joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x1051473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eeff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ef18
lea eax, [ebp - 0x10]
mov edx, dword [0x106b2a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ef2b
lea eax, [ebp - 0x10]
mov edx, dword [0x106b2a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ef37
adc edx, 0
mov edx, dword [edx*4 + 0x106a10c]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f045
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f038
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f038
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f038
cmp dx, 0x150
ja 0x41f038
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f038
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f05d
inc ebx
cmp ebx, 0x19
jne 0x41eef1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x105147a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xd444a94
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x46511875
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x1000a0b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1000a108
cmp byte [esi + ebx - 1], 0xa
je 0x1000a0dc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1001d084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x1000a6b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x1001d094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x1000a870
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x1001d094]
movzx eax, al
bt eax, esi
jae 0x1000a8d0
mov ecx, dword [0x1001d084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x1000a775
test byte [0x1000b050], 8
jne 0x1000a810
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1000b060], 8
jne 0x1000a7c0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000a744
cmp esi, 3
jbe 0x1000a780
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10017cd0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x1000a744
mov ecx, dword [0x1001d094]
test ecx, ecx
je 0x1000a8b0
mov dword [esp], 0x1000b060
call dword [0x1001d094]
test al, 8
je 0x1000a71b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x1000a71b
mov ebx, dword [0x1001d094]
test ebx, ebx
je 0x1000a890
mov dword [esp], 0x1000b050
call dword [0x1001d094]
test al, 8
je 0x1000a706
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x1000a70e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x1001d094
call sym._load_func.part.0
jmp 0x1000a6cd
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x1001d094
call sym._load_func.part.0
jmp 0x1000a81a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x1001d094
call sym._load_func.part.0
jmp 0x1000a7ce
mov eax, 0xffffffff
jmp 0x1000a775
Function at 0x1000aa80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1001d0a0]
test eax, eax
je 0x1000ab38
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x1000aac0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000aaac
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000ab6d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1001d0a0], eax
sub esp, 8
test eax, eax
jne 0x1000aa9d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000aaae
Function at 0x1000ab80
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [ebp - 0x10], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000ad01
mov eax, dword [esi]
test eax, eax
je 0x1000acf0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], edx
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [ebp - 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000ad05
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000ace8
call dword [edx + 0x28]
sub esp, 8
mov dword [esi + 8], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
not eax
shr eax, 0x1f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
sub esp, 8
jmp 0x1000aca9
mov edx, esi
mov eax, edi
call dbg.create_registrar
test eax, eax
jne 0x1000abe6
xor eax, eax
jmp 0x1000acd8
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000acd8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41d480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ecx + 4]
xor eax, eax
push esi
push edi
mov edi, dword [ecx]
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edi
mov dword [edi + 0x16], eax
test ebx, ebx
jle 0x41d4bd
nop
movzx edx, byte [edi + esi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x5326d0]
cmp esi, ebx
jl 0x41d4a0
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 0xc]
xor esi, esi
test ebx, ebx
jle 0x41d4ed
mov edi, dword [ecx + 8]
nop dword [eax]
movzx edx, byte [edi + esi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x5326d0]
cmp esi, ebx
jl 0x41d4d0
mov edi, dword [ebp - 8]
mov byte [edi + 0x16], al
mov ecx, eax
shr ecx, 8
mov byte [edi + 0x17], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 0x18], cl
shr eax, 0x18
mov byte [edi + 0x19], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ecx + 0x64]
xor ebx, ebx
imul edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], ecx
test edi, edi
je 0x424b8b
nop dword [eax]
mov edx, dword [ebp + 0xc]
mov eax, esi
shr eax, 1
movzx edx, byte [eax + edx]
lea eax, [ecx + 0xa8]
lea eax, [eax + ebx*8]
mov ecx, esi
push eax
mov eax, edx
shr edx, 4
