joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424d77
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 4], 0
push esi
push edi
mov esi, eax
call fcn.0042f59a
test eax, eax
jne 0x424db2
mov dword [ebp + 8], 0xc0000098
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x424da8
push ebx
call fcn.0042a899
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
movzx ecx, word [eax + 0x14]
movzx edi, word [eax + 6]
mov edx, dword [eax + 0x78]
lea ecx, [ecx + eax + 0x18]
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], edi
test edi, edi
jbe 0x424df7
lea edi, [ecx + 0xc]
mov dword [ebp + 8], edi
mov edi, dword [ebp + 8]
mov edi, dword [edi]
cmp edx, edi
jb 0x424ded
mov edx, dword [ebp + 8]
mov edx, dword [edx + 4]
add edx, edi
mov edi, edx
mov edx, dword [ebp - 8]
cmp edx, edi
jb 0x424df7
add dword [ebp + 8], 0x28
inc eax
cmp eax, dword [ebp - 4]
jb 0x424dd3
cmp eax, dword [ebp - 4]
jne 0x424e05
mov dword [ebp + 8], 0xc0000225
jmp 0x424d9b
mov edx, dword [edx + esi + 0xc]
test edx, edx
je 0x424dfc
imul eax, eax, 0x28
add ecx, eax
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
add esi, edx
sub eax, edx
push eax
push esi
mov dword [ebp + 8], esi
call fcn.00442b3d
pop ecx
mov esi, eax
pop ecx
lea eax, [esi + 1]
push eax
call fcn.0042a848
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x424e48
mov dword [ebp + 8], 0xc0000017
jmp 0x424d9b
push esi
push dword [ebp + 8]
push edi
call fcn.0044dba0
and dword [ebp + 8], 0
add esp, 0xc
lea eax, [esi + 1]
push 0x2e
push edi
mov byte [edi + esi], 0
mov word [ebx + 2], ax
mov word [ebx], ax
call fcn.00442b10
pop ecx
pop ecx
test eax, eax
je 0x424da8
sub esi, eax
add esi, dword [ebx + 4]
cmp esi, 4
jne 0x424da8
push str..EXE
push 5
push eax
call fcn.00443de1
add esp, 0xc
jmp 0x424da8
Function at 0x427831
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
call fcn.004237ff
mov esi, eax
call fcn.004237ff
mov ebx, eax
cmp ebx, esi
je 0x42783d
rdtsc
mov esi, eax
mov edi, edx
call fcn.004237ff
cmp eax, ebx
je 0x42784e
rdtsc
push 0
sub eax, esi
pop esi
sbb edx, edi
push esi
add eax, 0x6b46
push 0xd68b
adc edx, esi
push edx
push eax
call fcn.0044fdb0
push esi
push 0xf4240
push edx
push eax
call fcn.00443810
pop edi
pop esi
mov dword [0x48d0f8], eax
mov dword [0x48d0fc], edx
xor eax, eax
pop ebx
ret
Function at 0x42f562
Capabilities:
Parse pe header

Disassembly:
test edx, edx
je 0x42f594
and dword [edx], 0
test eax, eax
je 0x42f594
cmp eax, 0xffffffff
je 0x42f594
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x42f582
mov eax, 0xc000007b
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f57c
xor eax, eax
mov dword [edx], ecx
ret
mov eax, 0xc000000d
ret

Function at 0x42fc65
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov cx, word [eax + 0x14]
movzx ecx, cx
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
push esi
xor esi, esi
push edi
test eax, eax
jbe 0x42fc9b
mov edx, dword [ecx + 0xc]
cmp dword [ebp + 0xc], edx
jb 0x42fc93
mov edi, dword [ecx + 0x10]
add edi, edx
cmp dword [ebp + 0xc], edi
jb 0x42fc9d
add ecx, 0x28
inc esi
cmp esi, eax
jb 0x42fc81
xor ecx, ecx
pop edi
pop esi
test ecx, ecx
je 0x42fcb1
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
jmp 0x42fcb3
xor eax, eax
pop ebp
ret 8

Function at 0x430b7f
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x46af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xb8], eax
xor eax, eax
mov edi, edx
mov dword [ebp - 0xbc], edi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push eax
mov esi, ecx
call fcn.00452870
push 0x40
pop ebx
push ebx
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0044db40
add esp, 0xc
push 5
pop ecx
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
xor byte [ebp + eax - 0x58], 0x36
inc eax
cmp eax, ebx
jb 0x430bd9
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00452930
