joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4381ca
Capabilities:
Access peb ldr_data
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x63ae80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi + 0x98], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
or eax, 0xffffffff
lea ebx, [esi + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov byte [esi + 0x48], 1
mov dword [esi + 0x14], 4
call fcn.00419e50
mov ecx, dword [esi + 0x30]
xor ebx, ebx
mov dword [esi + 0x34], ebx
mov byte [ecx], bl
mov edx, dword [esi + 0x3c]
xor eax, eax
mov dword [esi + 0x40], ebx
lea edi, [esi + 0x18]
mov word [edx], ax
call fcn.0042cec0
mov ebx, dword [ebp + 0x10]
xor edi, edi
lea ebx, [ebx]
cmp edi, dword [ebp + 0x14]
jae 0x438277
mov eax, dword [ebp + 0xc]
mov ecx, edi
shl ecx, 4
add ecx, ebx
push ecx
mov ecx, dword [eax + edi*4]
lea edx, [esi + 4]
push edx
call fcn.0042ca10
test eax, eax
jne 0x4383c2
inc edi
jmp 0x438250
cmp dword [esi + 0x34], 0
je 0x4382fc
mov dword [ebp + 8], 0
mov ecx, dword [ebp + 8]
cmp ecx, 9
jae 0x4382dc
mov eax, dword [esi + 0x30]
mov edx, dword [ecx*8 + 0x60ecb4]
mov edi, eax
mov cl, byte [edi]
mov al, byte [edx]
inc edx
inc edi
mov dword [ebp + 0x10], edx
cmp cl, al
je 0x4382c5
lea edx, [ecx - 0x41]
cmp dl, 0x19
ja 0x4382b2
lea edx, [ecx + 0x20]
jmp 0x4382b4
mov dl, cl
lea ebx, [eax - 0x41]
cmp bl, 0x19
ja 0x4382be
add al, 0x20
cmp dl, al
jne 0x4382f7
mov edx, dword [ebp + 0x10]
test cl, cl
jne 0x438298
mov ecx, dword [ebp + 8]
mov eax, dword [ecx*8 + 0x60ecb0]
mov dword [esi + 0x98], eax
cmp ecx, 9
jne 0x4382fc
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
inc dword [ebp + 8]
jmp 0x438284
xor edi, edi
mov edi, edi
cmp edi, dword [esi + 0x1c]
jae 0x43831a
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx + edi*4]
cmp dword [eax + 0x10], 0
jne 0x43831a
cmp dword [eax + 4], 0
jne 0x43831a
inc edi
jmp 0x438300
lea ebx, [esi + 0x18]
push ebx
call fcn.004342e0
mov esi, dword [esi + 0x1c]
cmp esi, 1
ja 0x4382de
jne 0x4383c0
mov edx, dword [ebx]
mov edi, dword [edx]
cmp dword [edi + 0x10], 0
jne 0x4383ab
xor esi, esi
lea ecx, [ecx]
cmp byte [esi + str.LZMA2], 0
je 0x43834c
inc esi
jmp 0x438340
cmp esi, dword [edi + 0x14]
jbe 0x438371
lea eax, [esi + 1]
push eax
call fcn.004a4d50
mov ecx, dword [edi + 0xc]
add esp, 4
push ecx
mov ebx, eax
call fcn.004a4d8a
add esp, 4
mov dword [edi + 0xc], ebx
mov dword [edi + 0x14], esi
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x10], esi
mov edx, str.LZMA2
lea esp, [esp]
mov al, byte [edx]
mov byte [ecx], al
inc ecx
inc edx
test al, al
jne 0x438380
jmp 0x4383c0
mov ecx, dword [edi + 0xc]
mov eax, str.LZMA2
call fcn.0040ece0
test al, al
je 0x4382de
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43a4a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3e9d
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x63ae80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [esi + 0x2c], vtable.CFilterCoder.11.0
mov dword [esi + 0x30], vtable.CFilterCoder.12.0
mov dword [esi + 0x34], vtable.CFilterCoder.13.0
mov dword [esi + 0x38], vtable.CFilterCoder.14.0
mov dword [ebp - 4], 8
mov eax, dword [esi + 0x94]
test eax, eax
je 0x43a547
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 7
mov eax, dword [esi + 0x90]
test eax, eax
je 0x43a55d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x43a573
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x88]
test eax, eax
je 0x43a589
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x84]
test eax, eax
je 0x43a59f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x80]
test eax, eax
je 0x43a5b5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x43a5c8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x43a5db
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 0
mov eax, dword [esi + 0x68]
test eax, eax
je 0x43a5ee
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
mov esi, dword [esi + 0x40]
test esi, esi
je 0x43a60a
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43b570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov eax, dword [ecx]
lea edi, [ecx + edx*4 + 8]
test ebx, ebx
je 0x43b5ff
cmp eax, 0x10
je 0x43b5a2
mov dl, byte [edi + eax]
xor byte [esi], dl
inc eax
inc esi
dec ebx
je 0x43b59f
cmp eax, 0x10
jne 0x43b590
mov dword [ebp + 0xc], ebx
cmp ebx, 0x10
jb 0x43b5c9
shr ebx, 4
push ebx
lea ecx, [edi + 0x10]
mov edx, esi
call dword [0x64a324]
mov ecx, dword [ebp + 8]
shl ebx, 4
add esi, ebx
sub dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x10
xor edx, edx
cmp ebx, edx
je 0x43b5fd
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
push 1
lea ecx, [edi + 0x10]
mov edx, edi
call dword [0x64a324]
xor eax, eax
sub edi, esi
jmp 0x43b5f0
mov cl, byte [edi + esi]
xor byte [esi], cl
inc eax
inc esi
dec ebx
jne 0x43b5f0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43b690
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
ret

Function at 0x43b6c0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push esi
push edi
push 0x40
mov esi, ecx
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.005a9d60
mov edi, esi
lea edx, [ebp - 0x4c]
add esp, 0xc
xor ecx, ecx
sub edi, edx
lea eax, [ebp + ecx - 0x4c]
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [esi + ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [esi + ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [esi + ecx + 3]
xor byte [eax + 3], dl
movzx edx, byte [esi + ecx + 4]
xor byte [eax + 4], dl
add ecx, 5
cmp ecx, 0x14
jb 0x43b6f3
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov eax, 0x40
lea ecx, [ebp - 0x4c]
lea edi, [ebp - 0xac]
mov dword [ebp - 0xac], 0x67452301
mov dword [ebp - 0xa8], 0xefcdab89
mov dword [ebp - 0xa4], 0x98badcfe
mov dword [ebp - 0xa0], 0x10325476
mov dword [ebp - 0x9c], 0xc3d2e1f0
call fcn.0045c250
mov eax, ebx
mov esi, edi
call fcn.0045c380
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
Function at 0x43b800
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x63ae80]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 4], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
lea edi, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
call fcn.0045c250
lea eax, [esp + 0x70]
mov esi, edi
call fcn.0045c380
push 0x36
lea ebx, [esp + 0x88]
lea ecx, [esp + 0x74]
call fcn.0043b6c0
add esp, 4
push 0x5c
lea ebx, [esp + 0x9c]
lea ecx, [esp + 0x74]
call fcn.0043b6c0
mov edi, dword [esp + 0x10]
add esp, 4
mov ecx, 8
lea esi, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret 8

Function at 0x43bcb0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, 0x12345678
mov ecx, 0x23456789
mov edx, 0x34567890
test edi, edi
je 0x43bd12
push ebx
mov edi, edi
mov ebx, dword [ebp + 0xc]
movzx ebx, byte [esi + ebx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x64a340]
inc esi
movzx ebx, al
add ecx, ebx
imul ecx, ecx, 0x8088405
inc ecx
mov ebx, ecx
shr ebx, 0x18
xor ebx, edx
and ebx, 0xff
shr edx, 8
xor edx, dword [ebx*4 + 0x64a340]
cmp esi, edi
jb 0x43bcd0
pop ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], eax
pop edi
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x43bde0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ecx + 0xc]
push ebx
mov ebx, dword [ecx + 0x10]
push esi
mov esi, dword [ecx + 0x14]
push edi
xor edi, edi
test eax, eax
je 0x43be62
mov ecx, dword [ebp + 0xc]
nop
mov al, byte [edi + ecx]
mov byte [ebp - 1], al
mov ecx, esi
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [ebp + 0xc]
shr eax, 8
xor al, byte [ebp - 1]
inc edi
mov byte [edi + ecx - 1], al
movzx eax, byte [ebp - 1]
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x64a340]
movzx eax, dl
add ebx, eax
imul ebx, ebx, 0x8088405
inc ebx
mov eax, ebx
shr eax, 0x18
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x64a340]
mov eax, dword [ebp + 0x10]
cmp edi, eax
jb 0x43be00
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx + 0x14], esi
pop esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0xc], edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43be80
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ecx + 0xc]
push ebx
mov ebx, dword [ecx + 0x10]
push esi
mov esi, dword [ecx + 0x14]
push edi
xor edi, edi
test eax, eax
je 0x43bf00
jmp 0x43bea0
mov ecx, esi
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [ebp + 0xc]
shr eax, 8
xor al, byte [edi + ecx]
inc edi
movzx ecx, al
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x64a340]
movzx ecx, dl
add ebx, ecx
imul ebx, ebx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x64a340]
mov ecx, dword [ebp + 0xc]
mov byte [edi + ecx - 1], al
mov eax, dword [ebp + 0x10]
cmp edi, eax
jb 0x43bea0
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx + 0x14], esi
pop esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0xc], edx
pop ebx
pop ebp
ret 0xc
Function at 0x43ca30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d4368
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push edi
mov eax, dword [0x63ae80]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ecx
lea edx, [esp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov edi, eax
mov ax, word [esp + 0xc]
test edi, edi
je 0x43cad1
test ax, ax
je case.0x43caac.0
movzx eax, ax
cmp eax, 0x40
ja case.0x43caac.1
movzx ecx, byte [eax + 0x43cb24]
jmp dword [ecx*4 + 0x43cb1c]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
cmp ax, 0x40
jne 0x43caf7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
test ax, ax
je 0x43cae4
lea ecx, [esp + 0xc]
call fcn.004101d0
mov eax, 0x80070057
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43e990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 8
push esi
mov esi, dword [ecx]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0x43e9af
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 0xc], 5
push ebx
mov ebx, dword [ebp + 8]
sub eax, 4
add ebx, eax
mov dword [ebp - 8], ebx
nop
mov eax, dword [ebp + 8]
lea edx, [edi + eax]
cmp edx, ebx
jae 0x43e9df
lea ebx, [ebx]
mov cl, byte [edx]
and cl, 0xfe
cmp cl, 0xe8
je 0x43e9df
inc edx
cmp edx, ebx
jb 0x43e9d0
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, eax
sub edi, eax
cmp edx, ebx
jae 0x43eab5
cmp ecx, 2
jbe 0x43ea33
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x43ea52
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
add ecx, edi
add edi, 5
cmp dword [ebp + 0x14], 0
mov dword [ebp - 4], ecx
je 0x43ea5d
add eax, ecx
jmp 0x43ea5f
shr esi, cl
test esi, esi
je 0x43e9f8
cmp esi, 4
ja 0x43ea52
cmp esi, 3
je 0x43ea52
mov eax, esi
shr eax, 1
movzx ecx, byte [eax + edx + 1]
inc ecx
test cl, 0xfe
jne 0x43e9f8
or esi, 8
shr esi, 1
inc edi
jmp 0x43e9c0
sub eax, ecx
test esi, esi
je 0x43ea93
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x43ea8e
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [ebp + 0x14], 0
je 0x43ea8b
add eax, dword [ebp - 4]
jmp 0x43ea8e
sub eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x43e9c0
pop ebx
cmp ecx, 2
jbe 0x43eaca
mov edx, dword [ebp + 0x10]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43eae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.005a9bc4
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x43eb07
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43eb16
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x43f9b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x34], edx
mov byte [eax + 0x1f], dl
mov dword [eax + 0x24], edx
mov dword [eax + 0x30], 0x20
mov dword [eax + 0x48], 4
mov word [eax + 0x1d], 1
lea esi, [eax + 0x60]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x43f9d3
pop esi
ret

Function at 0x444b30
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x444b40
pop edi
pop ebx
ret

Function at 0x444b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
push edi
or ecx, edx
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 8
add ebx, edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
shr edi, 4
sar ebx, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add ecx, ecx
mov edi, ecx
xor edi, esi
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x444b81
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x444e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [ebp - 0xc], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0x14], ecx
xor edx, edx
jmp 0x444e80
cmp edx, dword [ebp + 0x10]
jae 0x444fa0
mov eax, edx
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x444ec9
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 4]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x444e98
add edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x444e80
cmp edx, 0x10
jae 0x444f4a
lea eax, [edx - 8]
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jae 0x444fa0
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x444f34
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 0x104]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x444f00
add edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, 0x10
jb 0x444ee3
cmp edx, dword [ebp + 0x10]
jae 0x444fa0
lea eax, [edx - 0x10]
mov dword [ebp - 8], eax
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x444f8a
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp + 8]
mov eax, ecx
cmp eax, 1
jne 0x444f61
add edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jb 0x444f55
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 0x325c8]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea ebx, [ebx]
xor edx, edx
lea ecx, [edx + 1]
mov dword [ebp - 4], 4
lea esp, [esp]
movzx ebx, word [edi + ecx*2 + 0x32c4c]
mov eax, esi
and eax, 1
mov edi, eax
neg edi
sar edi, 4
and edi, 0x7f
shr ebx, 4
xor ebx, edi
mov edi, dword [ebp + 8]
add edx, dword [edi + ebx*4 + 0x30f34]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [ebp - 4]
jne 0x446990
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp esi, 0x10
jb 0x446980
mov dword [edi + 0x84], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4469f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 4
mov dword [ebp - 0x208], edi
movzx ebx, byte [edx + edi + 0x30734]
mov ecx, ebx
mov esi, ebx
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 1
sub edi, esi
mov dword [ebp - 0x214], ecx
test ecx, ecx
je 0x446aa3
jmp 0x446a56
mov ebx, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x210]
sub ecx, ebx
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b66]
mov eax, edi
and eax, 1
mov ebx, eax
neg ebx
shr ecx, 4
sar ebx, 4
and ebx, 0x7f
xor ecx, ebx
mov ecx, dword [edx + ecx*4 + 0x30f34]
add dword [ebp - 0x20c], ecx
mov ecx, dword [ebp - 0x210]
add ecx, ecx
or ecx, eax
shr edi, 1
dec dword [ebp - 0x214]
mov dword [ebp - 0x210], ecx
jne 0x446a50
mov edi, dword [ebp - 0x208]
mov eax, dword [ebp - 0x20c]
mov dword [ebp + edi*4 - 0x204], eax
inc edi
mov dword [ebp - 0x208], edi
cmp edi, 0x80
jb 0x446a11
lea esi, [ebp - 0x204]
sub esi, edx
lea ecx, [edx + 0x32968]
lea ebx, [edx + 0x31dd0]
sub esi, 0x31dc8
lea edi, [edx + 0x319c8]
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], 4
jmp 0x446b10
xor ecx, ecx
mov dword [ebp - 0x214], ecx
cmp dword [edx + 0x88], ecx
jbe 0x446b80
mov eax, ecx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x446b68
lea esp, [esp]
mov ebx, dword [ebp - 0x208]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebx, 4
xor ebx, eax
add esi, dword [edx + ebx*4 + 0x30f34]
mov eax, ecx
cmp eax, 1
jne 0x446b30
mov ebx, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x214]
mov dword [edi + ecx*4], esi
inc ecx
mov dword [ebp - 0x214], ecx
cmp ecx, dword [edx + 0x88]
jb 0x446b20
mov esi, dword [ebp - 0x210]
mov eax, 0xe
cmp dword [edx + 0x88], eax
jbe 0x446ba6
lea ecx, [ecx]
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x88]
jb 0x446b90
mov eax, dword [edi]
mov dword [ebx - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebx - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebx], eax
mov ecx, dword [edi + 0xc]
mov dword [ebx + 4], ecx
mov eax, 4
lea ecx, [ebx + 8]
jmp 0x446bd0
movzx ebx, byte [edx + eax + 0x30734]
mov ebx, dword [edi + ebx*4]
add ebx, dword [esi + ecx]
inc eax
mov dword [ecx], ebx
add ecx, 4
cmp eax, 0x80
jb 0x446bd0
mov ebx, dword [ebp - 0x20c]
sub dword [ebp - 0x208], 0xffffff80
add ebx, 0x200
sub esi, 0x200
add edi, 0x100
dec dword [ebp - 0x218]
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], esi
jne 0x446b10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [edx + 0x80], 0
pop ebx
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret