joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438d20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x438d4f
test cl, 7
je 0x438d4f
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x5228d0]
dec esi
inc ecx
test esi, esi
ja 0x438d32
cmp esi, 8
jb 0x438de8
mov edi, esi
push ebx
shr edi, 3
push ebp
nop
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x522cd0]
mov dword [esp + 0x14], ecx
mov ebp, edx
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x5228d0]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x5230d0]
mov ebp, eax
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x5238d0]
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x523cd0]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x5240d0]
mov ecx, dword [esp + 0x14]
movzx edx, dl
xor ebx, dword [edx*4 + 0x5234d0]
movzx eax, al
xor ebx, dword [eax*4 + 0x5244d0]
sub esi, 8
add ecx, 8
sub edi, 1
mov eax, ebx
jne 0x438d60
pop ebp
pop ebx
test esi, esi
jbe 0x438e08
lea esp, [esp]
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x5228d0]
dec esi
inc ecx
test esi, esi
ja 0x438df0
pop edi
pop esi
ret 0xc
Function at 0x4390a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
test esi, esi
jbe 0x4390e3
test bl, 7
je 0x4390df
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x51e8d0]
shr edx, 8
xor edx, dword [ecx*8 + 0x51e8d4]
dec esi
inc ebx
test esi, esi
ja 0x4390b7
mov dword [esp + 0x1c], esi
mov ecx, esi
shr ecx, 3
lea ecx, [ebx + ecx*8]
mov dword [esp + 0x18], ecx
cmp ebx, ecx
jae 0x4391d1
push ebp
mov ecx, dword [ebx]
xor ecx, eax
mov eax, dword [ebx + 4]
xor eax, edx
mov edx, eax
shr edx, 0x10
movzx esi, dl
mov edi, dword [esi*8 + 0x51f0d0]
mov esi, dword [esi*8 + 0x51f0d4]
mov edx, eax
shr edx, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x51e8d0]
xor esi, dword [edx*8 + 0x51e8d4]
mov edx, eax
shr edx, 8
movzx edx, dl
xor edi, dword [edx*8 + 0x51f8d0]
xor esi, dword [edx*8 + 0x51f8d4]
movzx edx, al
xor edi, dword [edx*8 + 0x5200d0]
xor esi, dword [edx*8 + 0x5200d4]
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x5208d0]
xor esi, dword [edx*8 + 0x5208d4]
shr ebp, 0x18
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x10
movzx edx, dl
xor edi, dword [edx*8 + 0x5210d0]
xor esi, dword [edx*8 + 0x5210d4]
mov edx, ecx
shrd edx, eax, 8
mov dword [esp + 0x18], eax
shr eax, 8
movzx eax, dl
xor edi, dword [eax*8 + 0x5218d0]
xor esi, dword [eax*8 + 0x5218d4]
movzx eax, cl
xor esi, dword [eax*8 + 0x5220d4]
xor edi, dword [eax*8 + 0x5220d0]
add ebx, 8
shr ebp, 0x10
mov eax, edi
mov edx, esi
cmp ebx, dword [esp + 0x1c]
jb 0x4390f8
mov esi, dword [esp + 0x20]
pop ebp
and esi, 7
jbe 0x4391f9
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x51e8d0]
shr edx, 8
xor edx, dword [ecx*8 + 0x51e8d4]
dec esi
inc ebx
test esi, esi
ja 0x4391d6
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x439200
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
push esi
mov esi, dword [esp + 8]
mov byte [ecx + 0xc02], dl
mov byte [ecx + 0xc01], dl
mov byte [ecx + 0xc00], dl
mov al, byte [esi]
cmp al, dl
je 0x439244
push ebx
mov bl, byte [ecx + 0xc02]
add byte [ecx + 0xc00], al
xor byte [ecx + 0xc01], al
add bl, al
rol bl, 1
inc esi
mov byte [ecx + 0xc02], bl
mov al, byte [esi]
cmp al, dl
jne 0x439220
pop ebx
pop esi
ret 4
Function at 0x439250
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x6f0]
push eax
call fcn.00438bd0
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439270
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.00438d20
mov word [esi + 0xc04], ax
shr eax, 0x10
xor ecx, ecx
xor edx, edx
mov word [esi + 0xc06], ax
mov word [esi + 0xc0a], cx
mov word [esi + 0xc08], dx
mov al, byte [edi]
test al, al
je 0x4392e6
mov edx, edi
lea ecx, [ecx]
movzx ecx, al
mov di, word [esi + ecx*4 + 0x6f0]
lea ecx, [esi + ecx*4 + 0x6f0]
movzx ax, al
xor di, ax
xor word [esi + 0xc08], di
mov cx, word [ecx + 2]
add cx, ax