push dword [ebp + 0xc]
lea eax, [ebp - 0xb4]
push dword [ebp - 0xb8]
push eax
call fcn.00452930
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00452a40
xor eax, eax
xor byte [ebp + eax - 0x58], 0x6a
inc eax
cmp eax, ebx
jb 0x430c1b
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00452930
push 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00452930
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00452a40
mov edi, dword [ebp - 0xbc]
push 5
pop ecx
lea esi, [ebp - 0x18]
push 0x5c
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0xb4]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430c6f
push 0x14
pop ecx
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430c7c
lea eax, [ebp - 0x58]
mov byte [eax], 0
inc eax
dec ebx
jne 0x430c86
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00408ad6
leave
ret 8
Function at 0x4310d2
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x46af20]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa0], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x27
lea eax, [ebp - 0x2b]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0xa4], esi
mov byte [ebp - 0x2c], 0
call fcn.0044db40
xor eax, eax
mov byte [ebp - 0x40], 0
lea edi, [ebp - 0x3f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5b
stosb byte es:[edi], al
lea eax, [ebp - 0x9b]
push 0
push eax
mov byte [ebp - 0x9c], 0
call fcn.0044db40
add esp, 0x18
test ebx, ebx
jne 0x431147
mov dword [ebp - 0xa0], 0x80290104
jmp 0x4311bd
test esi, esi
jne 0x431157
mov dword [ebp - 0xa0], 0x80290103
jmp 0x4311bd
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
pop ecx
push 5
lea esi, [ebx + 0x34]
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x9c]
lea esi, [ebx + 0xc]
lea edi, [ebp - 0x18]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00452870
push 0x28
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00452930
push dword [ebp - 0xa4]
lea eax, [ebp - 0x9c]
push eax
call fcn.00452a40
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x40]
push 0x14
sub eax, ecx
pop esi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec esi
jne 0x4311b4
push 0x28
pop ecx
pop edi
pop esi
lea eax, [ebp - 0x2c]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x4311c6
push 0x14
pop ecx
lea eax, [ebp - 0x40]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4311d3
push 0x5c
pop ecx
lea eax, [ebp - 0x9c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4311e3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa0]
xor ecx, ebp
call fcn.00408ad6
leave
ret 4

Function at 0x4378ad
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, ecx
movzx ecx, word [ecx]
xor eax, eax
test cx, cx
je 0x4378d3
movzx ecx, cx
movzx ecx, cx
rol eax, 0x10
xor eax, ecx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4378c1
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 0xc]
mov eax, edx
pop ebp
ret 4

Function at 0x43d598
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x490874]
test eax, eax
jne 0x43d5ca
lea eax, [ebp - 8]
call fcn.00427819
push 0
push 0xf4240
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044fdb0
mov dword [ebp - 4], edx
mov dword [0x490874], eax
mul dword [ebp + 8]
push ebx
mov ebx, eax
mov ecx, edx
rdtsc
push esi
push edi
mov esi, eax
mov edi, edx
rdtsc
sub eax, esi
sbb edx, edi
cmp edx, ecx
jb 0x43d5da
ja 0x43d5ea
cmp eax, ebx
jb 0x43d5da
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x440e27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x46867c]
mov ecx, dword [ebp + 8]
sub esp, 0x1c
push ebx
mov ebx, dword [ecx + 0x18]
add eax, 0xffffffc8
push edi
cmp ebx, eax
jb 0x440e45
mov ebx, eax
mov edi, dword [ecx + 0x10]
and dword [ebp - 0x18], 0
mov eax, dword [esi + 4]
lea edx, [edi + ebx]
xor edx, edi
mov dword [ebp - 0xc], eax
test edx, 0xfffff000
jne 0x440e72
test edi, edi
je 0x440e76
movzx ecx, bx
