joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417cc0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x24c
mov eax, dword [0x5f1cf8]
xor eax, esp
mov dword [esp + 0x248], eax
mov eax, dword [esp + 0x254]
test eax, eax
push ebx
mov ebx, dword [esp + 0x25c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x260]
mov esi, 1
je 0x417d0f
push 2
push 0xb
push eax
push edi
call fcn.00417830
mov esi, eax
add esp, 0x10
cmp esi, 1
jne 0x417ddd
test ebx, ebx
je 0x417ddd
push 0x101
lea eax, [esp + 0x154]
push ebx
push eax
call fcn.00464690
push 3
lea ecx, [esp + 0x160]
push 0x4c249c
push ecx
call fcn.0046aad0
add esp, 0x18
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x417d65
mov eax, 0xfffffffa
jmp 0x417ddf
cmp dword [esp + 0x10], 0x10
je 0x417dc1
push 0x82
lea ecx, [esp + 0x154]
push ebx
push ecx
call fcn.00464690
push 2
lea edx, [esp + 0x160]
push 0x4c0b70
push edx
call fcn.0046aad0
push 0x80
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x170]
push ecx
call fcn.0046aad0
push 2
push 0xb
lea edx, [esp + 0x17c]
push edx
push edi
call fcn.00417830
add esp, 0x34
mov esi, eax
cmp esi, 1
jne 0x417dd6
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417d65
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00463f56
add esp, 0x24c
ret

Function at 0x418c50
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
mov eax, dword [0x5f1cf8]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x62c020]
test eax, eax
jne 0x418cc9
mov ax, word [0x4c26a4]
mov cl, byte [0x4c26a6]
push esi
push edi
push 7
lea edx, [esp + 0xe]
push edx
mov word [esp + 0x10], ax
xor eax, eax
push 0x1004
push 0x800
mov byte [esp + 0x1a], cl
mov dword [esp + 0x1b], eax
mov word [esp + 0x1f], ax
mov byte [esp + 0x21], al
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov edi, str.cp932
lea esi, [esp + 8]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
mov eax, 0x51b410
je 0x418cc4
mov eax, 0x4df198
mov dword [0x62c020], eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00463f56
add esp, 0x10
ret

Function at 0x419260
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push eax
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esi + 1]
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x4192a6
xor eax, eax
add esp, 0x10c
ret
je 0x4192c3
lea eax, [esp + 8]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 0x10c
ret
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 0x10c
ret
Function at 0x419e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov ecx, dword [ebp + 0x10]
sub esp, 0x34
test ecx, ecx
push ebx
push esi
push edi
je 0x419f23
cmp byte [ecx], 0
je 0x419f30
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [ebx + 8]
mov dword [esp + 0x1c], eax
mov eax, ecx
lea edx, [eax + 1]
mov esi, edi
mov dword [esp + 0x14], edx
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x419e68
sub eax, dword [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x28]
push eax
call fcn.00419d40
push 8
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.00419d40
mov edx, dword [esp + 0x30]
xor edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
xor eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00419cc0
mov eax, dword [esp + 0x40]
add esp, 0x24
cmp ebx, eax
jae 0x419eea
sub eax, ebx
mov ebx, eax
lea edx, [esp + 0x28]
push edx
call fcn.00419d00
fmul qword [0x4c26e0]
push ecx
fstp qword [esp]
call fcn.00466d60
fadd qword [0x4c26d8]
add esp, 8
call fcn.00466cb0
mov byte [edi], al
add edi, 1
sub ebx, 1
jne 0x419eb9
lea eax, [esp + 0x28]
push eax
call fcn.00419d00
fmul qword [0x4c26e0]
push ecx
fstp qword [esp]
call fcn.00466d60
add esp, 8
call fcn.00466cb0
cmp esi, edi
je 0x419f19
nop
xor byte [esi], al
add esi, 1
cmp esi, edi
jne 0x419f10
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
pop edi
pop esi
mov byte [edx], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a2e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [eax + edx]
cmp eax, edi
jae 0x41a303
lea ecx, [ecx]
mov dl, byte [eax]
xor dl, byte [esi]
add eax, 1
mov byte [ecx], dl
add ecx, 1
add esi, 1
cmp eax, edi
jb 0x41a2f0
pop edi
pop esi
ret

Function at 0x41b550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x62ce98]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x41b5b4
cmp byte [esi + 0x60], 0
je 0x41b5b4
lea ecx, [esi + 4]
push ecx
call fcn.00411a50
add esp, 4
lea edx, [esi + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.0046672a
add esp, 4
push 0x62cca0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [0x62c028], 1
jne 0x41b5a9
push 0x62cd80
call fcn.00411b80
add esp, 4
push 0x62cca0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x62ce98]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x41b610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x62ce98]
push ebx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x41b6a2
push esi
push 0x70
push 1
call fcn.0046ad23
mov esi, eax
add esp, 8
test esi, esi
jne 0x41b63b
pop esi
mov al, 1
pop ebx
ret
mov ecx, dword [0x62ce98]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0041b5d0
mov edx, dword [eax + 0x50]
lea eax, [esi + 0x30]
push eax
mov dword [esi + 0x50], edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 4]
push 0
push ecx
call fcn.004119f0
add esp, 8
push 0x62cca0
mov byte [esi + 0x60], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x62c02c]
add eax, 1
mov dword [esi + 0x54], eax
add dword [0x62c028], 1
push 0x62cca0
mov dword [0x62c02c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov al, bl
pop ebx
ret

Function at 0x41b6b0
Capabilities:
Allocate thread local storage

Disassembly:
call fcn.0041b600
mov dword [0x62bc08], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x62ce98], eax
mov eax, ecx
test eax, eax
je 0x41b6ed
push eax
push str.Cant_initialize_threads:_error__d_n
call fcn.00463ceb
add eax, 0x40
push eax
call fcn.00463b1e
add esp, 0xc
mov al, 1
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x62cdc0
call esi
push 0x62ce40
call esi
push 0x62ce80
call esi
push 0x62cde0
call esi
push 0x62ce00
call esi
push 0x62cd40
call esi
push 0x62ce20
call esi
push 0x62cec0
call esi
push 0x62ce60
call esi
push 0x62cca0
call esi
push 0x62cd60
call esi
push 0
push 0x62cd80
call fcn.004119f0
add esp, 8
call fcn.00411cd0
push 0x62cea0
call esi
push 0x62cd20
call esi
call fcn.0041b610
test al, al
pop esi
je 0x41b775
call fcn.0041b440
mov al, 1
ret
xor al, al
ret
Function at 0x426b30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00426b10
mov edi, dword [esp + 0x10]
cmp edi, 0x40
mov eax, dword [esp + 0xc]
ja 0x426b55
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00466080
add esp, 0xc
jmp 0x426b77
mov edx, dword [esi + 0x10]
mov edx, dword [edx + 4]
push ebx
lea ebx, [esi + 0x10]
push edi
push eax
mov ecx, ebx
call edx
mov ecx, dword [esi]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push ecx
mov ecx, ebx
call edx
mov edi, 0x10
pop ebx
mov ecx, dword [esi]
mov eax, 0x40
sub eax, edi
push eax
add ecx, edi
push 0
push ecx
call fcn.00464b40
add esp, 0xc
xor eax, eax
mov edx, dword [esi]
movzx ecx, byte [edx + eax]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [eax + edx], cl
mov ecx, dword [esi]
xor byte [ecx + eax], 0x36
mov edx, dword [esi]
add ecx, eax
movzx ecx, byte [edx + eax + 1]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 1], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 1], 0x36
mov edx, dword [esi]
lea ecx, [ecx + eax + 1]
movzx ecx, byte [edx + eax + 2]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 2], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 2], 0x36
mov edx, dword [esi]
lea ecx, [ecx + eax + 2]
movzx ecx, byte [edx + eax + 3]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 3], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 3], 0x36
lea ecx, [ecx + eax + 3]
add eax, 4
cmp eax, 0x40
jb 0x426b90
pop edi
pop esi
ret 8

Function at 0x426c30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00426c10
mov edi, dword [esp + 0x10]
cmp edi, 0x40
mov eax, dword [esp + 0xc]
ja 0x426c55
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00466080
add esp, 0xc
jmp 0x426c77
mov edx, dword [esi + 0x10]
mov edx, dword [edx + 4]
push ebx
lea ebx, [esi + 0x10]
push edi
push eax
mov ecx, ebx
call edx
mov ecx, dword [esi]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push ecx
mov ecx, ebx
call edx
mov edi, 0x14
pop ebx
mov ecx, dword [esi]
mov eax, 0x40
sub eax, edi
push eax
add ecx, edi
push 0
push ecx
call fcn.00464b40
add esp, 0xc
xor eax, eax
mov edx, dword [esi]
movzx ecx, byte [edx + eax]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [eax + edx], cl
mov ecx, dword [esi]
xor byte [ecx + eax], 0x36
mov edx, dword [esi]
add ecx, eax
movzx ecx, byte [edx + eax + 1]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 1], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 1], 0x36
mov edx, dword [esi]
lea ecx, [ecx + eax + 1]
movzx ecx, byte [edx + eax + 2]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 2], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 2], 0x36
mov edx, dword [esi]
lea ecx, [ecx + eax + 2]
movzx ecx, byte [edx + eax + 3]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 3], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 3], 0x36
lea ecx, [ecx + eax + 3]
add eax, 4
cmp eax, 0x40
jb 0x426c90
pop edi
pop esi
ret 8
Function at 0x426d30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00426d10
mov edi, dword [esp + 0x10]
cmp edi, 0x40
mov eax, dword [esp + 0xc]
ja 0x426d55
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00466080
add esp, 0xc
jmp 0x426d77
mov edx, dword [esi + 0x10]
mov edx, dword [edx + 4]
push ebx
lea ebx, [esi + 0x10]
push edi
push eax
mov ecx, ebx
call edx
mov ecx, dword [esi]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push ecx
mov ecx, ebx
call edx
mov edi, 0x14
pop ebx
mov ecx, dword [esi]
mov eax, 0x40
sub eax, edi
push eax
add ecx, edi
push 0
push ecx
call fcn.00464b40
add esp, 0xc
xor eax, eax
mov edx, dword [esi]
movzx ecx, byte [edx + eax]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [eax + edx], cl
mov ecx, dword [esi]
xor byte [ecx + eax], 0x36
mov edx, dword [esi]
add ecx, eax
movzx ecx, byte [edx + eax + 1]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 1], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 1], 0x36
mov edx, dword [esi]
lea ecx, [ecx + eax + 1]
movzx ecx, byte [edx + eax + 2]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 2], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 2], 0x36
mov edx, dword [esi]
lea ecx, [ecx + eax + 2]
movzx ecx, byte [edx + eax + 3]
mov edx, dword [esi + 4]
xor cl, 0x5c
mov byte [edx + eax + 3], cl
mov ecx, dword [esi]
xor byte [ecx + eax + 3], 0x36
lea ecx, [ecx + eax + 3]
add eax, 4
cmp eax, 0x40
jb 0x426d90
pop edi
pop esi
ret 8
Function at 0x429b60
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
Function at 0x4317a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
test ebx, ebx
jbe 0x4317e2
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov ecx, dword [esp + 0x1c]
push 0xfeedbeef
call fcn.00439b50
push 0xfeedbeef
mov ecx, ebp
mov edi, eax
call fcn.00439b50
mov cl, byte [edi]
xor cl, byte [eax]
mov edx, dword [esp + 0x14]
mov byte [esi + edx], cl
add esi, 1
cmp esi, ebx
jb 0x4317b2
pop edi
pop ebp
pop esi
pop ebx
ret

Function at 0x437e60
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 0x24], cx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
xor eax, eax
ret
Function at 0x441eb0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
Function at 0x447860
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
Function at 0x44a580
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov ecx, eax
or ecx, esi
or ecx, edx
test cl, 3
jne 0x44a5b0
shr edx, 2
je 0x44a5cd
mov ecx, esi
sub ecx, eax
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
sub edx, 1
jne 0x44a5a1
pop esi
ret
test edx, edx
jbe 0x44a5cd
mov ecx, esi
sub ecx, eax
mov esi, edx
lea ebx, [ebx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x44a5c0
pop esi
ret

Function at 0x44a9d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using des

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
add ecx, 8
mov edi, 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx - 8]
add ecx, 0x10
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4c5600]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5800]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5a00]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4c5c00]
mov eax, dword [ecx - 0x14]
xor edx, ebx
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4c5700]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5900]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5b00]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4c5d00]
xor edx, ebx
mov eax, edx
ror eax, 4
xor eax, dword [ecx - 0x10]
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4c5600]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5800]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5a00]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4c5c00]
mov eax, dword [ecx - 0xc]
xor esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4c5700]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5900]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4c5b00]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4c5d00]
xor esi, ebx
sub edi, 1
jne 0x44a9e8
mov ecx, dword [esp + 0x14]
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x44c657
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
cmp byte [0x62c071], 0
push esi
mov esi, ecx
jne 0x44c6af
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x44c67d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00425da0
pop esi
ret 0xc
cmp eax, 1
jne 0x44c786
cmp dword [esi + 0x30], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
jne 0x44c6a6
call fcn.00425df0
pop esi
ret 0xc
call fcn.00425e60
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
shr ebx, 3
cmp dword [esi + 0x34], 1
push edi
jne 0x44c75c
cmp dword [esi + 0x30], 0
jne 0x44c717
test ebx, ebx
je 0x44c783
mov ebp, dword [esp + 0x18]
lea edi, [esi + 0x10]
mov eax, dword [ebp]
xor dword [edi], eax
mov ecx, dword [ebp + 4]
xor dword [esi + 0x14], ecx
push 0x4c5600
push edi
push edi
mov ecx, esi
sub ebx, 1
call fcn.0044ab10
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov dword [eax], edx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
add eax, 8
add ebp, 8
test ebx, ebx
mov dword [esp + 0x14], eax
jne 0x44c6d8
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
test ebx, ebx
je 0x44c783
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push 0x4c5600
push edi
push ebp
mov ecx, esi
sub ebx, 1
call fcn.0044ab10
mov edx, dword [esi + 0x10]
xor dword [edi], edx
mov eax, dword [esi + 0x14]
xor dword [edi + 4], eax
mov ecx, dword [ebp]
mov dword [esi + 0x10], ecx
mov edx, dword [ebp + 4]
add edi, 8
add ebp, 8
test ebx, ebx
mov dword [esi + 0x14], edx
jne 0x44c723
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
test ebx, ebx
je 0x44c783
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push 0x4c5600
push edi
push ebp
mov ecx, esi
sub ebx, 1
call fcn.0044ab10
add edi, 8
add ebp, 8
test ebx, ebx
jne 0x44c768
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
Function at 0x44d197
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x62c071], 0
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
jne 0x44d1ef
test eax, eax
jne 0x44d1bd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00425da0
pop esi
ret 0xc
cmp eax, 1
jne 0x44d31f
cmp dword [esi + 0x30], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
jne 0x44d1e6
call fcn.00425df0
pop esi
ret 0xc
call fcn.00425e60
pop esi
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
shr ebp, 4
test eax, eax
push edi
jne 0x44d24b
test ebp, ebp
je 0x44d31c
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
lea ecx, [ecx]
sub ebp, 1
cmp dword [esi + 0x30], 0
jne 0x44d22a
mov eax, dword [0x51cee4]
push eax
push edi
push ebx
mov ecx, esi
call fcn.0044cbb0
jmp 0x44d23a
mov ecx, dword [0x51cef8]
push ecx
push edi
push ebx
mov ecx, esi
call fcn.0044ce70
add edi, 0x10
add ebx, 0x10
test ebp, ebp
jne 0x44d210
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
cmp eax, 1
jne 0x44d31c
cmp dword [esi + 0x30], 0
jne 0x44d2c6
test ebp, ebp
je 0x44d31c
mov ebx, dword [esp + 0x14]
lea edi, [esi + 0x10]
lea esp, [esp]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor dword [edi], edx
mov ecx, dword [eax + 4]
xor dword [esi + 0x14], ecx
mov edx, dword [eax + 8]
xor dword [esi + 0x18], edx
mov eax, dword [eax + 0xc]
xor dword [esi + 0x1c], eax
mov ecx, dword [0x51cee4]
push ecx
push edi
push edi
mov ecx, esi
sub ebp, 1
call fcn.0044cbb0
mov edx, dword [edi]
add dword [esp + 0x18], 0x10
mov dword [ebx], edx
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov ecx, dword [edi + 8]
mov dword [ebx + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [ebx + 0xc], edx
add ebx, 0x10
test ebp, ebp
jne 0x44d270
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
test ebp, ebp
je 0x44d31c
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [0x51cef8]
push eax
push edi
push ebx
mov ecx, esi
sub ebp, 1
call fcn.0044ce70
mov ecx, dword [esi + 0x10]
xor dword [edi], ecx
mov edx, dword [esi + 0x14]
xor dword [edi + 4], edx
mov eax, dword [esi + 0x18]
xor dword [edi + 8], eax
mov ecx, dword [esi + 0x1c]
xor dword [edi + 0xc], ecx
mov edx, dword [ebx]
mov dword [esi + 0x10], edx
mov eax, dword [ebx + 4]
mov dword [esi + 0x14], eax
mov ecx, dword [ebx + 8]
mov dword [esi + 0x18], ecx
mov edx, dword [ebx + 0xc]
add edi, 0x10
add ebx, 0x10
test ebp, ebp
mov dword [esi + 0x1c], edx
jne 0x44d2d2
pop edi
pop ebp
pop ebx
pop esi
ret 0xc

Function at 0x44e500
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x44e521
mov dword [esi + 4], 0x3ea
pop esi
ret 8
Function at 0x44e660
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movd mm3, edi
movd mm4, ebx
movd mm5, esi
movd mm6, ebp
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebp, dword [ebp + 0x10]
sub esp, 4
cmp ebp, 0
je 0x44e6d0
mov dword [esp], ebp
movzx edx, byte [ecx + 1]
lea ebp, [ecx + 2]
movzx ecx, byte [ecx]
movzx eax, byte [ebp + ecx]
add edx, eax
and edx, 0xff
movzx ebx, byte [ebp + edx]
mov byte [ebp + ecx], bl
mov byte [ebp + edx], al
inc ecx
and ecx, 0xff
add eax, ebx
and eax, 0xff
movzx ebx, byte [ebp + eax]
movzx eax, byte [ebp + ecx]
xor bl, byte [esi]
inc esi
mov byte [edi], bl
inc edi
dec dword [esp]
jne 0x44e692
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
movd ebp, mm6
movd esi, mm5
movd ebx, mm4
movd edi, mm3
mov esp, ebp
pop ebp
emms
ret 0xc