add word [esi + 0xc0a], cx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x4392b0
pop edi
pop esi
ret 4

Function at 0x439350
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x43940a
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x439370
mov ecx, 0x1234
add word [eax + 0xc04], cx
movzx ecx, word [eax + 0xc04]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6f0]
xor word [eax + 0xc06], dx
mov bx, word [eax + 0xc0a]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6f2]
sub word [eax + 0xc08], dx
movzx edx, word [eax + 0xc08]
xor edx, ecx
mov word [eax + 0xc04], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0xc06]
ror bx, cl
movzx ecx, bx
xor word [eax + 0xc04], cx
mov word [eax + 0xc0a], cx
movzx ecx, word [eax + 0xc04]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x439370
pop esi
pop ebx
pop edi
ret 8

Function at 0x439410
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x439420
movzx esi, byte [eax - 1]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbf0], esi
movzx esi, byte [eax]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbf4], esi
movzx esi, byte [eax + 1]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbf8], esi
movzx esi, byte [eax + 2]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbfc], esi
add eax, 4
sub edx, 1
jne 0x439420
pop esi
ret 4
Function at 0x439900
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0x1ec]
push ebx
mov ebx, dword [esp + 0x1e8]
push esi
mov esi, dword [esp + 0x1e8]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jbe 0x439979
lea ecx, [esp + 0xf0]
push ecx
call fcn.00465f70
push esi
push edi
lea edx, [esp + 0xf8]
push edx
call fcn.00466420
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.004664d0
lea edi, [esp + 0x1a0]
mov esi, 0x20
xor eax, eax
test esi, esi
jbe 0x4399a5
push ebp
mov ebp, edi
lea edx, [esp + 0x164]
sub ebp, edx
jmp 0x439990
lea ecx, [esp + eax + 0x164]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x439990
pop ebp
cmp esi, 0x40
jae 0x4399c4
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x36
push eax
call fcn.004e0730
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.00465f70
push 0x40
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00466420
mov edx, dword [esp + 0x1f4]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.00466420
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004664d0
lea eax, [esp + 0x80]
push eax
call fcn.00465f70
xor eax, eax
test esi, esi
jbe 0x439a37
lea ecx, [esp + 0x160]
sub edi, ecx
lea ecx, [esp + eax + 0x160]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x439a23
cmp esi, 0x40
jae 0x439a56
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x5c
push eax
call fcn.004e0730
add esp, 0xc
push 0x40
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.00466420
push 0x20
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.00466420
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x84]
push ecx
call fcn.004664d0
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1d8
ret 0x14
Function at 0x439ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc8
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0xd4]
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
mov ebp, dword [esp + 0xe4]
push esi
mov esi, dword [esp + 0xe4]
push edi
mov edi, dword [esp + 0xdc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov ecx, esi
cmp esi, 0x40
jb 0x439b06
mov ecx, 0x40
push ecx
push eax
lea edx, [esp + 0x78]
push edx
call fcn.004e03c0
mov edx, dword [esp + 0xec]
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov byte [esp + esi + 0x74], 0
mov byte [esp + esi + 0x75], 0
mov byte [esp + esi + 0x76], 0
mov byte [esp + esi + 0x77], 1
add esi, 4
push esi
lea ecx, [esp + 0x78]
push ecx
push edx
push edi
call fcn.00439900
mov eax, dword [esp + 0xf8]
dec eax
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, 0x10
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
xor ebx, ebx
nop
mov eax, dword [esp + ebx + 0x24]
test eax, eax
jbe 0x439c01
mov ebp, eax
lea ebx, [ebx]
mov ecx, dword [esp + 0xe0]
lea edx, [esp + 0xb4]
push edx
mov edx, dword [esp + 0x18]
push 0x20
lea eax, [esp + 0x58]
push eax
push ecx
push edx
call fcn.00439900
mov ecx, 8
lea esi, [esp + 0xb4]
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x439bd0
movzx ecx, byte [esp + eax + 0x50]
movzx edx, byte [esp + eax + 0x51]
xor byte [esp + eax + 0x30], cl
xor byte [esp + eax + 0x31], dl
movzx ecx, byte [esp + eax + 0x52]
movzx edx, byte [esp + eax + 0x53]
xor byte [esp + eax + 0x32], cl
xor byte [esp + eax + 0x33], dl
add eax, 4
cmp eax, 0x20
jb 0x439bd0
sub ebp, 1
jne 0x439b90
mov edi, dword [esp + ebx + 0x18]
add ebx, 4
mov ecx, 8
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
cmp ebx, 0xc
jb 0x439b80
push 0x44
lea eax, [esp + 0x74]
push eax
call fcn.004641a0
push 0x20
lea ecx, [esp + 0x34]
push ecx
call fcn.004641a0
push 0x20
lea edx, [esp + 0x54]
push edx
call fcn.004641a0
push 0x20
lea eax, [esp + 0xb8]
push eax
call fcn.004641a0
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0xc8
ret 0x20
Function at 0x43a920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x38]
cmp dword [edi], 2
jne 0x43a9d1
mov eax, dword [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push 0x20
push ebx
mov dword [esp + 0x20], eax
call fcn.00439900
xor edx, edx
mov dword [edi + 4], edx
mov eax, edx
lea esi, [edx - 2]
push ebp
jmp 0x43a970
movzx ebp, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi - 1]
and ecx, 3
add ecx, ecx
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x15]
add ecx, ecx
shl ebp, cl
mov ecx, esi
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x16]
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi + 1]
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x17]
add ecx, ecx
add ecx, ecx
shl ebp, cl
add edx, 4
add esi, 4
xor eax, ebp
cmp edx, 0x20
jb 0x43a970
mov dword [edi + 4], eax
pop ebp
cmp dword [edi], 3
jne 0x43a9f4
lea eax, [esp + 0x10]
push eax
push 0x20
add edi, 4
push edi
push 0x20
push ebx
call fcn.00439900
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x28
ret 8

Function at 0x43ae60
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push 0xf0000040
push 1
xor esi, esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebp, dword [esp + 0x20]
test eax, eax
je 0x43aeaf
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
mov eax, dword [esp + 0xc]
push esi
push eax
sete bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x43af12
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.00468000
lea ecx, [esp + 0x14]
call fcn.00467fd0
mov esi, eax
mov edi, edx
call fcn.004e330a
cdq
add esi, eax
adc edi, edx
xor ebx, ebx
test ebp, ebp
jbe 0x43af11
mov edi, edi
mov ecx, ebx
and ecx, 7
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, esi
mov edx, edi
call fcn.004e2910
mov edx, dword [esp + 0x20]
mov cl, al
mov eax, dword [0x524d90]
xor cl, bl
add cl, al
mov byte [ebx + edx], cl
inc eax
inc ebx
mov dword [0x524d90], eax
cmp ebx, ebp
jb 0x43aee0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x43b100
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, edx
jbe 0x43b168
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp edx, ecx
jb 0x43b144
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
lea ebx, [ebx]
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
inc ecx
mov dword [ebx + eax], ebp
add eax, 4
cmp ecx, dword [esi]
jbe 0x43b130
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
sub eax, dword [esi]
lea edx, [edi + ecx*4]
add eax, eax
add eax, eax
push eax
push edx
lea eax, [ebx + ecx*4]
push eax
call fcn.004e03c0
mov ecx, dword [edi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
pop ebx
ret 0xc
jae 0x43b1b8
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
jb 0x43b194
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