and eax, 0xf
and cl, 1
cmove edx, eax
push edx
call fcn.004271c0
mov ecx, dword [ebp + 8]
add esp, 8
mov word [ecx + esi*2], ax
mov eax, ebx
mov ecx, dword [ebp - 4]
xor eax, 1
inc esi
cmp dword [ecx + 0x64], 2
cmovne eax, ebx
mov ebx, eax
cmp esi, edi
jb 0x424b40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x425530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
mov eax, dword [edi + 0x64]
imul eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x42558b
nop word [eax + eax]
push dword [edi + 0x8c]
lea eax, [edi + 0xa8]
lea eax, [eax + ebx*8]
push eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [esi + eax]
push eax
call fcn.00427240
mov ecx, dword [ebp + 8]
add esp, 0xc
mov word [ecx + esi*2], ax
mov eax, ebx
xor eax, 1
inc esi
cmp dword [edi + 0x64], 2
cmovne eax, ebx
mov ebx, eax
cmp esi, dword [ebp + 0x10]
jb 0x425550
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x426c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50fdc6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5522f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWaveStreamCtrl.0
call fcn.0044b570
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
call fcn.00421170
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], eax
call fcn.00421810
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x43f49a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x516208]
test eax, eax
je 0x43f4d9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43f4d9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43f4d9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43f4d9
cmp dword [ecx + 0x74], 0xe
jbe 0x43f4d9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44d040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, edx
test edi, edi
je 0x44d078
imul edx, dword [ecx], 0xe9
movzx eax, byte [esi + ebx]
add eax, edx
mov dword [ecx], eax
add byte [ecx + 4], al
xor byte [ecx + 5], al
movzx eax, byte [esi + ebx]
add byte [ecx + 6], al
movzx eax, byte [esi + ebx]
inc esi
xor byte [ecx + 7], al
cmp esi, edi
jb 0x44d051
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4518e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov eax, edx
mov dword [ebp - 8], ecx
mov ecx, dword [0x56ab24]
push edi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045a2e0
test eax, eax
je 0x451a09
call fcn.00452420
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00452140
test eax, eax
je 0x4519f8
mov ecx, dword [eax + 0x20]
mov ebx, 1
call fcn.00503020
test eax, eax
jne 0x451945
mov ecx, edi
call fcn.00451c90
test eax, eax
jne 0x451945
xor ebx, ebx
mov esi, 0x80000009
jmp 0x451948
mov esi, dword [ebp - 8]
call fcn.00452410
test ebx, ebx
je 0x4519ef
push 0x1c
call fcn.004275db
add esp, 4
mov esi, eax
push 0
push 0
push 0
push 0
call dword [0x5162f0]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
push esi
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x451a20
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
call fcn.00438cf0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4519d8
push 2
push eax
mov dword [esi], eax
call dword [0x516300]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [0x5162fc]
push dword [esi + 4]
call dword [0x5162f4]
mov eax, dword [ebp - 8]
mov dword [esi + 4], 0
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1c
push esi
call fcn.0042760b
add esp, 8
mov eax, 0x80000008
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00452410
mov eax, 0x80000003
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80000005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4645f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x53c7b0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x46478a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x464703
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm1, xmm3
movaps xmm2, xmm3
pmullw xmm3, xmm4
paddw xmm2, xmm4
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psrlw xmm3, 7
psubw xmm2, xmm0
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x464690
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x464770
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm1, xmm2
movaps xmm3, xmm2
mov ecx, dword [ebp - 4]
paddw xmm3, xmm4
pmullw xmm2, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x464683
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x464bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x53c7b0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x464d4a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x464cc3
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm1, xmm4
pcmpgtw xmm1, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm1
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm2, xmm3
psrlw xmm0, 8
paddw xmm2, xmm4
pmullw xmm3, xmm4
psllw xmm2, 1
add eax, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm3, 7
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x464c50
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x464d30
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm3, xmm2
paddw xmm3, xmm4
pmullw xmm2, xmm4
mov ecx, dword [ebp - 4]
movaps xmm1, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x464c43
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret