joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e1e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
movaps xmm0, xmmword [0x4a82a0]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x18], 0x9012908
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x1d160b
nop dword [eax + eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x44bce0
push 0xc
mov byte [ebp - 0x11], 0
call fcn.0046ad4e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov edx, 0x17
mov ecx, dword [0x4b4f24]
mov dword [edi], 0
mov byte [edi + 8], 1
mov dword [edi + 4], 0x17
call fcn.00424500
mov dword [edi], eax
test eax, eax
je 0x44bd40
push dword [edi + 4]
lea ecx, [ebp - 0x27]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
nop
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4b55b0]
cmp eax, dword [ecx + 4]
jg 0x44bdee
mov eax, dword [edi]
test eax, eax
je 0x44bd7d
push dword [edi + 4]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
push dword [edi]
call fcn.0046f5b4
add esp, 4
mov dword [edi], 0
push 0xc
push edi
call fcn.0046afcf
mov ecx, dword [0x4b5598]
add esp, 8
mov esi, dword [0x4b559c]
mov eax, ecx
or eax, esi
jne 0x44bdb2
mov eax, 0xc0000138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
cdq
push edx
push eax
push 0
push dword [ebp + 0x18]
lea eax, [ebp + 0x10]
cdq
push edx
push eax
lea eax, [ebp + 8]
cdq
push edx
push eax
mov eax, dword [ebx + 4]
cdq
push edx
push eax
push 5
push esi
push ecx
call fcn.00452960
mov ecx, dword [ebp - 0xc]
add esp, 0x34
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x4b55b0
call fcn.0046b2ca
add esp, 4
cmp dword [0x4b55b0], 0xffffffff
jne 0x44bd59
mov esi, dword [edi]
call fcn.00452ac0
push edx
push eax
mov ecx, esi
call fcn.00453450
push 0x4b55b0
mov dword [0x4b5598], eax
mov dword [0x4b559c], edx
call fcn.0046b280
add esp, 0xc
jmp 0x44bd59
Function at 0x44be40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f474
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [ebp + 0x18]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 8]
test eax, eax
push esi
push edi
lea edi, [ebp - 0x20]
mov dword [ebp - 0x10], ecx
cmovne edi, eax
movlpd qword [ebp - 0x20], xmm0
cmp byte [ecx + 0xd], 0
je 0x44becd
cmp dword [ebp + 0xc], 0
ja 0x44becd
jb 0x44be8d
cmp ebx, 0x7fffffff
jae 0x44becd
mov eax, dword fs:[0x18]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov dword [eax + 0xbf4], 0
push ebx
push dword [ecx + 4]
call 0x9cdd83
call fcn.0042cc00
movaps xmm0, xmmword [0x4a8840]
xor ecx, ecx
mov dword [ebp + 0x18], eax
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x6a4b4652
mov dword [ebp - 0x28], 0x55484a42
mov dword [ebp - 0x24], 0x13115e
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x1a
jb 0x44bef7
push 0xc
mov byte [ebp - 0x21], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, 0x1b
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x1b
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44bf55
push dword [esi + 4]
lea ecx, [ebp - 0x3b]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
test eax, eax
je 0x44bf91
mov ecx, dword [ebp - 0x10]
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ecx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 0xc]
mov eax, 0xc0000138
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44bfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f474
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [ebp + 0x18]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 8]
test eax, eax
push esi
push edi
lea edi, [ebp - 0x20]
mov dword [ebp - 0x10], ecx
cmovne edi, eax
movlpd qword [ebp - 0x20], xmm0
cmp byte [ecx + 0xd], 0
je 0x44c03d
cmp dword [ebp + 0xc], 0
ja 0x44c03d
jb 0x44bffd
cmp ebx, 0x7fffffff
jae 0x44c03d
mov eax, dword fs:[0x18]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov dword [eax + 0xbf4], 0
push ebx
push dword [ecx + 4]
push edx
call 0x6a7d9a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xbf4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call fcn.0042cc00
movaps xmm0, xmmword [0x4a8450]
xor ecx, ecx
mov dword [ebp + 0x18], eax
movups xmmword [ebp - 0x3d], xmm0
mov dword [ebp - 0x2d], 0xd1918
mov dword [ebp - 0x29], 0x3010921
mov dword [ebp - 0x25], 0x585a151e
mov byte [ebp - 0x21], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x3d]
xor byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x1b
jb 0x44c070
push 0xc
mov byte [ebp - 0x21], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, 0x1c
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x1c
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44c0ce
push dword [esi + 4]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
test eax, eax
je 0x44c10a
mov ecx, dword [ebp - 0x10]
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ecx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 0xc]
mov eax, 0xc0000138
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44c130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f474
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 0x10], 0
call fcn.0042cc00
movaps xmm0, xmmword [0x4a8380]
mov edi, eax
movups xmmword [ebp - 0x36], xmm0
xor ecx, ecx
mov word [ebp - 0x16], 0x40
movaps xmm0, xmmword [0x4a86e0]
movups xmmword [ebp - 0x26], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x36]
xor byte [ebp + ecx - 0x35], al
inc ecx
cmp ecx, 0x20
jb 0x44c180
push esi
push 0xc
mov byte [ebp - 0x15], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, 0x21
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x21
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44c1df
push dword [esi + 4]
lea ecx, [ebp - 0x35]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
push esi
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
pop esi
test eax, eax
je 0x44c217
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx + 4]
call eax
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0xc]
mov eax, 0xc0000138
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44c230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e1e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
movaps xmm0, xmmword [0x4a86b0]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x19], 0x415c7e40
push edi
movups xmmword [ebp - 0x29], xmm0
mov dword [ebp - 0x15], 0x5d5d4b4d
xor ecx, ecx
mov byte [ebp - 0x11], 0
nop
mov al, byte [ebp - 0x29]
xor byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0x17
jb 0x44c270
push 0xc
mov byte [ebp - 0x11], 0
call fcn.0046ad4e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov edx, 0x18
mov ecx, dword [0x4b4f24]
mov dword [edi], 0
mov byte [edi + 8], 1
mov dword [edi + 4], 0x18
call fcn.00424500
mov dword [edi], eax
test eax, eax
je 0x44c2d0
push dword [edi + 4]
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
nop
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4b5588]
cmp eax, dword [ecx + 4]
jg 0x44c378
mov eax, dword [edi]
test eax, eax
je 0x44c30d
push dword [edi + 4]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
push dword [edi]
call fcn.0046f5b4
add esp, 4
mov dword [edi], 0
push 0xc
push edi
call fcn.0046afcf
mov ecx, dword [0x4b5580]
add esp, 8
mov esi, dword [0x4b5584]
mov eax, ecx
or eax, esi
jne 0x44c342
mov eax, 0xc0000138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
cdq
push edx
push eax
mov eax, dword [ebp + 8]
cdq
push edx
push eax
mov eax, dword [ebx + 4]
cdq
push edx
push eax
push 4
push esi
push ecx
call fcn.00452960
mov ecx, dword [ebp - 0xc]
add esp, 0x2c
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x4b5588
call fcn.0046b2ca
add esp, 4
cmp dword [0x4b5588], 0xffffffff
jne 0x44c2e9
mov esi, dword [edi]
call fcn.00452ac0
push edx
push eax
mov ecx, esi
call fcn.00453450
push 0x4b5588
mov dword [0x4b5580], eax
mov dword [0x4b5584], edx
call fcn.0046b280
add esp, 0xc
jmp 0x44c2e9
Function at 0x44c3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e1e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
movaps xmm0, xmmword [0x4a88b0]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov word [ebp - 0x1a], 0x64
movups xmmword [ebp - 0x2a], xmm0
mov cl, byte [ebp - 0x2a]
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0x10
jb 0x44c3f3
push 0xc
mov byte [ebp - 0x19], 0
call fcn.0046ad4e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov edx, 0x11
mov ecx, dword [0x4b4f24]
mov dword [edi], 0
mov byte [edi + 8], 1
mov dword [edi + 4], 0x11
call fcn.00424500
mov dword [edi], eax
test eax, eax
je 0x44c451
push dword [edi + 4]
lea ecx, [ebp - 0x29]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4b5538]
cmp eax, dword [ecx + 4]
jg 0x44c52f
mov eax, dword [edi]
test eax, eax
je 0x44c48e
push dword [edi + 4]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
push dword [edi]
call fcn.0046f5b4
add esp, 4
mov dword [edi], 0
push 0xc
push edi
call fcn.0046afcf
mov ecx, dword [0x4b5540]
add esp, 8
mov esi, dword [0x4b5544]
mov eax, ecx
or eax, esi
jne 0x44c4c3
mov eax, 0xc0000138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
push 0
push 0
mov eax, dword [ebp + 0x1c]
xorps xmm0, xmm0
push 0
push 0x100000
push 0
push 0x1000
push 0
push 0
cdq
push edx
push eax
push dword [ebp + 0x18]
mov eax, dword [ebx + 4]
push dword [ebp + 0x14]
cdq
push dword [ebp + 0x10]
movlpd qword [ebp - 0x18], xmm0
push dword [ebp + 0xc]
push edx
push eax
push 0
push 0
push 0
push dword [ebp + 0x20]
lea eax, [ebp - 0x18]
cdq
push edx
push eax
push 0xb
push esi
push ecx
call fcn.00452960
mov edx, dword [ebp + 8]
add esp, 0x64
mov ecx, dword [ebp - 0x18]
pop edi
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
push 0x4b5538
call fcn.0046b2ca
add esp, 4
cmp dword [0x4b5538], 0xffffffff
jne 0x44c46a
mov esi, dword [edi]
call fcn.00452ac0
push edx
push eax
mov ecx, esi
call fcn.00453450
push 0x4b5538
mov dword [0x4b5540], eax
mov dword [0x4b5544], edx
call fcn.0046b280
add esp, 0xc
jmp 0x44c46a
Function at 0x44c5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e1e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
movaps xmm0, xmmword [0x4a8400]
xor ecx, ecx
push esi
push edi
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xe0b0f
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x12
jb 0x44c5f1
push 0xc
mov byte [ebp - 0x11], 0
call fcn.0046ad4e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov edx, 0x13
mov ecx, dword [0x4b4f24]
mov dword [edi], 0
mov byte [edi + 8], 1
mov dword [edi + 4], 0x13
call fcn.00424500
mov dword [edi], eax
test eax, eax
je 0x44c650
push dword [edi + 4]
lea ecx, [ebp - 0x23]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
nop
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4b555c]
cmp eax, dword [ecx + 4]
jg 0x44c6eb
mov eax, dword [edi]
test eax, eax
je 0x44c68d
push dword [edi + 4]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
push dword [edi]
call fcn.0046f5b4
add esp, 4
mov dword [edi], 0
push 0xc
push edi
call fcn.0046afcf
mov ecx, dword [0x4b5530]
add esp, 8
mov esi, dword [0x4b5534]
mov eax, ecx
or eax, esi
jne 0x44c6c1
mov eax, 0xc0000138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push 2
push esi
push ecx
call fcn.00452960
mov ecx, dword [ebp - 0xc]
add esp, 0x1c
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x4b555c
call fcn.0046b2ca
add esp, 4
cmp dword [0x4b555c], 0xffffffff
jne 0x44c669
mov esi, dword [edi]
call fcn.00452ac0
push edx
push eax
mov ecx, esi
call fcn.00453450
push 0x4b555c
mov dword [0x4b5530], eax
mov dword [0x4b5534], edx
call fcn.0046b280
add esp, 0xc
jmp 0x44c669
Function at 0x44c780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e1e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
movaps xmm0, xmmword [0x4a8830]
xor ecx, ecx
push esi
push edi
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x454044
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x12
jb 0x44c7b1
push 0xc
mov byte [ebp - 0x11], 0
call fcn.0046ad4e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov edx, 0x13
mov ecx, dword [0x4b4f24]
mov dword [edi], 0
mov byte [edi + 8], 1
mov dword [edi + 4], 0x13
call fcn.00424500
mov dword [edi], eax
test eax, eax
je 0x44c810
push dword [edi + 4]
lea ecx, [ebp - 0x23]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
nop
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4b553c]
cmp eax, dword [ecx + 4]
jg 0x44c8ab
mov eax, dword [edi]
test eax, eax
je 0x44c84d
push dword [edi + 4]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
push dword [edi]
call fcn.0046f5b4
add esp, 4
mov dword [edi], 0
push 0xc
push edi
call fcn.0046afcf
mov ecx, dword [0x4b5550]
add esp, 8
mov esi, dword [0x4b5554]
mov eax, ecx
or eax, esi
jne 0x44c881
mov eax, 0xc0000138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push 2
push esi
push ecx
call fcn.00452960
mov ecx, dword [ebp - 0xc]
add esp, 0x1c
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x4b553c
call fcn.0046b2ca
add esp, 4
cmp dword [0x4b553c], 0xffffffff
jne 0x44c829
mov esi, dword [edi]
call fcn.00452ac0
push edx
push eax
mov ecx, esi
call fcn.00453450
push 0x4b553c
mov dword [0x4b5550], eax
mov dword [0x4b5554], edx
call fcn.0046b280
add esp, 0xc
jmp 0x44c829
Function at 0x44c900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48e1e4
push eax
mov dword fs:[0], esp
sub esp, 0x18
cmp byte [ecx + 0xd], 0
push esi
push edi
je 0x44c949
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
movaps xmm0, xmmword [0x4a89e0]
xor ecx, ecx
movups xmmword [ebp - 0x22], xmm0
mov word [ebp - 0x12], 0x62
nop dword [eax]
mov al, byte [ebp - 0x22]
xor byte [ebp + ecx - 0x21], al
inc ecx
cmp ecx, 0x10
jb 0x44c960
push 0xc
mov byte [ebp - 0x11], 0
call fcn.0046ad4e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov edx, 0x11
mov ecx, dword [0x4b4f24]
mov dword [edi], 0
mov byte [edi + 8], 1
mov dword [edi + 4], 0x11
call fcn.00424500
mov dword [edi], eax
test eax, eax
je 0x44c9c0
push dword [edi + 4]
lea ecx, [ebp - 0x21]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
nop
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4b554c]
cmp eax, dword [ecx + 4]
jg 0x44ca69
mov eax, dword [edi]
test eax, eax
je 0x44c9fd
push dword [edi + 4]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
push dword [edi]
call fcn.0046f5b4
add esp, 4
mov dword [edi], 0
push 0xc
push edi
call fcn.0046afcf
mov ecx, dword [0x4b5578]
add esp, 8
mov esi, dword [0x4b557c]
mov eax, ecx
or eax, esi
jne 0x44ca31
mov eax, 0xc0000138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push dword [ebp + 0x18]
cdq
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
push eax
push 5
push esi
push ecx
call fcn.00452960
mov ecx, dword [ebp - 0xc]
add esp, 0x34
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
push 0x4b554c
call fcn.0046b2ca
add esp, 4
cmp dword [0x4b554c], 0xffffffff
jne 0x44c9d9
mov esi, dword [edi]
call fcn.00452ac0
push edx
push eax
mov ecx, esi
call fcn.00453450
push 0x4b554c
mov dword [0x4b5578], eax
mov dword [0x4b557c], edx
call fcn.0046b280
add esp, 0xc
jmp 0x44c9d9
Function at 0x44cab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48f454
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x40
push esi
push edi
mov edi, ecx
cmp byte [edi + 0xd], 0
jne 0x44caf2
xor eax, eax
xor edx, edx
jmp 0x44cbd8
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
call fcn.0042cc00
movaps xmm0, xmmword [0x4a85d0]
xor ecx, ecx
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x4f], xmm0
mov dword [ebp - 0x3f], 0x152b2a2c
mov dword [ebp - 0x3b], 0x20262a37
mov word [ebp - 0x37], 0x3636
mov byte [ebp - 0x35], 0
mov al, byte [ebp - 0x4f]
xor byte [ebp + ecx - 0x4e], al
inc ecx
cmp ecx, 0x19
jb 0x44cb32
push 0xc
mov byte [ebp - 0x35], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov edx, 0x1a
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x1a
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44cb90
push dword [esi + 4]
lea ecx, [ebp - 0x4e]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
test eax, eax
je 0x44cbd4
lea ecx, [ebp - 0x18]
push ecx
push 0x18
lea ecx, [ebp - 0x34]
push ecx
push 0
push dword [edi + 4]
call eax
test eax, eax
js 0x44cbd4
mov eax, dword [ebx + 8]
test eax, eax
je 0x44cbd4
push 0
push 0x250
push eax
push dword [ebp - 0x30]
push dword [edi + 4]
call 0x8aa634
mov eax, dword [ebp - 0x30]
cdq
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x44cbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f4a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x30
lea eax, [ebp - 0x68]
mov ebx, ecx
push 0
push eax
call fcn.0046ce00
add esp, 0xc
mov dword [ebp - 0x10], 0
call fcn.0042cc00
movaps xmm0, xmmword [0x4a8ba0]
mov edi, eax
movups xmmword [ebp - 0x36], xmm0
xor ecx, ecx
mov word [ebp - 0x16], 0x2f
movaps xmm0, xmmword [0x4a85b0]
movups xmmword [ebp - 0x26], xmm0
nop dword [eax]
mov al, byte [ebp - 0x36]
xor byte [ebp + ecx - 0x35], al
inc ecx
cmp ecx, 0x20
jb 0x44cc50
push 0xc
mov byte [ebp - 0x15], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, 0x21
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x21
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44ccae
push dword [esi + 4]
lea ecx, [ebp - 0x35]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
push esi
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
test eax, eax
je 0x44ccd2
lea ecx, [ebp - 0x10]
push ecx
push 0x30
lea ecx, [ebp - 0x68]
push ecx
push 0
push dword [ebx + 4]
call eax
cmp dword [ebp - 0x10], 0
jbe 0x44cdaa
call fcn.0042cc00
movaps xmm0, xmmword [0x4a8670]
mov edi, eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x6272a3e
xor ecx, ecx
mov dword [ebp - 0x1c], 0x3924262e
mov dword [ebp - 0x18], 0x7f7d32
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x1a
jb 0x44cd05
push 0xc
mov byte [ebp - 0x15], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov edx, 0x1b
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x1b
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44cd63
push dword [esi + 4]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
push esi
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
test eax, eax
je 0x44cdaa
push 0
push 0
push 0x388
push dword [ebp + 8]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebx + 4]
call eax
test eax, eax
js 0x44cdaa
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
xor edx, edx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44cdd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48f844
push eax
mov dword fs:[0], esp
sub esp, 0x44
push edi
mov edi, ecx
cmp byte [edi + 0xd], 0
jne 0x44ce09
xor eax, eax
xor edx, edx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x40], xmm0
call fcn.0042cc00
movaps xmm0, xmmword [0x4a88f0]
xor ecx, ecx
mov dword [ebp - 0x10], eax
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x22], 0x7b414046
mov dword [ebp - 0x1e], 0x4e4a5d47
mov word [ebp - 0x1a], 0x4b
nop dword [eax]
mov al, byte [ebp - 0x32]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x44ce50
push esi
push 0xc
mov byte [ebp - 0x19], 0
call fcn.0046ad4e
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov edx, 0x19
mov ecx, dword [0x4b4f24]
mov dword [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 4], 0x19
call fcn.00424500
mov dword [esi], eax
test eax, eax
je 0x44ceaf
push dword [esi + 4]
lea ecx, [ebp - 0x31]
push ecx
push eax
call fcn.0046c880
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00433fa0
pop esi
test eax, eax
je 0x44cef4
lea ecx, [ebp - 0x14]
push ecx
push 0x1c
lea ecx, [ebp - 0x50]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
js 0x44cef4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44cef4
push 0
push 0x1000
push eax
push dword [ebp - 0x4c]
push dword [edi + 4]
push edi
call fcn.00953032
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8