mov ebp, dword [eax + edx]
xor ebp, dword [eax]
inc ecx
mov dword [eax + ebx], ebp
add eax, 4
cmp ecx, dword [edi]
jbe 0x43b180
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
sub edx, dword [edi]
lea eax, [esi + ecx*4]
add edx, edx
add edx, edx
push edx
push eax
lea ecx, [ebx + ecx*4]
push ecx
call fcn.004e03c0
mov edx, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], edx
pop ebx
ret 0xc
test eax, eax
jbe 0x43b1d2
mov edx, edi
lea ecx, [esi + eax*4]
sub edx, esi
mov ebx, dword [ecx + edx]
xor ebx, dword [ecx]
jne 0x43b1d2
dec eax
sub ecx, 4
test eax, eax
ja 0x43b1c3
mov edx, dword [esp + 0x14]
mov dword [edx], eax
test eax, eax
jbe 0x43b1f3
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, esi
mov esi, dword [ecx + edi]
xor esi, dword [ecx]
dec eax
mov dword [ecx + edx], esi
sub ecx, 4
test eax, eax
ja 0x43b1e3
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x43b200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp dword [esi], 0
je 0x43b32a
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp]
test eax, eax
je 0x43b32a
mov ecx, ebp
lea edx, [esp + 8]
sub ecx, edx
push edi
lea ebx, [ebx]
mov edi, dword [0x524d98]
lea edx, [ecx + eax*4]
sub eax, 1
mov edx, dword [esp + edx + 0xc]
mov edx, dword [edi + edx*4]
mov dword [esp + eax*4 + 0x10], edx
jne 0x43b230
mov edi, dword [esp + 0x5c]
push ebx
push 0x90
push eax
push edi
call fcn.004e0730
mov ebx, dword [esi]
add esp, 0xc
test ebx, ebx
je 0x43b2d7
mov ebp, dword [0x524d94]
lea esp, [esp]
mov eax, dword [esi + ebx*4]
mov ecx, dword [0x524d98]
mov esi, dword [ecx + eax*4]
cmp esi, 0x7fff
je 0x43b2ca
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
test eax, eax
je 0x43b2ca
lea ecx, [ebx + eax]
lea edx, [edi + ecx*4 - 4]
jmp 0x43b2a0
mov ecx, dword [esp + eax*4 + 0x10]
cmp ecx, 0x7fff
je 0x43b2c2
add ecx, esi
cmp ecx, 0x7fff
jb 0x43b2bc
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
dec eax
sub edx, 4
test eax, eax
jne 0x43b2a0
sub ebx, 1
mov esi, dword [esp + 0x64]
jne 0x43b270
mov ebp, dword [esp + 0x68]
mov edx, dword [esi]
mov eax, dword [ebp]
lea ecx, [edx + eax - 1]
cmp ecx, 0x11
mov dword [edi], ecx
pop ebx
jle 0x43b307
lea eax, [edi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
nop
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], 0
sub eax, 4
sub edx, 1
jne 0x43b2f0
cmp dword [edi], 0x11
jbe 0x43b321
mov dword [edi], 0x11
mov eax, dword [edi]
cmp dword [edi + eax*4], 0
jne 0x43b321
dec eax
mov dword [edi], eax
test eax, eax
jne 0x43b312
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov ecx, dword [esp + 0x58]
pop esi
mov dword [ecx], 0
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x43b340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
je 0x43b425
mov ecx, dword [edi + eax*4]
push ebx
mov ebx, dword [0x524d98]
mov ecx, dword [ebx + ecx*4]
push esi
cmp ecx, 0x7fff
je 0x43b38b
add ecx, ecx
cmp ecx, 0x7fff
jb 0x43b378
add ecx, 0xffff8001
mov edx, dword [0x524d94]
mov ecx, dword [edx + ecx*4]
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ecx
jmp 0x43b393
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ebp
mov ecx, dword [edi]
sub ecx, 1
je 0x43b3d8
lea edx, [esi + ecx*8 - 4]
mov edi, edi
mov dword [edx + 4], ebp
mov eax, dword [edi + ecx*4]
mov eax, dword [ebx + eax*4]
cmp eax, 0x7fff
je 0x43b3ce
add eax, eax
cmp eax, 0x7fff
jb 0x43b3be
add eax, 0xffff8001
mov ebp, dword [0x524d94]
mov eax, dword [ebp + eax*4]
mov dword [edx], eax
xor ebp, ebp
jmp 0x43b3d0
mov dword [edx], ebp
dec ecx
sub edx, 8
cmp ecx, ebp
jne 0x43b3a0
mov eax, dword [edi]
lea ecx, [eax + eax - 1]
cmp ecx, 0x11
mov dword [esi], ecx
jle 0x43b403
lea eax, [esi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
lea esp, [esp]
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], ebp
sub eax, 4
sub edx, 1
jne 0x43b3f0
cmp dword [esi], 0x11
jbe 0x43b41e
mov dword [esi], 0x11
mov edi, edi
mov eax, dword [esi]
cmp dword [esi + eax*4], ebp
jne 0x43b41e
dec eax
mov dword [esi], eax
cmp eax, ebp
jne 0x43b410
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], ebp
pop ebp
ret 8
Function at 0x441be0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4f54cb
mov eax, dword fs:[0]
push eax
mov eax, 0x5028
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x5024], eax
push ebx
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x5038]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5048]
push 0x800
lea eax, [esp + 0x2038]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x441df2
cmp eax, 0x800
jae 0x441df2
push 0x800
lea ecx, [esp + 0x3038]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x441df2
cmp eax, 0x800
jae 0x441df2
lea edx, [esp + 0x2034]
push edx
call fcn.00451140
mov ebx, eax
lea eax, [esp + 0x3034]
push eax
call fcn.00451140
mov esi, eax
cmp word [esi], 0
je 0x441df2
push esi
push ebx
call fcn.00469f00
test eax, eax
je 0x441df2
push esi
push edi
call fcn.00451140
push eax
call fcn.00469f00
test eax, eax
jne 0x441df2
mov word [esp + 0x1034], ax
xor esi, esi
lea esp, [esp]
test ax, ax
jne 0x441d42
push 0x800
push edi
lea ecx, [esp + 0x103c]
push ecx
call fcn.00466b20
push esi
push str.rtmp_d
lea edx, [esp + 0x103c]
push edx
call fcn.00451140
push eax
mov edx, 0x800
call fcn.00460180
add esp, 0xc
lea eax, [esp + 0x1034]
push eax
call fcn.00443510
test al, al
je 0x441d26
xor eax, eax
mov word [esp + 0x1034], ax
jmp 0x441d2e
mov ax, word [esp + 0x1034]
add esi, 0x7b
cmp esi, 0x2710
jl 0x441cd0
test ax, ax
je 0x441df2
push 0x800
push edi
lea ecx, [esp + 0x403c]
push ecx
call fcn.00466b20
push 0x800
push ebx
lea edx, [esp + 0x403c]
push edx
call fcn.00451310
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [esp + 0x1034]
push eax
lea ecx, [esp + 0x4038]
push ecx
call esi
test eax, eax
je 0x441df2
lea ecx, [esp + 0x10]
call fcn.00441f10
mov dword [esp + 0x5040], 0
push edi
xor bl, bl
call fcn.00443510
test al, al
jne 0x441db2
push 0xa
push edi
lea ecx, [esp + 0x18]
call fcn.00442120
mov bl, al
lea edx, [esp + 0x4034]
push edx
lea eax, [esp + 0x1038]
push eax
call esi
test bl, bl
je 0x441dda
lea ecx, [esp + 0x10]
call fcn.00442240
lea ecx, [esp + 0x10]
call fcn.004422a0
mov dword [esp + 0x5040], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00442640
mov al, 1
jmp 0x441df4
xor al, al
mov ecx, dword [esp + 0x5038]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5024]
xor ecx, esp
call fcn.004df824
add esp, 0x5034
ret 4
Function at 0x441f90
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1014]
mov edx, dword [esp + 0x1018]
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
push edi
mov dword [esp + 0x18], eax
mov dword [esi + 0x1020], 0
jne 0x441fd9
test dl, 4
jne 0x441fd9
xor cl, cl
jmp 0x441fdb
mov cl, 1
mov ebx, edx
shr ebx, 1
and bl, 1
movzx ebp, bl
neg ebp
sbb ebp, ebp
and ebp, 0xc0000000
add ebp, 0x80000000
test dl, 1
je 0x442000
or ebp, 0x40000000
mov dword [esp + 0x10], 1
test cl, cl
je 0x442014
mov dword [esp + 0x10], 3
mov ecx, dword [esp + 0x10]
xor ebx, ebx
cmp byte [esi + 0x15], bl
push 0
setne bl
dec ebx
and ebx, 0x8000000
push ebx
push 3
push 0
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44209f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x800
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.00451b70
test al, al
je 0x44208e
mov ecx, dword [esp + 0x10]
push 0
push ebx
push 3
push 0
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x442089
mov dword [esp + 0x14], eax
cmp edi, 0xffffffff
jne 0x44209f
cmp dword [esp + 0x14], 2
jne 0x44209f
mov dword [esi + 0x1020], 1
cmp edi, 0xffffffff
setne bl
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
test bl, bl
je 0x4420ce
mov eax, dword [esp + 0x18]
push 0x800
mov dword [esi + 4], edi
push eax
add esi, 0x1e
push esi
call fcn.00466b20
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1010
ret 8