joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4465f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a370
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x483008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x446633
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push 0x2c
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0045e179
mov esi, eax
mov dword [ebp - 0x1c], 0
add esp, 4
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0
mov dword [esi], 0
lea eax, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0xc
mov dword [esi + 0xc], eax
xor eax, eax
push 0xc
push str.Advapi32.dll
mov dword [esi + 0x10], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00405840
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0043e4a0
mov ecx, eax
call fcn.0043e560
mov dword [esi + 0x28], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4466fe
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4466f4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4466f4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0045e524
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
push eax
push eax
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x14]
lea eax, [esi + 0x14]
mov dword [ebp - 0x18], 7
push eax
call fcn.0044d230
mov esi, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [ebp - 4], 1
cmp dword [esi], 0
je 0x446736
lea eax, [esi + 8]
jmp 0x446738
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x446748
cmp dword [ebx + 0x14], 8
jb 0x44674a
mov ebx, dword [ebx]
jmp 0x44674a
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x44676b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44676b
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x446794
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4467a9
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.0045e524
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e155
mov esp, ebp
pop ebp
ret 4
Function at 0x446a20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467718
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x483008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x446a5b
xor al, al
jmp 0x446b25
and esi, 0xffffb1af
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x446a6b
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x446a80
mov al, 1
jmp 0x446b25
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00447150
test al, al
je 0x446aca
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x446aca
mov bl, 1
jmp 0x446acc
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x446b0f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446b05
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x446b05
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0045e524
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e155
mov esp, ebp
pop ebp
ret
Function at 0x446b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467718
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x483008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446b86
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x446c36
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00447150
test al, al
je 0x446bdf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x446c22
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446c18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x446c18
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0045e524
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e155
mov esp, ebp
pop ebp
ret
Function at 0x449990
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a778
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x483008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
mov edi, dword [ebp + 0xc]
push esi
push eax
call fcn.0044a250
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.004465f0
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x1c], 0
test eax, eax
jne 0x449a14
xor bl, bl
jmp 0x449a32
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x449a2c
cmp eax, 0x80
je 0x449a2c
xor bl, bl
jmp 0x449a32
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x1c], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x39]
push eax
push edi
push esi
mov byte [ebp - 0x39], 0
call fcn.00449b20
test al, al
jne 0x449a60
cmp byte [ebp - 0x39], al
je 0x449a60
cmp dword [esi + 0x14], 8
jb 0x449a59
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
test bl, bl
je 0x449a7a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x449a76
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x449a9a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x449ae3
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449ad9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x449ad9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0045e524
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e155
mov esp, ebp
pop ebp
ret 8
Function at 0x44b600
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x483008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x44b697
cmp dword [esp + 8], 6
jb 0x44b697
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.0045e155
add esp, 0x118
ret
Function at 0x44b6b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46aa20
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x483008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00405840
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.0043e4a0
mov ecx, eax
call fcn.0043e560
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44b767
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44b75d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44b75d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0045e524
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
push 0xb
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], eax
push str.crypt32.dll
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00405840
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.0043e4a0
mov ecx, eax
call fcn.0043e560
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x44b7fe
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44b7f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44b7f1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0045e524
mov eax, dword [ebp - 0x10]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
test edi, edi
je 0x44b890
test eax, eax
je 0x44b890
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c3c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x483008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x44c425
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44c400
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44c425
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0045e155
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0045e155
add esp, 8
ret 4
Function at 0x44f1c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46af80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x483008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test eax, eax
je 0x44f2a7
cmp byte [eax + 0x54], 0
je 0x44f2a7
add eax, 0x1c
lea ecx, [ebp - 0x34]
push eax
call fcn.0042b4b0
push 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043d760
add esp, 4
mov byte [ebp - 4], 1
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [esi]
cmovae edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
cmp dword [eax + 0x14], 8
jb 0x44f242
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44f28c
push 2
push 0
push 0
push esi
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004076f0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.0042b500
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e155
mov esp, ebp
pop ebp
ret 4

Function at 0x44fba0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [esp + 0x18]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x44fbb3
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x44fe90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, ecx
mov dword [esp + 8], edx
push esi
push edi
movzx esi, word [ebp]
movzx ecx, word [ebp + 2]
mov eax, esi
shr eax, 4
xor esi, 0x7f0
shr esi, 4
mov eax, dword [ebx + eax*4]
mov dword [esp + 0x14], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + esi*4]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
xor esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], esi
cmp esi, dword [esp + 0x24]
jae 0x45000a
mov edx, esi
xor edi, edi
mov esi, dword [esp + 0x10]
or edx, 8
nop dword [eax + eax]
mov ecx, edx
and edx, 1
shr ecx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + esi*8]
movzx eax, word [ebp + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add edi, dword [ebx + eax*4]
cmp edx, 1
jne 0x44ff00
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov dword [esp + 0x2c], esi
cmp esi, 8
jb 0x44fee6
cmp esi, 0x10
jae 0x44ffb2
lea eax, [esi - 8]
mov dword [esp + 0x14], eax
nop dword [eax]
cmp esi, dword [esp + 0x24]
jae 0x45000a
mov esi, dword [esp + 0x10]
mov edx, eax
xor edi, edi
or edx, 8
mov ecx, edx
and edx, 1
shr ecx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + esi*8]
movzx eax, word [ebp + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add edi, dword [ebx + eax*4]
cmp edx, 1
jne 0x44ff65
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x44ff50
cmp esi, dword [esp + 0x24]
jae 0x45000a
lea eax, [esi - 0x10]
mov dword [esp + 0x2c], eax
nop
xor edi, edi
or eax, 0x100
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebp + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x44ffc7
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x2c], eax
cmp esi, dword [esp + 0x24]
jb 0x44ffc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x451be0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x14], ecx
lea eax, [ecx + 0x32350]
mov dword [esp + 0xc], ebp
push edi
mov dword [esp + 0x14], eax
nop dword [eax + eax]
xor ebx, ebx
mov edi, ebp
lea eax, [ebx + 1]
lea ebp, [ebx + 4]
nop word [eax + eax]
movzx edx, word [ecx + eax*2 + 0x329f4]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [esp + 0x18]
add ebx, dword [ecx + edx*4 + 0x30ca0]
sub ebp, 1
jne 0x451c10
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
inc ebp
mov dword [esp + 0x10], ebp
mov dword [edx], ebx
add edx, 4
mov dword [esp + 0x14], edx
cmp ebp, 0x10
jb 0x451c00
pop edi
pop esi
pop ebp
mov dword [ecx + 0x32390], 0
pop ebx
add esp, 0xc
ret
Function at 0x451c70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
mov ebx, 4
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
nop word [eax + eax]
movzx eax, byte [edi + ebx + 0x304a0]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov edx, eax
shr ebp, 1
and edx, 1
dec ebp
or edx, 2
mov ecx, ebp
shl edx, cl
mov eax, ebx
sub eax, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea esi, [eax + 1]
test ebp, ebp
je 0x451d14
mov ebx, dword [esp + 0x20]
nop word [eax + eax]
mov eax, esi
mov edx, ebx
sub eax, dword [esp + 0x1c]
and edx, 1
add eax, dword [esp + 0x18]
add esi, esi
shr ebx, 1
or esi, edx
movzx ecx, word [edi + eax*2 + 0x3290e]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [esp + 0x14]
add eax, dword [edi + ecx*4 + 0x30ca0]
mov dword [esp + 0x14], eax
sub ebp, 1
jne 0x451cd0
mov ebx, dword [esp + 0x10]
mov dword [esp + ebx*4 + 0x24], eax
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x80
jb 0x451c90
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 4
sub ecx, edi
lea ebp, [edi + 0x31750]
lea esi, [edi + 0x32710]
mov dword [esp + 0x18], ebp
lea edx, [edi + 0x31b58]
mov dword [esp + 0x10], esi
sub ecx, 0x31b50
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ecx
nop
mov eax, dword [edi + 0x32394]
xor ebx, ebx
test eax, eax
je 0x451dc2
nop dword [eax]
mov ebp, dword [esp + 0x10]
mov eax, ebx
xor esi, esi
or eax, 0x40
nop dword [eax + eax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebp + edx*2]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30ca0]
cmp eax, 1
jne 0x451d80
mov ebp, dword [esp + 0x18]
mov dword [ebp + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x32394]
cmp ebx, eax
jb 0x451d70
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0xe
cmp eax, ecx
jbe 0x451de7
nop dword [eax + eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x32394]
jb 0x451dd0
mov eax, dword [ebp]
mov ecx, 4
mov ebx, dword [esp + 0x1c]
mov dword [edx - 8], eax
mov eax, dword [ebp + 4]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x304a0]
lea edx, [edx + 4]
inc ecx
mov eax, dword [ebp + eax*4]
add eax, dword [edx + ebx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x451e10
mov edx, dword [esp + 0x14]
sub esi, 0xffffff80
add ebp, 0x100
mov dword [esp + 0x10], esi
add edx, 0x200
mov dword [esp + 0x18], ebp
sub ebx, 0x200
mov dword [esp + 0x14], edx
sub dword [esp + 0x20], 1
mov dword [esp + 0x1c], ebx
jne 0x451d60
mov dword [edi + 0x3baf8], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
Function at 0x451e80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x44
push ebx
mov ebx, ecx
xor edx, edx
push ebp
push esi
push edi
mov dword [ebx + 0x3bad4], 0
lea esi, [ebx + 0x8c]
mov dword [ebx + 0x3bad0], 0
mov dword [esp + 0x1c], ebx
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x48], 0x20
mov dword [ebx + 0x70], 1
mov dword [ebx + 0x64], 4
mov dword [ebx + 0x74], 0
nop word [eax + eax]
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x451ee0
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 5
mov ecx, ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x48], 0
call fcn.0044f8a0
lea edx, [ebx + 0x304a0]
mov eax, 2
mov word [edx], 0x100
mov ebx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
nop
mov ecx, ebx
mov ebp, 1
sar ecx, 1
dec ecx
shl ebp, cl
test ebp, ebp
je 0x45203c
lea edi, [eax + edx]
mov ecx, ebp
mov al, bl
mov edx, dword [esp + 0x18]
movzx eax, al
mov esi, ecx
imul eax, eax, 0x1010101
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
add eax, ebp
mov dword [esp + 0x14], eax
inc ebx
cmp ebx, 0x16
jl 0x452000
mov ebx, dword [esp + 0x1c]
mov edi, 8
nop dword [eax + eax]
xor edx, edx
mov eax, edi
lea esi, [edx + 4]
nop word [eax + eax]
imul eax, eax
add edx, edx
cmp eax, 0x10000
jb 0x45207a
nop dword [eax]
shr eax, 1
inc edx
cmp eax, 0x10000
jae 0x452070
sub esi, 1
jne 0x452060
mov eax, edi
mov ecx, 0xa1
shr eax, 4
sub ecx, edx
add edi, 0x10
mov dword [ebx + eax*4 + 0x30ca0], ecx
cmp edi, 0x800
jb 0x452050
pop edi
mov dword [ebx + 0x323ac], esi
mov dword [ebx + 0x3bb14], esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret