joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4310d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
sub esp, 0x110
mov esi, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
mov ecx, dword [0x567b10]
xor ecx, esp
mov dword [esp + 0x10c], ecx
lea edi, [esp + 0xc]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x80
mov ecx, esp
push 0x104
push ecx
push eax
push esi
call fcn.0042f8a0
add esp, 0x10
cmp dword [esi], 0
je 0x43114d
mov eax, dword [esp]
cmp eax, edi
je 0x431134
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00533ace
mov eax, esi
add esp, 0x110
pop esi
pop edi
ret
push dword [esp]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4311b2
cmp dword [esp + 0x124], 1
mov dword [esi], 0
jne 0x431202
and eax, 1
je 0x431202
mov dword [esi + 4], 0
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x43123a
mov dword [esi], 0xd
mov dword [esi + 4], 0x5673a0
jmp 0x431123
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
cmp ecx, 2
jne 0x43122b
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x4312a8
mov dword [esi], 2
mov dword [esi + 4], 0x5673a0
jmp 0x431123
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x431273
mov dword [esi + 4], 0x567398
jmp 0x431123
push eax
push esi
call fcn.004295f0
add esp, 8
jmp 0x431123
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x4311a0
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x4311a0
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x43121f
push 0x433930
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x43121f
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x4311f0
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x4311f0
Function at 0x431390
Capabilities:
Access peb ldr_data
Check if file exists

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, ecx
mov ebx, dword [esp + 0x54]
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp edx, 0xffffffff
je case.default.0x4313ba
mov edi, edx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp dword [eax*4 + 0x538840]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x431557
pxor xmm0, xmm0
movdqu xmmword [ebx], xmm0
movaps xmm1, xmmword [0x5385c0]
jmp 0x43150d
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je case.default.0x4313ba
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 8]
test al, 1
mov edx, 0x1ff
mov ecx, 0x16d
cmove ecx, edx
mov edx, dword [esp + 0x28]
and eax, 0x10
cmp eax, 1
mov edi, dword [esp + 0x24]
movdqu xmm0, xmmword [esp + 0x14]
pshufd xmm0, xmm0, 0xb1
mov eax, dword [esp + 0x30]
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], ebp
mov edx, 3
sbb edx, 0
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], edi
mov eax, dword [esp]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 4]
mov dword [ebx + 0x2c], eax
mov dword [esi], 0
mov eax, dword [0x5698e8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x568c58]
cmp ecx, dword [eax + 0xc]
jle 0x431539
jmp 0x431576
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
pxor xmm0, xmm0
cmp ecx, 2
jne 0x4314c8
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
movdqu xmmword [ebx + 0x20], xmm0
mov dword [ebx + 0x18], 1
jmp 0x431550
cmp eax, 0x20
jne 0x431542
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
movdqu xmmword [ebx + 0x20], xmm0
mov dword [ebx + 0x18], 9
jmp 0x431550
pxor xmm0, xmm0
movdqu xmmword [ebx], xmm0
movaps xmm1, xmmword [0x538570]
jmp 0x43150d
pxor xmm0, xmm0
movdqu xmmword [ebx], xmm0
movaps xmm1, xmmword [0x5385b0]
movups xmmword [ebx + 0x10], xmm1
movdqu xmmword [ebx + 0x20], xmm0
mov dword [esi], 0
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x431576
mov dword [esi + 4], 0x567398
jmp 0x431561
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx], xmm0
movdqu xmmword [ebx + 0xc], xmm0
mov dword [ebx + 0x1c], 0xffff
push eax
push esi
call fcn.004295f0
add esp, 8
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00533ace
mov eax, esi
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x431539
push 0x433930
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x431539
Function at 0x4318c0
Capabilities:
Parse pe header

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x43192c
mov esi, ecx
mov ecx, dword [ecx]
cmp ecx, 2
jae 0x43193e
mov bl, 1
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test bl, bl
jne 0x431923
cmp dword [esi + 0xc], 1
jne 0x431923
mov eax, dword [0x5697a0]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x43197e
cmp byte [0x56979c], 0
je 0x431923
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00533ace
add esp, 0x14
pop esi
pop edi
pop ebx
ret
movzx edi, word [eax]
xor edx, edx
cmp edi, 0x5a4d
setne bl
cmp ecx, 0x40
jb 0x4318e1
mov dl, bl
test edx, edx
jne 0x4318e1
mov edx, dword [eax + 0x3c]
cmp edx, ecx
cmova edx, ecx
sub ecx, edx
cmp ecx, 4
jb 0x4318e1
cmp dword [eax + edx], 0x4550
jne 0x4318e1
xor ebx, ebx
jmp 0x4318e3
push 0x5697a0
call fcn.00533bee
add esp, 4
cmp dword [0x5697a0], 0xffffffff
jne 0x431911
mov eax, esp
push eax
call fcn.0042ad70
add esp, 4
mov ecx, dword [esp]
mov al, 1
cmp ecx, 0xa
jb 0x4319dd
xor eax, eax
cmp ecx, 0xa
jne 0x4319dd
mov ecx, 0x7fffffff
and ecx, dword [esp + 4]
jne 0x4319dd
mov eax, dword [esp + 0xc]
and eax, 0x7fffffff
test dword [esp + 8], 0x7fffffff
sete cl
cmp eax, 0x4563
setb al
and al, cl
mov byte [0x56979c], al
push 0x5697a0
call fcn.00533ba4
add esp, 4
jmp 0x431911

Function at 0x431a10
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x28
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00533ace
mov eax, esi
add esp, 0x28
pop esi
ret
Function at 0x432060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov edi, dword [ebp + 0xc]
mov eax, dword [0x567b10]
xor eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [edi]
test eax, eax
je 0x43208b
cmp eax, 0xffffffff
je 0x43208b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
xorps xmm0, xmm0
movaps xmmword [esp], xmm0
movups xmmword [esp + 0xf], xmm0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x4320ed
mov ecx, dword [edi + 4]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x4320e3
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4321aa
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
mov esi, dword [ebp + 8]
mov dword [edi + 4], 0
movsd xmm0, qword [esp + 0x20]
movsd qword [edi + 8], xmm0
mov eax, dword [esp + 0x28]
mov dword [edi + 0x10], eax
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 9
mov byte [edi + 0x20], 1
movaps xmm0, xmmword [esp]
movups xmmword [edi + 0x21], xmm0
movups xmm0, xmmword [esp + 0xf]
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], 0xffff
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
mov dword [esi], 0
cmp eax, dword [ecx + 0xc]
jg 0x432178
mov dword [esi + 4], 0x567398
mov ecx, dword [esp + 0x2c]
xor ecx, ebp
call fcn.00533ace
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x43215d
push 0x433930
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x43215d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
Function at 0x4323e0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov eax, dword [0x567b10]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
test bl, 2
jne 0x432410
mov eax, dword [ebp + 0x10]
mov eax, dword [eax*4 + 0x538718]
mov edi, ecx
shl edi, 0x1f
and ecx, 2
shl ecx, 0x1d
or ecx, edi
mov edi, ebx
and edi, 4
shl edi, 0xe
or edi, ecx
mov ecx, ebx
and ebx, 0x10
shl ebx, 4
or ebx, edi
mov edi, ecx
and edi, 8
shr edi, 3
lea esi, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push edi
push 0x80
push ebx
push eax
push esi
call fcn.00432550
add esp, 0x14
cmp dword [ebp - 0x1c], 0
je 0x432472
mov esi, esp
push eax
mov edi, esp
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call fcn.00424bf0
add esp, 0xc
mov ebx, dword [ebp + 8]
jmp 0x432528
mov eax, dword [ebp + 0x18]
test al, 0x10
mov ebx, dword [ebp + 8]
je 0x4324ae
lea esi, [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x4324f5
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x4324f5
mov eax, dword [ebp + 0x18]
test al, 4
jne 0x4324b7
mov edi, dword [ebp - 0x14]
jmp 0x4324ed
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
mov edx, edi
push 1
call fcn.004327d0
add esp, 4
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4324ed
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, esp
push eax
mov edi, esp
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
jmp 0x43251f
and byte [ebx + 4], 0xfe
mov dword [ebx], edi
jmp 0x432538
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, esp
push eax
mov edi, esp
lea eax, [ebp - 0x3c]
push ebx
mov ebx, dword [ebp + 8]
push eax
call fcn.004295f0
add esp, 8
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push edi
call fcn.00424bf0
add esp, 0xc
or byte [ebx + 4], 1
mov eax, dword [edi]
mov dword [edi], 0
mov dword [ebx], eax
mov esp, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00533ace
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov edi, dword [0x567b10]
xor edi, ebp
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x14], 0
lea ebx, [ebp - 0x14]
push edi
push ebx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x432d09
and byte [esi + 4], 0xfe
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00533ace
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x432cec
cmp eax, 0x26
je 0x432cec
mov edi, esp
push eax
mov ebx, esp
lea ecx, [ebp - 0x1c]
push eax
push ecx
call fcn.004295f0
add esp, 8
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
call fcn.00424bf0
add esp, 0xc
or byte [esi + 4], 1
mov eax, dword [ebx]
mov dword [ebx], 0
mov dword [esi], eax
mov esp, edi
jmp 0x432cf5

Function at 0x432e70
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xac
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0xa8], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x432f90
mov esi, ecx
mov edx, dword [ecx]
cmp byte [edx], 0x7e
jne 0x432f90
mov ecx, 0xffffffff
add eax, 0xffffffff
je 0x432eca
xor edi, edi
nop dword [eax]
movzx ebx, byte [edx + edi + 1]
cmp bl, 0x5c
je 0x432ec8
cmp bl, 0x2f
je 0x432ec8
add edi, 1
cmp eax, edi
jne 0x432eb0
jmp 0x432eca
mov ecx, edi
cmp eax, ecx
cmovb ecx, eax
test ecx, ecx
jne 0x432f90
lea edi, [esp + 0x18]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x80
