x4295dc
mov edx, dword [ebp - 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4295d2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42967f
push ecx
push edx
call fcn.00459618
add esp, 8
xorps xmm0, xmm0
mov ebx, 0x4e44ac
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp dword [0x4e44c0], 7
mov edi, dword [0x4e44bc]
cmova ebx, dword [0x4e44ac]
cmp edi, 0x7ffffffe
ja 0x429684
cmp edi, 7
ja 0x42962f
mov dword [esi + 0x10], edi
mov eax, esi
mov dword [esi + 0x14], 7
movups xmm0, xmmword [ebx]
movups xmmword [esi], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x429642
mov eax, 0x7ffffffe
jmp 0x42964c
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.004024e0
mov ecx, dword [ebp - 4]
mov dword [esi + 0x14], ecx
lea ecx, [edi*2 + 2]
push ecx
push ebx
push eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
call fcn.00473360
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0047d27c
call fcn.00401840
int3
Function at 0x429690
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 4], esi
mov eax, dword fs:[0x2c]
push edi
mov ecx, dword [eax]
mov eax, dword [0x4e44a0]
cmp eax, dword [ecx + 4]
jle 0x42970c
push 0x4e44a0
call fcn.0045921f
add esp, 4
cmp dword [0x4e44a0], 0xffffffff
jne 0x42970c
xorps xmm0, xmm0
mov dword [0x4e44ec], 0
xor eax, eax
mov dword [0x4e44f0], 7
movups xmmword [0x4e44dc], xmm0
push 0x4b4390
mov word [0x4e44dc], ax
call fcn.00459603
add esp, 4
push 0x4e44a0
call fcn.004591ce
add esp, 4
mov edx, dword [0x4e44f0]
mov ecx, dword [0x4e44dc]
cmp edx, 7
jbe 0x429721
test ecx, ecx
je 0x42974c
cmp edx, 7
mov eax, 0x4e44dc
cmova eax, ecx
cmp word [eax], 0
je 0x42974c
cmp edx, 7
mov eax, 0x4e44dc
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42981c
lea ecx, [ebp - 0x20]
call fcn.0042c9d0
mov edi, eax
cmp edi, 0x4e44dc
je 0x4297e2
mov ecx, dword [0x4e44f0]
cmp ecx, 7
jbe 0x4297a2
mov edx, dword [0x4e44dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429798
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4298bf
push ecx
push edx
call fcn.00459618
add esp, 8
mov dword [0x4e44ec], 0
xor eax, eax
mov dword [0x4e44f0], 7
mov word [0x4e44dc], ax
movups xmm0, xmmword [edi]
movups xmmword [0x4e44dc], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x4e44ec], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov ecx, dword [ebp - 0xc]
cmp ecx, 7
jbe 0x42981c
mov edx, dword [ebp - 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429812
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4298bf
push ecx
push edx
call fcn.00459618
add esp, 8
xorps xmm0, xmm0
mov ebx, 0x4e44dc
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp dword [0x4e44f0], 7
mov edi, dword [0x4e44ec]
cmova ebx, dword [0x4e44dc]
cmp edi, 0x7ffffffe
ja 0x4298c4
cmp edi, 7
ja 0x42986f
mov dword [esi + 0x10], edi
mov eax, esi
mov dword [esi + 0x14], 7
movups xmm0, xmmword [ebx]
movups xmmword [esi], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x429882
mov eax, 0x7ffffffe
jmp 0x42988c
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.004024e0
mov ecx, dword [ebp - 4]
mov dword [esi + 0x14], ecx
lea ecx, [edi*2 + 2]
push ecx
push ebx
push eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
call fcn.00473360
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0047d27c
call fcn.00401840
int3
Function at 0x429ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af5cd
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4de180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x10], 0
jne 0x429f2a
xor al, al
jmp 0x42a0ec
lea eax, [ebp - 0x58]
push eax
call fcn.0046baa0
add esp, 4
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [0x4cf994]
movq xmm0, qword [str.E_XX_]
mov dword [ebp - 0x64], eax
mov ax, word [0x4cf998]
movq qword [ebp - 0x6c], xmm0
mov word [ebp - 0x60], ax
nop
mov eax, 0x24924925
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
lea ecx, [eax*8]
sub ecx, eax
mov eax, esi
shl ecx, 3
sub eax, ecx
add eax, 0x37
xor word [ebp + esi*2 - 0x6c], ax
inc esi
cmp esi, 7
jl 0x429f60
mov edx, dword [edi + 0x10]
lea ecx, [ebp - 0x6c]
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429fa0
sub ecx, esi
mov eax, 0x7ffffffe
sar ecx, 1
sub eax, edx
cmp eax, ecx
jb 0x42a108
cmp dword [edi + 0x14], 7
mov eax, edi
jbe 0x429fc8
mov eax, dword [edi]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push edx
push eax
push edi
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.00402180
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push 1
push eax
call fcn.0046b820
add esp, 0x10
push 0
sub esp, 8
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.004298d0
add esp, 0xc
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
mov bl, al
push 0
sub esp, 8
call fcn.004298d0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
cmp ecx, 7
jbe 0x42a056
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42a04c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a10d
push ecx
push edx
call fcn.00459618
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 7
jbe 0x42a0a0
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42a096
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a10d
push ecx
push edx
call fcn.00459618
add esp, 8
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 7
jbe 0x42a0ea
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42a0e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a10d
push ecx
push edx
call fcn.00459618
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004591b2
mov esp, ebp
pop ebp
ret
call fcn.00401840
call fcn.0047d27c
int3
Function at 0x42ae20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4de180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0042bd30
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp edx, 7
jbe 0x42ae48
test ecx, ecx
je 0x42ae75
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
cmp word [eax], 0
je 0x42ae75
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x42ae75
mov bl, 1
jmp 0x42ae77
xor bl, bl
cmp edx, 7
jbe 0x42aea7
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ae9d
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aeb8
push edx
push ecx
call fcn.00459618
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004591b2
mov esp, ebp
pop ebp
ret
call fcn.0047d27c
int3

Function at 0x42aec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4de180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0042c230
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp edx, 7
jbe 0x42aee8
test ecx, ecx
je 0x42af15
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
cmp word [eax], 0
je 0x42af15
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x42af15
mov bl, 1
jmp 0x42af17
xor bl, bl
cmp edx, 7
jbe 0x42af47
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42af3d
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42af58
push edx
push ecx
call fcn.00459618
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004591b2
mov esp, ebp
pop ebp
ret
call fcn.0047d27c
int3

Function at 0x42b7b0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
mov edx, esi
push edi
lea edi, [esi + 0x14]
cmp ecx, 7
jbe 0x42b7c8
mov edx, dword [esi]
lea eax, [esi + 0x14]
jmp 0x42b7ca
mov eax, edi
test edx, edx
je 0x42b7fe
push ebx
mov ebx, esi
cmp ecx, 7
jbe 0x42b7dd
mov ebx, dword [esi]
lea edx, [esi + 0x14]
jmp 0x42b7df
mov edx, eax
cmp word [ebx], 0
mov edi, eax
pop ebx
je 0x42b7fe
mov eax, esi
cmp ecx, 7
jbe 0x42b7f1
mov eax, dword [esi]
push eax
mov edi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b837
cmp dword [edi], 7
mov eax, esi
jbe 0x42b807
mov eax, dword [esi]
push 0
push 0
push 1
push eax
call fcn.0046acd0
add esp, 0x10
cmp eax, 0xffffffff
je 0x42b837
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi], 7
jbe 0x42b829
mov esi, dword [esi]
push esi
call fcn.0046af20
test eax, eax
pop edi
setne al
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x433d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b02b6
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4de180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x60], edi
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
call fcn.00433ba0
push eax
mov ecx, edi
call fcn.0041f390
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x433e0a
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x433e00
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433f46
push ecx
push edx
call fcn.00459618
add esp, 8
cmp dword [edi + 0x10], 0
je 0x433ef3
cmp word [0x4ce9fa], 0
movups xmm0, xmmword [str.TUZ_]
mov eax, dword [0x4ce9f8]
mov dword [ebp - 0x48], eax
movups xmmword [ebp - 0x58], xmm0
je 0x433e5c
xor esi, esi
mov eax, 0x29e4129f
mov ecx, esi
mul esi
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub eax, ecx
imul eax, eax, 0x37
add eax, esi
xor word [ebp + esi*2 - 0x58], ax
inc esi
cmp esi, 0xa
jl 0x433e33
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433e77
sub ecx, edx
lea eax, [ebp - 0x58]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.0041f8a0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 3
cmp ecx, 7
jbe 0x433ed4
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x433eca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433f4b
push ecx
push edx
call fcn.00459618
add esp, 8
movups xmm0, xmmword [ebp - 0x44]
lea eax, [ebp - 0x28]
push eax
movups xmmword [ebp - 0x28], xmm0
push edi
movq xmm0, qword [ebp - 0x34]
movq qword [ebp - 0x18], xmm0
call fcn.0045dc30
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x433f29
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x433f1f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433f4b
push ecx
push edx
call fcn.00459618
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004591b2
mov esp, ebp
pop ebp
ret
call fcn.0047d27c
call fcn.0047d27c
int3
Function at 0x44c450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4e3048], 0
jne 0x44c45e
call fcn.00451490
cmp byte [0x4e3052], 0
je 0x44c47c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00454cc0
add esp, 0x10
ret
jmp fcn.0044a7b0
Function at 0x44f370
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
cmp eax, 4
jb 0x44f3a4
mov esi, eax
shr esi, 2
nop dword [eax]
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x44f390
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
test eax, eax
je 0x44f484
mov ebx, edi
sub ebx, edx
cmp eax, 8
jb 0x44f463
mov ecx, eax
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
mov dword [esp + 0x1c], ecx
lea ecx, [edx + 4]
nop dword [eax]
movd xmm2, dword [edi + ebp]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ebp, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [ecx - 8]
orps xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp ebp, dword [esp + 0x1c]
jb 0x44f3f0
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x44f484
lea edi, [edx + ebp]
sub eax, ebp
nop dword [eax + eax]
movzx edx, byte [ebx + edi]
lea edi, [edi + 1]
movzx ecx, byte [edi - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x44f470
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
ret
Function at 0x44f490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x24
test eax, eax
je 0x44f638
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
push edi
cmp eax, 4
jb 0x44f4d3
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x44f4b8
mov dword [esp + 0x40], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ebx
test eax, eax
je 0x44f634
cmp eax, 8
jb 0x44f619
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x44f509
cmp edi, ebx
jae 0x44f619
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x44f51a
cmp edi, edx
jae 0x44f619
cmp eax, 0x40
jb 0x44f5ce
mov edi, eax
mov ecx, eax
mov eax, edx
and edi, 0x3f
sub eax, ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], eax
sub ecx, edi
mov eax, esi
mov dword [esp + 0x2c], ecx
sub eax, ebx
lea edi, [esi + 0x20]
mov dword [esp + 0x20], eax
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, edx
sub eax, esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
lea eax, [edx + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + 0x40]
movups xmm0, xmmword [ecx - 0x50]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ebx + ecx - 0x40], xmm1
movups xmm1, xmmword [edx + edi - 0x40]
mov edx, dword [esp + 0x28]
movups xmm0, xmmword [ecx - 0x30]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x10]
add ebp, 0x40
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ebp, dword [esp + 0x2c]
jb 0x44f565
cmp dword [esp + 0x30], 8
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jb 0x44f615
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x30], eax
sub edx, ebx
mov edi, dword [esp + 0x30]
mov eax, esi
sub eax, ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov eax, edx
mov edx, dword [esp + 0x28]
movq xmm1, qword [ecx + eax]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
xorps xmm1, xmm0
movq qword [edx + ecx - 8], xmm1
cmp ebp, edi
jb 0x44f5f0
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
cmp ebp, eax
jae 0x44f634
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [esi + edi - 1], cl
sub eax, 1
jne 0x44f622
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret