joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443d31
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
mov edi, 0x2911
push edi
push 0xd
mov eax, esi
xor eax, 0x1fff
push eax
push edi
push 0xd
push eax
push eax
call fcn.00443d00
add esp, 0x10
push eax
call fcn.00443d00
add esp, 0x10
mov byte [esi + 0x49ac40], al
inc esi
cmp esi, 0x2000
jb 0x443d3a
xor esi, esi
mov edi, 0xaa7
push edi
push 0xb
mov eax, esi
xor eax, 0x7ff
push eax
push edi
push 0xb
push eax
push eax
call fcn.00443d00
add esp, 0x10
push eax
call fcn.00443d00
add esp, 0x10
mov byte [esi + 0x49a440], al
inc esi
cmp esi, 0x800
jb 0x443d71
pop edi
xor eax, eax
pop esi
mov ecx, eax
and ecx, 0xfffffff8
shl ecx, 7
mov edx, eax
and edx, 4
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 2
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 1
or ecx, edx
shl ecx, 7
mov dword [eax*8 + 0x499c40], ecx
mov ecx, eax
and ecx, 0xffffff80
shl ecx, 7
mov edx, eax
and edx, 0x40
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x20
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x10
or ecx, edx
shl ecx, 3
mov dword [eax*8 + 0x499c44], ecx
inc eax
cmp eax, 0x100
jb 0x443da5
ret
Function at 0x446da8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
lea ebx, [edx + 0xb8]
push esi
push edi
mov dword [ebp - 4], ebx
add edx, 0xabc
mov dword [ebp - 8], 0x100
movzx eax, byte [ebx + 0x100]
mov edi, eax
and edi, 3
movzx esi, byte [edi + 0x492a10]
movzx edi, byte [edi + 0x492a14]
mov ecx, eax
shr ecx, 2
xor esi, ecx
mov ecx, eax
shr ecx, 1
xor ecx, eax
shr ecx, 1
xor ecx, edi
xor ecx, eax
xor esi, eax
mov edi, ecx
imul ecx, ecx, 0x1000100
imul edi, edi, 0x10100
add edi, esi
shl edi, 8
add edi, eax
shl eax, 0x10
add ecx, esi
add eax, ecx
mov dword [edx], eax
mov dword [edx - 0x800], edi
movzx esi, byte [ebx]
mov edi, esi
and edi, 3
movzx ecx, byte [edi + 0x492a10]
movzx edi, byte [edi + 0x492a14]
mov eax, esi
shr eax, 2
xor ecx, eax
mov eax, esi
shr eax, 1
xor eax, esi
shr eax, 1
xor eax, edi
xor eax, esi
xor ecx, esi
mov ebx, eax
mov edi, esi
imul ebx, ebx, 0x101
shl edi, 8
add edi, ecx
imul ecx, ecx, 0x1000001
shl eax, 8
add eax, esi
shl edi, 0x10
shl eax, 8
add edi, ebx
mov ebx, dword [ebp - 4]
add eax, ecx
mov dword [edx - 0x400], edi
mov dword [edx + 0x400], eax
add edx, 4
inc ebx
dec dword [ebp - 8]
mov dword [ebp - 4], ebx
jne 0x446dc9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448335
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 0x497e98
push edi
mov ecx, eax
dec ecx
push 2
mov dword [ebp - 0xc], eax
sub dword [ebp - 0xc], ecx
mov byte [0x497998], 0
mov byte [0x497e98], 1
mov byte [0x497999], 0
mov byte [0x497e99], 3
mov byte [0x49799b], 1
pop ebx
lea esi, [ecx + 2]
mov edi, 0x100
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov cl, dl
add cl, cl
xor cl, dl
xor cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + esi], cl
movzx eax, cl
mov byte [eax + 0x497998], bl
inc ebx
inc esi
cmp ebx, edi
jl 0x44837a
xor edx, edx
mov byte [0x498110], 0x63
mov byte [0x498073], 0
inc edx
movzx eax, dl
movzx eax, byte [eax + 0x497998]
mov ecx, 0x497f97
sub ecx, eax
mov bl, byte [ecx]
mov cl, bl
rol cl, 1
xor bl, cl
rol cl, 1
xor bl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, bl
xor al, cl
xor al, 0x63
mov byte [edx + 0x498110], al
movzx eax, al
mov byte [eax + 0x498010], dl
inc edx
cmp edx, edi
jl 0x4483b4
mov dl, 1
mov ecx, 0x497f98
movzx eax, dl
mov dword [ecx], eax
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
add dl, dl
add ecx, 4
xor dl, al
cmp ecx, 0x498010
jl 0x4483f8
xor esi, esi
mov al, byte [esi + 0x498110]
mov byte [ebp - 1], al
and byte [ebp - 1], 0x80
mov cl, al
mov byte [ebp - 6], al
sete dl
add cl, cl
dec dl
and dl, 0x1b
mov bl, cl
xor bl, dl
xor bl, al
cmp byte [ebp - 1], 0
mov byte [ebp - 7], al
sete al
dec al
and al, 0x1b
xor cl, al
mov byte [ebp - 8], cl
lea ecx, [ebp - 8]
mov byte [ebp - 5], bl
call fcn.0043e122
mov ebx, dword [0x492ab8]
mov dword [esi*4 + 0x497a98], eax
mov al, byte [esi + 0x498010]
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
movzx eax, bl
push eax
call fcn.0044823a
push dword [ebp - 0xc]
mov byte [ebp - 5], al
movzx eax, bh
push eax
call fcn.0044823a
push dword [ebp - 0xc]
mov byte [ebp - 6], al
movzx eax, byte [0x492aba]
push eax
call fcn.0044823a
push dword [ebp - 0xc]
mov byte [ebp - 7], al
movzx eax, byte [0x492abb]
push eax
call fcn.0044823a
add esp, 0x20
lea ecx, [ebp - 8]
mov byte [ebp - 8], al
call fcn.0043e122
mov dword [esi*4 + 0x498210], eax
inc esi
cmp esi, edi
jl 0x448418
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4487a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x4487e8
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x3c]
mov ecx, dword [ebp + 8]
call fcn.0043e122
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x4487c8
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x4488a2
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x44888f
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x497a98]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x497a98]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x497a98]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x497a98]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x448828
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x448801
cmp dword [esi + 4], 0
jle 0x448926
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x498110]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x498110]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x498110]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x498110]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x4488c0
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x44896d
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x44893b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x4489b5
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x21c]
mov ecx, dword [ebp + 8]
call fcn.0043e122
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x448995
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x448a72
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x448a5f
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x498210]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x498210]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x498210]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x498210]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x4489f8
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x4489ce
cmp dword [esi + 4], 0
jle 0x448afd
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x498010]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x498010]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x498010]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x498010]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x448a97
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x448b44
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x448b12
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44981f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
movzx ecx, byte [esi + 5]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl eax, 8
or eax, ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x80], 0xc
jbe 0x44998e
mov ebx, dword [eax + 0x3c]
add ebx, dword [ebp + 0xc]
mov ecx, dword [eax + 0x7c]
rol ebx, cl
mov dword [ebp + 8], eax
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x477ac8]
movzx edi, al
xor ecx, dword [edi*4 + 0x477ec8]
mov eax, ebx
shr eax, 8
movzx edi, al
sub ecx, dword [edi*4 + 0x4782c8]
mov eax, dword [ebp + 8]
movzx edi, bl
add ecx, dword [edi*4 + 0x4786c8]
mov ebx, dword [eax + 0x38]
xor edx, ecx
mov ecx, dword [eax + 0x78]
sub ebx, edx
rol ebx, cl
mov dword [ebp + 8], edx
mov edx, ebx
shr edx, 0x10
movzx edi, dl
mov ecx, ebx
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x477ac8]
add ecx, dword [edi*4 + 0x477ec8]
mov edx, ebx
shr edx, 8
movzx edi, dl
xor ecx, dword [edi*4 + 0x4782c8]
movzx edi, bl
mov dh, 0xfb
Function at 0x44a6ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [esi + 8]
mov ebx, eax
cmp dword [ebp + 0x14], edi
jne 0x44a765
test ecx, ecx
jne 0x44a704
push edi
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
push edi
push dword [esi]
push dword [esi + 4]
call fcn.004596f0
mov esi, dword [esi]
add esp, 0x20
test edi, edi
jle 0x44a817
sub esi, ebx
mov al, byte [esi + ebx]
xor byte [ebx], al
inc ebx
dec edi
jne 0x44a6f6
jmp 0x44a817
mov eax, dword [esi]
sub edi, ecx
add eax, ecx
test edi, edi
jle 0x44a720
mov ecx, ebx
sub eax, ebx
mov dword [ebp + 0x14], edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp + 0x14]
jne 0x44a715
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [esi]
push dword [esi + 4]
call fcn.004596f0
mov eax, dword [esi + 8]
mov esi, dword [esi]
add esp, 0x20
lea ecx, [edi + ebx]
test eax, eax
jle 0x44a817
sub esi, ecx
mov dl, byte [esi + ecx]
xor byte [ecx], dl
inc ecx
dec eax
jne 0x44a757
jmp 0x44a817
test ecx, ecx
jne 0x44a7a5
push edi
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
push edi
push dword [esi]
push dword [esi + 4]
call fcn.004596f0
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
add esp, 0x20
test edi, edi
jle 0x44a7a0
sub eax, ebx
mov ecx, edi
mov dl, byte [eax + ebx]
xor byte [ebx], dl
inc ebx
dec ecx
jne 0x44a797
mov dword [esi + 8], edi
jmp 0x44a817
sub edi, ecx
cmp edi, dword [ebp + 0x14]
jl 0x44a7af
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
add eax, ecx
test edi, edi
jle 0x44a7c9
mov ecx, ebx
sub eax, ebx
mov dword [ebp - 4], edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp - 4]
jne 0x44a7be
add dword [esi + 8], edi
cmp edi, dword [ebp + 0x14]
jge 0x44a817
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [esi]
push dword [esi + 4]
call fcn.004596f0
mov ecx, dword [ebp + 0x14]
mov edx, dword [esi + 4]
sub ecx, edi
add esp, 0x20
lea eax, [edi + ebx]
test ecx, ecx
jle 0x44a814
mov edi, edx
sub edi, eax
mov edx, ecx
mov bl, byte [edi + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x44a80b
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a8d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp + 0x14]
cmp edi, eax
jne 0x44a984
test ecx, ecx
jne 0x44a923
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov ecx, dword [esi]
add esp, 0x14
cmp dword [ebp + 0x10], 0
jle 0x44a91b
mov edi, ecx
mov ecx, dword [ebp + 0x10]
mov eax, ebx
sub edi, ebx
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x44a912
push dword [ebp + 0x10]
jmp 0x44aa40
mov edi, eax
mov eax, dword [esi]
sub edi, ecx
add eax, ecx
test edi, edi
jle 0x44a941
mov ecx, ebx
sub eax, ebx
mov dword [ebp + 0x14], edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp + 0x14]
jne 0x44a936
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov edx, dword [esi]
add esp, 0x14
lea ecx, [edi + ebx]
test eax, eax
jle 0x44a975
sub edx, ecx
mov dword [ebp + 0x10], eax
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x44a96a
push dword [esi + 8]
mov eax, dword [esi + 4]
push ebx
add eax, edi
push eax
jmp 0x44aa44
test ecx, ecx
jne 0x44a9c8
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov ecx, dword [esi]
add esp, 0x14
test edi, edi
jle 0x44a9b6
mov eax, ebx
sub ecx, ebx
mov dword [ebp + 0x10], edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec dword [ebp + 0x10]
jne 0x44a9ab
push edi
push ebx
push dword [esi + 4]
call fcn.004596f0
mov dword [esi + 8], edi
jmp 0x44aa49
sub eax, ecx
cmp eax, edi
jge 0x44a9d0
mov edi, eax
mov eax, dword [esi]
add eax, ecx
test edi, edi
jle 0x44a9ea
mov ecx, ebx
sub eax, ebx
mov dword [ebp - 4], edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp - 4]
jne 0x44a9df
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
push edi
push ebx
push eax
call fcn.004596f0
add dword [esi + 8], edi
add esp, 0xc
cmp edi, dword [ebp + 0x14]
jge 0x44aa4c
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 4]
sub eax, edi
add esp, 0x14
lea ecx, [edi + ebx]
test eax, eax
jle 0x44aa3c
mov edi, ecx
sub edx, ecx
mov dword [ebp + 0x10], eax
mov cl, byte [edx + edi]
xor byte [edi], cl
inc edi
dec dword [ebp + 0x10]
jne 0x44aa31
mov dword [esi + 8], eax
push eax
push ebx
push dword [esi + 4]
call fcn.004596f0
add esp, 0xc
pop edi
leave
ret
Function at 0x44aa4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
push edi
mov edi, eax
cmp dword [ebp + 0x14], ebx
jne 0x44ab0a
test ecx, ecx
jne 0x44aaa7
push ebx
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
push ebx
push edi
push dword [esi + 4]
call fcn.004596f0
mov esi, dword [esi]
add esp, 0x20
test ebx, ebx
jle 0x44abd5
sub esi, edi
mov al, byte [esi + edi]
xor byte [edi], al
inc edi
dec ebx
jne 0x44aa99
jmp 0x44abd5
mov eax, dword [esi]
sub ebx, ecx
add eax, ecx
test ebx, ebx
jle 0x44aac3
mov ecx, edi
sub eax, edi
mov dword [ebp + 0x14], ebx
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp + 0x14]
jne 0x44aab8
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
push dword [esi + 8]
mov eax, dword [esi + 4]
add eax, ebx
push edi
push eax
call fcn.004596f0
mov eax, dword [esi + 8]
mov esi, dword [esi]
add esp, 0x20
lea ecx, [ebx + edi]
test eax, eax
jle 0x44abd5
sub esi, ecx
mov dl, byte [esi + ecx]
xor byte [ecx], dl
inc ecx
dec eax
jne 0x44aafc
jmp 0x44abd5
test ecx, ecx
jne 0x44ab4c
push ebx
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push ebx
push edi
push dword [esi + 4]
call fcn.004596f0
mov eax, dword [esi]
add esp, 0x20
test ebx, ebx
jle 0x44ab44
sub eax, edi
mov ecx, ebx
mov dl, byte [eax + edi]
xor byte [edi], dl
inc edi
dec ecx
jne 0x44ab3b
mov dword [esi + 8], ebx
jmp 0x44abd5
mov eax, ebx
sub eax, ecx
cmp eax, dword [ebp + 0x14]
mov ebx, eax
jl 0x44ab5a
mov ebx, dword [ebp + 0x14]
mov eax, dword [esi]
add eax, ecx
test ebx, ebx
jle 0x44ab74
mov ecx, edi
sub eax, edi
mov dword [ebp - 4], ebx
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp - 4]
jne 0x44ab69
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
push ebx
push edi
push eax
call fcn.004596f0
add dword [esi + 8], ebx
add esp, 0xc
cmp ebx, dword [ebp + 0x14]
jge 0x44abd5
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
sub eax, ebx
push eax
push edi
push dword [esi + 4]
mov dword [ebp + 0x14], eax
call fcn.004596f0
mov edx, dword [ebp + 0x14]
mov eax, dword [esi + 4]
add esp, 0x20
add edi, ebx
test edx, edx
jle 0x44abd2
mov ecx, edi
sub eax, edi
mov edi, edx
mov bl, byte [eax + ecx]
xor byte [ecx], bl
inc ecx
dec edi
jne 0x44abc9
mov dword [esi + 8], edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ae17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [esi + 8]
mov ebx, eax
cmp dword [ebp + 0x14], edi
jne 0x44aecd
test ecx, ecx
jne 0x44ae6d
push edi
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov eax, dword [esi]
add esp, 0x14
test edi, edi
jle 0x44ae5e
sub eax, ebx
mov ecx, edi
mov dl, byte [eax + ebx]
xor byte [ebx], dl
inc ebx
dec ecx
jne 0x44ae55
mov ecx, dword [esi + 4]
mov eax, edi
call fcn.0044ad0e
jmp 0x44af76
mov eax, dword [esi]
sub edi, ecx
add eax, ecx
test edi, edi
jle 0x44ae89
mov ecx, ebx
sub eax, ebx
mov dword [ebp + 0x14], edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp + 0x14]
jne 0x44ae7e
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 4]
call fcn.0044ad0e
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov esi, dword [esi]
add esp, 0x14
add edi, ebx
test eax, eax
jle 0x44af76
mov ecx, edi
sub esi, edi
mov dl, byte [esi + ecx]
xor byte [ecx], dl
inc ecx
dec eax
jne 0x44aebf
jmp 0x44af76
test ecx, ecx
jne 0x44af02
push edi
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
add esp, 0x14
test edi, edi
jle 0x44aefd
sub eax, ebx
mov ecx, edi
mov dl, byte [eax + ebx]
xor byte [ebx], dl
inc ebx
dec ecx
jne 0x44aef4
mov dword [esi + 8], edi
jmp 0x44af76
mov eax, edi
sub eax, ecx
cmp eax, dword [ebp + 0x14]
mov edi, eax
jl 0x44af10
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
add eax, ecx
test edi, edi
jle 0x44af2a
mov ecx, ebx
sub eax, ebx
mov dword [ebp - 4], edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp - 4]
jne 0x44af1f
add dword [esi + 8], edi
cmp edi, dword [ebp + 0x14]
jge 0x44af76
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 4]
call fcn.0044ad0e
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [esi]
call fcn.004596f0
push dword [esi]
push dword [ebp + 8]
call dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [esi]
sub eax, edi
add esp, 0x14
add ebx, edi
test eax, eax
jle 0x44af73
mov edi, ecx
mov edx, ebx
sub edi, ebx
mov ecx, eax
mov bl, byte [edi + edx]
xor byte [edx], bl
inc edx
dec ecx
jne 0x44af6a
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45312f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x498c2c], 0
push esi
jne 0x4530a2
call fcn.00452fc8
test eax, eax
je 0x4530e5
mov eax, dword [0x498c2c]
cmp eax, 1
jne 0x4530c3
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4530e5
pop esi
ret
push eax
call dword [0x498c34]
test eax, eax
jne 0x45312d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4530e9
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x498c2c]
call dword [0x498c34]
mov edi, eax
test edi, edi
je 0x45310e
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x45312a
mov edi, esi
add esi, 0xff0
push edi
push dword [0x498c2c]
call dword [0x498c30]
add edi, 0x10
cmp edi, esi
jb 0x453116
mov eax, edi
pop edi
pop esi
ret
jmp 0x45308f