movups xmm0, xmmword [0x5608a0]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 8], 0
lea eax, [esp + 8]
lea ecx, [esp + 0x98]
push eax
push 0
push 0x8000
push ecx
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x432f7e
mov ebx, dword [esp + 8]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
lea ebp, [esp + 0xc]
mov ecx, esp
mov edx, 0xfde9
push ebp
push eax
push ebx
call fcn.00433320
add esp, 0xc
mov ebx, dword [esp]
push dword [esp + 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x432f7e
mov eax, dword [esp + 0xc]
mov al, byte [eax]
mov ecx, dword [esi]
mov byte [ecx], al
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add edx, eax
add eax, 1
mov ebx, dword [esi]
add ebx, 1
mov ecx, esi
push edx
push eax
push ebx
call fcn.00433600
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x432f90
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00533ace
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [ecx + 8]
xor eax, eax
add edx, 0x3f
setb al
shld eax, edx, 0x1a
je 0x446555
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx]
mov edx, dword [edx]
xor esi, esi
cmp eax, 4
jb 0x4464d7
lea edi, [edx + eax*8]
cmp ecx, edi
jae 0x44643f
lea edi, [ecx + eax*8]
cmp edx, edi
jb 0x4464d7
mov esi, eax
and esi, 0xfffffffc
lea edi, [esi - 4]
mov ebx, edi
shr ebx, 2
add ebx, 1
test edi, edi
je 0x44655f
mov ebp, ebx
and ebp, 0xfffffffe
neg ebp
xor edi, edi
movups xmm0, xmmword [edx + edi*8]
movups xmm1, xmmword [edx + edi*8 + 0x10]
movups xmm2, xmmword [ecx + edi*8]
xorps xmm2, xmm0
movups xmm0, xmmword [ecx + edi*8 + 0x10]
xorps xmm0, xmm1
movups xmmword [ecx + edi*8], xmm2
movups xmmword [ecx + edi*8 + 0x10], xmm0
movups xmm0, xmmword [edx + edi*8 + 0x20]
movups xmm1, xmmword [edx + edi*8 + 0x30]
movups xmm2, xmmword [ecx + edi*8 + 0x20]
xorps xmm2, xmm0
movups xmm0, xmmword [ecx + edi*8 + 0x30]
xorps xmm0, xmm1
movups xmmword [ecx + edi*8 + 0x20], xmm2
movups xmmword [ecx + edi*8 + 0x30], xmm0
add edi, 8
add ebp, 2
jne 0x446460
test bl, 1
je 0x4464d3
movups xmm0, xmmword [edx + edi*8]
movups xmm1, xmmword [edx + edi*8 + 0x10]
movups xmm2, xmmword [ecx + edi*8]
xorps xmm2, xmm0
movups xmm0, xmmword [ecx + edi*8 + 0x10]
xorps xmm0, xmm1
movups xmmword [ecx + edi*8], xmm2
movups xmmword [ecx + edi*8 + 0x10], xmm0
cmp esi, eax
je 0x446555
mov edi, esi
not edi
add edi, eax
mov ebx, eax
and ebx, 3
mov dword [esp], edi
je 0x446506
nop word [eax + eax]
mov ebp, dword [edx + esi*8]
mov edi, dword [edx + esi*8 + 4]
xor dword [ecx + esi*8], ebp
xor dword [ecx + esi*8 + 4], edi
add esi, 1
add ebx, 0xffffffff
jne 0x4464f0
cmp dword [esp], 3
jb 0x446555
nop dword [eax]
mov edi, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [ecx + esi*8], edi
xor dword [ecx + esi*8 + 4], ebx
mov edi, dword [edx + esi*8 + 8]
mov ebx, dword [edx + esi*8 + 0xc]
xor dword [ecx + esi*8 + 0xc], ebx
xor dword [ecx + esi*8 + 8], edi
mov edi, dword [edx + esi*8 + 0x14]
mov ebx, dword [edx + esi*8 + 0x10]
xor dword [ecx + esi*8 + 0x10], ebx
xor dword [ecx + esi*8 + 0x14], edi
mov edi, dword [edx + esi*8 + 0x18]
mov ebx, dword [edx + esi*8 + 0x1c]
xor dword [ecx + esi*8 + 0x1c], ebx
xor dword [ecx + esi*8 + 0x18], edi
add esi, 4
cmp eax, esi
jne 0x446510
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor edi, edi
test bl, 1
jne 0x4464b2
jmp 0x4464d3
Function at 0x4469e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, ecx
mov ecx, dword [ecx + 8]
xor edx, edx
mov esi, ecx
add esi, 0x3f
setb dl
shld edx, esi, 0x1a
je 0x446ac1
mov ecx, dword [eax]
xor esi, esi
cmp edx, 4
jb 0x446ab0
mov esi, edx
and esi, 0xfffffffc
lea edi, [esi - 4]
mov ebx, edi
shr ebx, 2
add ebx, 1
test edi, edi
je 0x446aff
mov ebp, ebx
and ebp, 0xfffffffe
neg ebp
xor edi, edi
pcmpeqd xmm0, xmm0
nop
movdqu xmm1, xmmword [ecx + edi*8]
movdqu xmm2, xmmword [ecx + edi*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ecx + edi*8], xmm1
movdqu xmmword [ecx + edi*8 + 0x10], xmm2
movdqu xmm1, xmmword [ecx + edi*8 + 0x20]
movdqu xmm2, xmmword [ecx + edi*8 + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ecx + edi*8 + 0x20], xmm1
movdqu xmmword [ecx + edi*8 + 0x30], xmm2
add edi, 8
add ebp, 2
jne 0x446a30
test bl, 1
je 0x446a9d
movdqu xmm0, xmmword [ecx + edi*8]
movdqu xmm1, xmmword [ecx + edi*8 + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [ecx + edi*8], xmm0
movdqu xmmword [ecx + edi*8 + 0x10], xmm1
cmp esi, edx
je 0x446abe
nop word cs:[eax + eax]
nop dword [eax + eax]
not dword [ecx + esi*8]
not dword [ecx + esi*8 + 4]
add esi, 1
cmp edx, esi
jne 0x446ab0
mov ecx, dword [eax + 8]
cmp ecx, 0x40
jbe 0x446adc
mov eax, dword [eax]
xor edx, edx
mov esi, ecx
add esi, 0x3f
setb dl
shld edx, esi, 0x1a
lea eax, [eax + edx*8]
add eax, 0xfffffff8
neg cl
mov edx, 0xffffffff
shr edx, cl
mov esi, 0xffffffff
xor edi, edi
test cl, 0x20
cmove edi, edx
cmove edx, esi
and dword [eax], edx
and dword [eax + 4], edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
test bl, 1
jne 0x446a7b
jmp 0x446a9d
Function at 0x449d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, ecx
mov ecx, dword [ecx + 8]
cmp ecx, 0x40
ja 0x449db9
mov edi, dword [eax]
mov ebx, dword [eax + 4]
not edi
not ebx
neg cl
mov edx, 0xffffffff
mov ebp, 0xffffffff
shr ebp, cl
xor esi, esi
test cl, 0x20
cmovne edx, ebp
cmove esi, ebp
and esi, ebx
and edx, edi
jmp 0x449eb6
xor edx, edx
add ecx, 0x3f
setb dl
shld edx, ecx, 0x1a
mov ecx, dword [eax]
xor esi, esi
cmp edx, 4
jb 0x449e80
mov esi, edx
and esi, 0xfffffffc
lea edi, [esi - 4]
mov ebx, edi
shr ebx, 2
add ebx, 1
test edi, edi
je 0x449f5b
mov ebp, ebx
and ebp, 0xfffffffe
neg ebp
xor edi, edi
pcmpeqd xmm0, xmm0
nop word [eax + eax]
movdqu xmm1, xmmword [ecx + edi*8]
movdqu xmm2, xmmword [ecx + edi*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ecx + edi*8], xmm1
movdqu xmmword [ecx + edi*8 + 0x10], xmm2
movdqu xmm1, xmmword [ecx + edi*8 + 0x20]
movdqu xmm2, xmmword [ecx + edi*8 + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ecx + edi*8 + 0x20], xmm1
movdqu xmmword [ecx + edi*8 + 0x30], xmm2
add edi, 8
add ebp, 2
jne 0x449e00
test bl, 1
je 0x449e6d
movdqu xmm0, xmmword [ecx + edi*8]
movdqu xmm1, xmmword [ecx + edi*8 + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [ecx + edi*8], xmm0
movdqu xmmword [ecx + edi*8 + 0x10], xmm1
cmp esi, edx
je 0x449e8e
nop word cs:[eax + eax]
nop dword [eax + eax]
not dword [ecx + esi*8]
not dword [ecx + esi*8 + 4]
add esi, 1
cmp edx, esi
jne 0x449e80
mov ebx, dword [eax + 8]
mov ecx, ebx
neg cl
mov edx, 0xffffffff
shr edx, cl
xor esi, esi
test cl, 0x20
cmove esi, edx
mov ecx, 0xffffffff
cmove edx, ecx
cmp ebx, 0x40
ja 0x449f03
and edx, dword [eax]
and esi, dword [eax + 4]
mov dword [eax], edx
mov dword [eax + 4], esi
add dword [eax], 1
adc dword [eax + 4], 0
mov ecx, dword [eax + 8]
cmp ecx, 0x40
jbe 0x449ee0
mov eax, dword [eax]
xor edx, edx
mov esi, ecx
add esi, 0x3f
setb dl
shld edx, esi, 0x1a
lea eax, [eax + edx*8]
add eax, 0xfffffff8
neg cl
mov edx, 0xffffffff
shr edx, cl
mov esi, 0xffffffff
xor edi, edi
test cl, 0x20
cmove edi, edx
cmove edx, esi
and dword [eax], edx
and dword [eax + 4], edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
add ebx, 0x3f
setb cl
shld ecx, ebx, 0x1a
mov edi, dword [eax]
and dword [edi + ecx*8 - 8], edx
and dword [edi + ecx*8 - 4], esi
mov esi, dword [eax + 8]
cmp esi, 0x41
jb 0x449ebb
xor ecx, ecx
add esi, 0x3f
setb bl
mov edx, dword [eax]
add dword [edx], 1
adc dword [edx + 4], 0
jae 0x449ec2
mov cl, bl
shld ecx, esi, 0x1a
mov esi, 1
nop
cmp ecx, esi
je 0x449ec2
add dword [edx + esi*8], 1
adc dword [edx + esi*8 + 4], 0
lea esi, [esi + 1]
jb 0x449f40
jmp 0x449ec2
xor edi, edi
test bl, 1
jne 0x449e4b
jmp 0x449e6d
Function at 0x4530c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [0x567b10]
xor ecx, esp
mov dword [esp + 0x1c], ecx
cmp eax, 0xffffffff
je 0x453239
test eax, eax
je 0x453239
js 0x4530fa
lea ecx, [edi + 0x6c]
mov ebx, eax
jmp 0x4531b2
mov ebx, 0xfffffffe
sub ebx, eax
mov ebp, 1
mov ecx, ebx
shl ebp, cl
mov esi, ebx
shr esi, 5
mov ecx, dword [edi + 0x8c]
mov ecx, dword [ecx + esi*4]
bt ecx, ebx
jb 0x4531ab
mov ecx, dword [edi + 0x98]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test al, al
je 0x4531ab
mov eax, dword [edi + 0x8c]
test dword [eax + esi*4], ebp
mov esi, dword [esp + 0x34]
jne 0x453239
cmp dword [edi + 0x104], 0
jne 0x453239
mov ecx, edi
call fcn.004500a0
mov ebx, eax
mov dword [eax + 0xc], 0x535402
mov dword [eax + 0x10], 0
push 0x14
call fcn.00533f15
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], ebx
mov ecx, dword [edi + 0x104]
mov dword [edi + 0x104], eax
test ecx, ecx
je 0x453239
push ecx
call fcn.00533f45
add esp, 4
jmp 0x453239
lea ecx, [edi + 0x78]
mov esi, dword [esp + 0x34]
mov eax, dword [ecx]
lea ecx, [ebx + ebx*4]
mov ebp, dword [eax + ecx*4]
test ebp, ebp
js 0x453239
cmp dword [esp + 0x3c], 1
jne 0x4531d0
cmp dword [esp + 0x40], 1
jne 0x4531d0
mov dword [esi], ebp
jmp 0x45323f
mov ebx, dword [eax + ecx*4 + 0xc]
and ebx, 0xfffffff8
lea eax, [esp + 8]
mov ecx, ebx
push 0
push dword [edi + 8]
push dword [edi + 4]
push eax
call fcn.0044e670
cmp byte [esp + 0x18], 0
je 0x453239
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x453223
add edi, 0xc
sub esp, 0x18
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x14], edi
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.00452740
add esp, 0x18
mov eax, dword [esp + 4]
mov dword [ebx + 0x14], eax
mov ecx, dword [esp + 0x3c]
cmp dword [eax], ecx
jae 0x453256
mov eax, dword [esp + 0xc]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
jmp 0x45329f
mov dword [esi], 0
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00533ace
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [eax + ecx*4]
mov edx, dword [esp + 0xc]
sub edx, eax
je 0x45329f
xor ecx, ecx
add edx, 0xffffffff
mov dword [esp], eax
je 0x453296
mov eax, dword [esp + 0x40]
add eax, 0xffffffff
je 0x453296
mov edi, dword [esp + 8]
add edi, dword [esp]
xor ecx, ecx
movzx ebx, byte [edi + ecx]
cmp bl, 0xa
je 0x453296
cmp bl, 0xd
je 0x453296
add ecx, 1
cmp ecx, edx
jae 0x453296
cmp ecx, eax
jb 0x45327d
mov eax, dword [esp]
add eax, ebp
add eax, ecx
jmp 0x4532a1
add eax, ebp
mov dword [esi], eax
jmp 0x45323f