joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e5c5
Capabilities:
Parse pe header

Disassembly:
test edx, edx
je 0x42e5f7
and dword [edx], 0
test eax, eax
je 0x42e5f7
cmp eax, 0xffffffff
je 0x42e5f7
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x42e5e5
mov eax, 0xc000007b
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42e5df
xor eax, eax
mov dword [edx], ecx
ret
mov eax, 0xc000000d
ret

Function at 0x42f47a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov cx, word [eax + 0x14]
movzx ecx, cx
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
push esi
xor esi, esi
push edi
test eax, eax
jbe 0x42f4b0
mov edx, dword [ecx + 0xc]
cmp dword [ebp + 0xc], edx
jb 0x42f4a8
mov edi, dword [ecx + 0x10]
add edi, edx
cmp dword [ebp + 0xc], edi
jb 0x42f4b2
add ecx, 0x28
inc esi
cmp esi, eax
jb 0x42f496
xor ecx, ecx
pop edi
pop esi
test ecx, ecx
je 0x42f4c6
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
jmp 0x42f4c8
xor eax, eax
pop ebp
ret 8

Function at 0x430200
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
rdtsc
push 0
push 0xf4240
push dword [0x48e35c]
mov edi, eax
push dword [0x48e358]
mov ebx, edx
call fcn.00452fc0
push 0
push 0x186a0
push edx
push eax
call fcn.00445a30
mov esi, eax
mov ecx, edx
add esi, edi
adc ecx, ebx
rdtsc
cmp edx, ecx
jl 0x430239
jg 0x430245
cmp eax, esi
jb 0x430239
pop edi
pop esi
pop ebx
ret
Function at 0x430419
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xb8], eax
xor eax, eax
mov edi, edx
mov dword [ebp - 0xbc], edi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push eax
mov esi, ecx
call fcn.00455870
push 0x40
pop ebx
push ebx
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00450c60
add esp, 0xc
push 5
pop ecx
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
xor byte [ebp + eax - 0x58], 0x36
inc eax
cmp eax, ebx
jb 0x430473
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00455930
push dword [ebp + 0xc]
lea eax, [ebp - 0xb4]
push dword [ebp - 0xb8]
push eax
call fcn.00455930
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00455a40
xor eax, eax
xor byte [ebp + eax - 0x58], 0x6a
inc eax
cmp eax, ebx
jb 0x4304b5
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00455930
push 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00455930
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00455a40
mov edi, dword [ebp - 0xbc]
push 5
pop ecx
lea esi, [ebp - 0x18]
push 0x5c
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0xb4]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430509
push 0x14
pop ecx
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430516
lea eax, [ebp - 0x58]
mov byte [eax], 0
inc eax
dec ebx
jne 0x430520
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044341a
leave
ret 8
Function at 0x43096c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa0], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x27
lea eax, [ebp - 0x2b]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0xa4], esi
mov byte [ebp - 0x2c], 0
call fcn.00450c60
xor eax, eax
mov byte [ebp - 0x40], 0
lea edi, [ebp - 0x3f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5b
stosb byte es:[edi], al
lea eax, [ebp - 0x9b]
push 0
push eax
mov byte [ebp - 0x9c], 0
call fcn.00450c60
add esp, 0x18
test ebx, ebx
jne 0x4309e1
mov dword [ebp - 0xa0], 0x80290104
jmp 0x430a57
test esi, esi
jne 0x4309f1
mov dword [ebp - 0xa0], 0x80290103
jmp 0x430a57
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
pop ecx
push 5
lea esi, [ebx + 0x34]
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x9c]
lea esi, [ebx + 0xc]
lea edi, [ebp - 0x18]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00455870
push 0x28
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00455930
push dword [ebp - 0xa4]
lea eax, [ebp - 0x9c]
push eax
call fcn.00455a40
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x40]
push 0x14
sub eax, ecx
pop esi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec esi
jne 0x430a4e
push 0x28
pop ecx
pop edi
pop esi
lea eax, [ebp - 0x2c]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x430a60
push 0x14
pop ecx
lea eax, [ebp - 0x40]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430a6d
push 0x5c
pop ecx
lea eax, [ebp - 0x9c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430a7d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa0]
xor ecx, ebp
call fcn.0044341a
leave
ret 4

Function at 0x4362ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00435efc
push eax
push esi
push dword [ebp + 8]
call fcn.00435eb1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00435efc
push eax
push esi
push dword [ebp + 8]
call fcn.00435eb1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00435eec
xchg edi, eax
push ds
push ds
mov ah, 0x88
popfd
jl 0x436371
invalid
invalid
Function at 0x436573
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4365a0
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x43659b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x436585
and ecx, 0xfff
loope 0x436574
dec dword [edi]
add byte [eax], al
sldt word [eax]
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x43658d
cmp edx, ebx
jne 0x4366db
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x43655c
add eax, dword [eax + 4]
jmp 0x436549
mov dword [ebp + 0xc], ebx
jmp 0x4365ab
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4365c3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4365e1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x43663f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x436626
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x43662f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x436639
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x43661b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4365a5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x43668c
dec eax
je 0x436683
sub eax, 3
je 0x43667a
mov dword [ebp - 4], 0x40
jmp 0x4366a9
mov dword [ebp - 4], 4
jmp 0x43668f
mov dword [ebp - 4], 0x20
jmp 0x43668f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4366db
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x43665b
invalid
invalid
Function at 0x4365dd
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4365a0
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x43659b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x436585
and ecx, 0xfff
loope 0x436574
dec dword [edi]
add byte [eax], al
sldt word [eax]
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x43658d
cmp edx, ebx
jne 0x4366db
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x43655c
add eax, dword [eax + 4]
jmp 0x436549
mov dword [ebp + 0xc], ebx
jmp 0x4365ab
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4365c3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4365e1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x43663f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x436626
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x43662f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x436639
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x43661b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4365a5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x43668c
dec eax
je 0x436683
sub eax, 3
je 0x43667a
mov dword [ebp - 4], 0x40
jmp 0x4366a9
mov dword [ebp - 4], 4
jmp 0x43668f
mov dword [ebp - 4], 0x20
jmp 0x43668f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4366db
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x43665b
invalid
invalid

Function at 0x437342
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00435eec
shr byte [edx], 0x4e
xchg dword [eax - 0x72b5b], eax
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
jecxz 0x4373b0
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
inc dword [esp + edi*8 + 0x62]
mov ch, 0x8d
test esp, edx
clc
invalid
Function at 0x43f558
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x491b14]
test eax, eax
jne 0x43f58a
lea eax, [ebp - 8]
call fcn.0042284c
push 0
push 0xf4240
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00452fc0
mov dword [ebp - 4], edx
mov dword [0x491b14], eax
mul dword [ebp + 8]
push ebx
mov ebx, eax
mov ecx, edx
rdtsc
push esi
push edi
mov esi, eax
mov edi, edx
rdtsc
sub eax, esi
sbb edx, edi
cmp edx, ecx
jb 0x43f59a
ja 0x43f5aa
cmp eax, ebx
jb 0x43f59a
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x442dec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x46c8e4]
mov ecx, dword [ebp + 8]
sub esp, 0x1c
push ebx
mov ebx, dword [ecx + 0x18]
add eax, 0xffffffc8
push edi
cmp ebx, eax
jb 0x442e0a
mov ebx, eax
mov edi, dword [ecx + 0x10]
and dword [ebp - 0x18], 0
mov eax, dword [esi + 4]
lea edx, [edi + ebx]
xor edx, edi
mov dword [ebp - 0xc], eax
test edx, 0xfffff000
jne 0x442e37
test edi, edi
je 0x442e3b
movzx ecx, bx
push ecx
push edi
call fcn.00442c94
mov word [esi], ax
jmp 0x442eb6
test edi, edi
jne 0x442e42
xor eax, eax
mov word [esi], ax
jmp 0x442eb9
mov ecx, edi
and ecx, 0xfff
mov edx, 0x1000
sub edx, ecx
movzx ecx, dx
mov dword [ebp - 8], ecx
movzx ecx, cx
push ecx
push edi
call fcn.00442c94
mov word [esi], ax
movzx eax, word [ebp - 8]
add dword [ebp - 0xc], eax
add edi, eax
mov eax, ebx
sub eax, dword [ebp - 8]
movzx eax, ax
jmp 0x442eae
test edi, edi
je 0x442eb6
mov eax, 0x1000
mov ecx, eax
cmp cx, word [ebp - 0x10]
jb 0x442e8c
movzx eax, word [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, ax
push eax
mov eax, dword [ebp - 0xc]
push edi
call fcn.00442c94
add word [esi], ax
movzx eax, word [ebp - 8]
add dword [ebp - 0xc], eax
add edi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
test ax, ax
ja 0x442e77
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
sub ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0xc0000001
mov dword [ecx + 8], ebx
movzx eax, word [esi]
push 0x38
mov dword [ecx + 0x1c], eax
pop eax
mov word [ebp - 0x1c], ax
push esi
lea eax, [ebp - 0x1c]
push eax
push 2
mov dword [ebp - 0x18], ecx
call dword [0x491b1c]
pop edi
pop ebx
leave
ret 4
Function at 0x442eee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
push ebx
movzx ebx, word [edi + 0x18]
push esi
mov esi, dword [edi + 0x10]
push 0x38
pop eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
movzx eax, bx
lea edx, [eax + esi]
xor edx, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ecx
test edx, 0xfffff000
jne 0x442f34
push eax
push ecx
mov eax, esi
call fcn.00442c94
movzx eax, ax
jmp 0x442f96
mov eax, esi
and eax, 0xfff
mov edx, 0x1000
sub edx, eax
movzx eax, dx
mov dword [ebp - 8], eax
movzx eax, ax
push eax
push ecx
mov eax, esi
call fcn.00442c94
movzx eax, ax
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 8]
sub ebx, dword [ebp - 8]
add dword [ebp - 0xc], eax
add esi, eax
test bx, bx
jbe 0x442f93
mov eax, 0x1000
mov ecx, eax
cmp cx, bx
jb 0x442f7a
movzx eax, bx
mov dword [ebp - 8], eax
movzx eax, ax
push eax
push dword [ebp - 0xc]
mov eax, esi
call fcn.00442c94
movzx eax, ax
add dword [ebp - 0x10], eax
jmp 0x442f5a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, eax
sub edx, ecx
neg edx
sbb edx, edx
and edx, 0xc0000001
mov dword [edi + 8], edx
mov dword [edi + 0x1c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [0x491b1c]
pop esi
pop ebx
leave
ret 4

Function at 0x44b7b9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20
pop edi
push edi
call fcn.0044a2a4
mov esi, eax
test esi, esi
jl 0x44b87b
push 1
push dword [ebp + 8]
call fcn.0044b152
mov esi, eax
test esi, esi
jl 0x44b87b
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0044b0e3
mov esi, eax
test esi, esi
jl 0x44b87b
cmp word [ebp + 0x10], di
je 0x44b81b
mov esi, 0xc000000d
jmp 0x44b87b
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004446f0
add esp, 0xc
push 1
push dword [ebp + 0xc]
call fcn.0044b152
mov esi, eax
test esi, esi
jl 0x44b87b
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0044b0e3
mov esi, eax
test esi, esi
jl 0x44b87b
cmp word [ebp + 0x10], di
jne 0x44b814
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, edi
jb 0x44b858
push ebx
push edi
push dword [ebp - 4]
push 0x2000
call fcn.0044b523
mov esi, eax
cmp dword [ebp - 4], 0
je 0x44b88a
push edi
push dword [ebp - 4]
call fcn.0044a468
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44c0fb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
pop ebx
push ebx
push 0
push esi
call fcn.00450c60
push dword [ebp + 0x10]
push edi
push esi
call fcn.004446f0
add esp, 0x18
lea edi, [esi + 0x40]
push edi
call fcn.00454000
lea eax, [ebp - 0x44]
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x44]
mov dl, byte [esi + eax]
xor dl, 0x36
inc ecx
cmp ecx, ebx
mov byte [eax], dl
jl 0x44c13f
push ebx
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.00454b30
lea eax, [ebp - 0x44]
mov byte [eax], 0
inc eax
dec ebx
jne 0x44c15e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044341a
leave
ret 0xc

Function at 0x44c176
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x24]
push eax
lea esi, [ebx + 0x40]
push esi
call fcn.00454c40
push esi
call fcn.00454000
mov edi, ebx
lea eax, [ebp - 0x64]
xor ecx, ecx
sub edi, eax
lea eax, [ebp + ecx - 0x64]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
cmp ecx, 0x40
mov byte [eax], dl
jl 0x44c1b0
push 0x40
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.00454b30
push 0x20
pop edi
push edi
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00454b30
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00454c40
mov eax, dword [ebp + 0x10]
cmp eax, edi
jb 0x44c1ef
mov eax, edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x68]
call fcn.004446f0
add esp, 0xc
push 0x40
pop ecx
lea eax, [ebp - 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x44c205
mov ecx, edi
lea eax, [ebp - 0x24]
mov byte [eax], 0
inc eax
dec ecx
jne 0x44c211
mov eax, 0xa8
mov byte [ebx], 0
inc ebx
dec eax
jne 0x44c21d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044341a
leave
ret 0xc
Function at 0x44c3dd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 - 0x14]
push ebx
push esi
mov esi, dword [ecx + eax*4 - 0x10]
mov dword [ebp - 4], esi
mov esi, dword [ecx + eax*4 - 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ecx + eax*4 - 8]
lea eax, [ecx + eax*4]
push edi
mov edi, dword [eax - 4]
add eax, 0xffffffc0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 5
mov ebx, dword [ebp - 0x14]
cmp ecx, ebx
ja 0x44c4fc
sub ebx, ecx
shr ebx, 6
inc ebx
lea eax, [ecx + 8]
mov dword [ebp - 0xc], ebx
mov ebx, edx
mov edx, dword [ebp - 8]
rol ebx, 9
xor ebx, esi
add ebx, dword [eax - 8]
mov ecx, edi
xor ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ebx
add ecx, dword [eax - 4]
rol edx, 0xd
xor edx, ebx
add edx, dword [eax]
xor esi, ecx
add esi, dword [eax + 4]
mov dword [eax - 8], ebx
rol edi, 9
xor edi, edx
add edi, dword [eax + 8]
mov ebx, esi
xor ebx, dword [ebp - 0x18]
mov dword [eax], edx
add ebx, dword [eax + 0xc]
mov dword [eax - 4], ecx
xor edx, ebx
add edx, dword [eax + 0x14]
rol ecx, 0xd
xor ecx, edi
add ecx, dword [eax + 0x10]
mov dword [eax + 8], edi
xor edi, edx
add edi, dword [eax + 0x1c]
mov dword [eax + 4], esi
rol esi, 9
xor esi, ecx
add esi, dword [eax + 0x18]
mov dword [ebp - 4], ecx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, edi
xor ecx, dword [ebp - 4]
rol ebx, 0xd
add ecx, dword [eax + 0x24]
xor ebx, esi
add ebx, dword [eax + 0x20]
mov dword [eax + 0x14], edx
rol edx, 9
xor edx, ebx
add edx, dword [eax + 0x28]
mov dword [eax + 0x18], esi
xor esi, ecx
add esi, dword [eax + 0x2c]
mov dword [eax + 0x1c], edi
mov dword [ebp - 8], edx
rol edi, 0xd
xor edi, edx
add edi, dword [eax + 0x30]
mov edx, esi
xor edx, ebx
add edx, dword [eax + 0x34]
mov dword [eax + 0x20], ebx
mov ebx, dword [ebp - 8]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], edi
mov dword [eax + 0x34], edx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], esi
add eax, 0x40
dec dword [ebp - 0xc]
mov esi, edi
mov edi, dword [ebp - 0x18]
mov edx, ecx
mov dword [ebp - 4], ebx
jne 0x44c42b
mov ecx, dword [ebp + 8]
dec dword [ebp - 0x10]
jne 0x44c414
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x44c658
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx + 8]
lea eax, [ecx + eax*4 - 0x40]
push edi
mov edi, dword [ecx + 0xc]
mov dword [ebp + 8], eax
mov dword [ebp - 8], 3
mov eax, ecx
cmp ecx, dword [ebp + 8]
ja 0x44c6f8
mov edx, ebx
xor edx, esi
add dword [eax], edx
mov esi, dword [eax + 0x18]
mov edx, esi
rol edx, 0xa
xor edx, edi
add dword [eax + 4], edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebp - 4]
xor edi, edx
add dword [eax + 8], edi
lea edx, [eax + 0x20]
mov dword [ebp - 0xc], edx
mov edx, dword [edx]
mov edi, edx
rol edi, 0x19
xor edi, ebx
add dword [eax + 0xc], edi
mov edi, dword [eax + 0x24]
xor edi, esi
add dword [eax + 0x10], edi
mov esi, dword [eax + 0x28]
mov ebx, dword [eax + 0x34]
mov edi, esi
rol edi, 0xa
xor edi, dword [eax + 0x1c]
add dword [eax + 0x14], edi
mov edi, dword [eax + 0x2c]
xor edx, edi
add edx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [eax + 0x30]
mov dword [ebp - 4], edx
rol edx, 0x19
xor edx, dword [eax + 0x24]
add edx, dword [eax + 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jbe 0x44c68a
mov edx, ebx
xor edx, esi
add dword [eax], edx
mov esi, dword [eax + 0x18]
mov edx, esi
rol edx, 0xa
xor edx, edi
add dword [eax + 4], edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebp - 4]
xor edi, edx
add dword [eax + 8], edi
mov edx, dword [ecx]
mov edi, edx
rol edi, 0x19
xor edi, ebx
add dword [eax + 0xc], edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0xc], edi
xor edi, esi
add dword [eax + 0x10], edi
mov esi, dword [ecx + 8]
mov edi, esi
rol edi, 0xa
xor edi, dword [eax + 0x1c]
add dword [eax + 0x14], edi
mov edi, dword [ecx + 0xc]
xor edx, edi
add edx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x10]
mov dword [ebp - 4], edx
rol edx, 0x19
xor edx, dword [ebp - 0xc]
add edx, dword [eax + 0x1c]
dec dword [ebp - 8]
mov dword [eax + 0x1c], edx
mov ebx, dword [ecx + 0x14]
jne 0x44c683
pop edi
pop esi
pop ebx
leave
ret 4