push ecx
push edi
call fcn.00440ccf
mov word [esi], ax
jmp 0x440ef1
test edi, edi
jne 0x440e7d
xor eax, eax
mov word [esi], ax
jmp 0x440ef4
mov ecx, edi
and ecx, 0xfff
mov edx, 0x1000
sub edx, ecx
movzx ecx, dx
mov dword [ebp - 8], ecx
movzx ecx, cx
push ecx
push edi
call fcn.00440ccf
mov word [esi], ax
movzx eax, word [ebp - 8]
add dword [ebp - 0xc], eax
add edi, eax
mov eax, ebx
sub eax, dword [ebp - 8]
movzx eax, ax
jmp 0x440ee9
test edi, edi
je 0x440ef1
mov eax, 0x1000
mov ecx, eax
cmp cx, word [ebp - 0x10]
jb 0x440ec7
movzx eax, word [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, ax
push eax
mov eax, dword [ebp - 0xc]
push edi
call fcn.00440ccf
add word [esi], ax
movzx eax, word [ebp - 8]
add dword [ebp - 0xc], eax
add edi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
test ax, ax
ja 0x440eb2
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
sub ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0xc0000001
mov dword [ecx + 8], ebx
movzx eax, word [esi]
push 0x38
mov dword [ecx + 0x1c], eax
pop eax
mov word [ebp - 0x1c], ax
push esi
lea eax, [ebp - 0x1c]
push eax
push 2
mov dword [ebp - 0x18], ecx
call dword [0x49087c]
pop edi
pop ebx
leave
ret 4

Function at 0x440f29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
push ebx
movzx ebx, word [edi + 0x18]
push esi
mov esi, dword [edi + 0x10]
push 0x38
pop eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
movzx eax, bx
lea edx, [eax + esi]
xor edx, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ecx
test edx, 0xfffff000
jne 0x440f6f
push eax
push ecx
mov eax, esi
call fcn.00440ccf
movzx eax, ax
jmp 0x440fd1
mov eax, esi
and eax, 0xfff
mov edx, 0x1000
sub edx, eax
movzx eax, dx
mov dword [ebp - 8], eax
movzx eax, ax
push eax
push ecx
mov eax, esi
call fcn.00440ccf
movzx eax, ax
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 8]
sub ebx, dword [ebp - 8]
add dword [ebp - 0xc], eax
add esi, eax
test bx, bx
jbe 0x440fce
mov eax, 0x1000
mov ecx, eax
cmp cx, bx
jb 0x440fb5
movzx eax, bx
mov dword [ebp - 8], eax
movzx eax, ax
push eax
push dword [ebp - 0xc]
mov eax, esi
call fcn.00440ccf
movzx eax, ax
add dword [ebp - 0x10], eax
jmp 0x440f95
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, eax
sub edx, ecx
neg edx
sbb edx, edx
and edx, 0xc0000001
mov dword [edi + 8], edx
mov dword [edi + 0x1c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [0x49087c]
pop esi
pop ebx
leave
ret 4
Function at 0x448839
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20
pop edi
push edi
call fcn.00447390
mov esi, eax
test esi, esi
jl 0x4488fb
push 1
push dword [ebp + 8]
call fcn.0044823e
mov esi, eax
test esi, esi
jl 0x4488fb
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.004481cf
mov esi, eax
test esi, esi
jl 0x4488fb
cmp word [ebp + 0x10], di
je 0x44889b
mov esi, 0xc000000d
jmp 0x4488fb
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004421a0
add esp, 0xc
push 1
push dword [ebp + 0xc]
call fcn.0044823e
mov esi, eax
test esi, esi
jl 0x4488fb
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.004481cf
mov esi, eax
test esi, esi
jl 0x4488fb
cmp word [ebp + 0x10], di
jne 0x448894
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, edi
jb 0x4488d8
push ebx
push edi
push dword [ebp - 4]
push 0x2000
call fcn.004485a3
mov esi, eax
cmp dword [ebp - 4], 0
je 0x44890a
push edi
push dword [ebp - 4]
call fcn.00447554
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44917b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x46af20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
pop ebx
push ebx
push 0
push esi
call fcn.0044db40
push dword [ebp + 0x10]
push edi
push esi
call fcn.004421a0
add esp, 0x18
lea edi, [esi + 0x40]
push edi
call fcn.00451000
lea eax, [ebp - 0x44]
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x44]
mov dl, byte [esi + eax]
xor dl, 0x36
inc ecx
cmp ecx, ebx
mov byte [eax], dl
jl 0x4491bf
push ebx
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.00451b30
lea eax, [ebp - 0x44]
mov byte [eax], 0
inc eax
dec ebx
jne 0x4491de
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ad6
leave
ret 0xc
Function at 0x4491f6
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x46af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x24]
push eax
lea esi, [ebx + 0x40]
push esi
call fcn.00451c40
push esi
call fcn.00451000
mov edi, ebx
lea eax, [ebp - 0x64]
xor ecx, ecx
sub edi, eax
lea eax, [ebp + ecx - 0x64]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
cmp ecx, 0x40
mov byte [eax], dl
jl 0x449230
push 0x40
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.00451b30
push 0x20
pop edi
push edi
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00451b30
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00451c40
mov eax, dword [ebp + 0x10]
cmp eax, edi
jb 0x44926f
mov eax, edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x68]
call fcn.004421a0
add esp, 0xc
push 0x40
pop ecx
lea eax, [ebp - 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x449285
mov ecx, edi
lea eax, [ebp - 0x24]
mov byte [eax], 0
inc eax
dec ecx
jne 0x449291
mov eax, 0xa8
mov byte [ebx], 0
inc ebx
dec eax
jne 0x44929d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ad6
leave
ret 0xc
Function at 0x44945d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 - 0x14]
push ebx
push esi
mov esi, dword [ecx + eax*4 - 0x10]
mov dword [ebp - 4], esi
mov esi, dword [ecx + eax*4 - 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ecx + eax*4 - 8]
lea eax, [ecx + eax*4]
push edi
mov edi, dword [eax - 4]
add eax, 0xffffffc0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 5
mov ebx, dword [ebp - 0x14]
cmp ecx, ebx
ja 0x44957c
sub ebx, ecx
shr ebx, 6
inc ebx
lea eax, [ecx + 8]
mov dword [ebp - 0xc], ebx
mov ebx, edx
mov edx, dword [ebp - 8]
rol ebx, 9
xor ebx, esi
add ebx, dword [eax - 8]
mov ecx, edi
xor ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ebx
add ecx, dword [eax - 4]
rol edx, 0xd
xor edx, ebx
add edx, dword [eax]
xor esi, ecx
add esi, dword [eax + 4]
mov dword [eax - 8], ebx
rol edi, 9
xor edi, edx
add edi, dword [eax + 8]
mov ebx, esi
xor ebx, dword [ebp - 0x18]
mov dword [eax], edx
add ebx, dword [eax + 0xc]
mov dword [eax - 4], ecx
xor edx, ebx
add edx, dword [eax + 0x14]
rol ecx, 0xd
xor ecx, edi
add ecx, dword [eax + 0x10]
mov dword [eax + 8], edi
xor edi, edx
add edi, dword [eax + 0x1c]
mov dword [eax + 4], esi
rol esi, 9
xor esi, ecx
add esi, dword [eax + 0x18]
mov dword [ebp - 4], ecx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, edi
xor ecx, dword [ebp - 4]
rol ebx, 0xd
add ecx, dword [eax + 0x24]
xor ebx, esi
add ebx, dword [eax + 0x20]
mov dword [eax + 0x14], edx
rol edx, 9
xor edx, ebx
add edx, dword [eax + 0x28]
mov dword [eax + 0x18], esi
xor esi, ecx
add esi, dword [eax + 0x2c]
mov dword [eax + 0x1c], edi
mov dword [ebp - 8], edx
rol edi, 0xd
xor edi, edx
add edi, dword [eax + 0x30]
mov edx, esi
xor edx, ebx
add edx, dword [eax + 0x34]
mov dword [eax + 0x20], ebx
mov ebx, dword [ebp - 8]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], edi
mov dword [eax + 0x34], edx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], esi
add eax, 0x40
dec dword [ebp - 0xc]
mov esi, edi
mov edi, dword [ebp - 0x18]
mov edx, ecx
mov dword [ebp - 4], ebx
jne 0x4494ab
mov ecx, dword [ebp + 8]
dec dword [ebp - 0x10]
jne 0x449494
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4496d8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx + 8]
lea eax, [ecx + eax*4 - 0x40]
push edi
mov edi, dword [ecx + 0xc]
mov dword [ebp + 8], eax
mov dword [ebp - 8], 3
mov eax, ecx
cmp ecx, dword [ebp + 8]
ja 0x449778
mov edx, ebx
xor edx, esi
add dword [eax], edx
mov esi, dword [eax + 0x18]
mov edx, esi
rol edx, 0xa
xor edx, edi
add dword [eax + 4], edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebp - 4]
xor edi, edx
add dword [eax + 8], edi
lea edx, [eax + 0x20]
mov dword [ebp - 0xc], edx
mov edx, dword [edx]
mov edi, edx
rol edi, 0x19
xor edi, ebx
add dword [eax + 0xc], edi
mov edi, dword [eax + 0x24]
xor edi, esi
add dword [eax + 0x10], edi
mov esi, dword [eax + 0x28]
mov ebx, dword [eax + 0x34]
mov edi, esi
rol edi, 0xa
xor edi, dword [eax + 0x1c]
add dword [eax + 0x14], edi
mov edi, dword [eax + 0x2c]
xor edx, edi
add edx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [eax + 0x30]
mov dword [ebp - 4], edx
rol edx, 0x19
xor edx, dword [eax + 0x24]
add edx, dword [eax + 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jbe 0x44970a
mov edx, ebx
xor edx, esi
add dword [eax], edx
mov esi, dword [eax + 0x18]
mov edx, esi
rol edx, 0xa
xor edx, edi
add dword [eax + 4], edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebp - 4]
xor edi, edx
add dword [eax + 8], edi
mov edx, dword [ecx]
mov edi, edx
rol edi, 0x19
xor edi, ebx
add dword [eax + 0xc], edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0xc], edi
xor edi, esi
add dword [eax + 0x10], edi
mov esi, dword [ecx + 8]
mov edi, esi
rol edi, 0xa
xor edi, dword [eax + 0x1c]
add dword [eax + 0x14], edi
mov edi, dword [ecx + 0xc]
xor edx, edi
add edx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x10]
mov dword [ebp - 4], edx
rol edx, 0x19
xor edx, dword [ebp - 0xc]
add edx, dword [eax + 0x1c]
dec dword [ebp - 8]
mov dword [eax + 0x1c], edx
mov ebx, dword [ecx + 0x14]
jne 0x449703
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4497eb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
add eax, 8
shr edx, 4
mov ebx, dword [ebp - 4]
xor dword [eax], ebx
mov ebx, dword [ebp - 8]
xor dword [eax + 4], ebx
mov ebx, dword [ebp - 4]
xor dword [eax + 0x20], ebx
mov ebx, dword [ebp - 8]
xor dword [eax - 8], esi
xor dword [eax - 4], edi
xor dword [eax + 0x18], esi
xor dword [eax + 0x1c], edi
xor dword [eax + 0x24], ebx
add eax, 0x40
dec edx
jne 0x449812
mov ebx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
add ebx, 0xfffffff4
cmp ebx, 4
jb 0x44987b
mov eax, dword [ebp + 8]
add ebx, 0xc
add eax, 0x18
shr ebx, 4
xor dword [eax - 8], edx
xor dword [eax - 4], esi
xor dword [eax], edi
xor dword [eax + 4], ecx
xor dword [eax + 0x18], edx
xor dword [eax + 0x1c], esi
xor dword [eax + 0x20], edi
xor dword [eax + 0x24], ecx
add eax, 0x40
dec ebx
jne 0x44985e
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x449d95
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x449db3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x449daa
pop esi
pop ebp
ret 0xc
Function at 0x449dfd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x28]
sub al, 2
push ebx
mov ebx, dword [ebp + 0x10]
and al, 0xfe
mov cl, 0xe
shl al, 2
sub cl, bl
push esi
mov esi, dword [ebp + 0xc]
or al, cl
cmp dword [ebp + 0x18], 0
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0x14], al
jbe 0x449e3f
or al, 0x40
mov byte [ebp - 0x14], al
push ebx
lea eax, [ebp - 0x13]
push esi
push eax
call fcn.004421a0
mov ecx, dword [ebp + 0x20]
add esp, 0xc
push 0xf
pop eax
cmp ebx, eax
jae 0x449e63
mov byte [ebp + eax - 0x14], cl
shr ecx, 8
dec eax
cmp eax, ebx
ja 0x449e57
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00451d80
mov edx, dword [ebp + 0x18]
test edx, edx
jbe 0x449ed7
xor ecx, ecx
push 2
pop esi
cmp edx, 0xff00
jb 0x449e90
not byte [ebp - 0x14]
xor byte [ebp - 0x13], 0xfe
push 4
mov ecx, esi
pop esi
lea eax, [esi - 1]
test eax, eax
jl 0x449ea4
lea ebx, [ebp + ecx - 0x14]
xor byte [ebx + eax], dl
shr edx, 8
dec eax
jns 0x449e9b
add ecx, esi
mov esi, dword [ebp + 0x14]
cmp ecx, 0x10
jne 0x449ebd
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00451d80
xor ecx, ecx
mov al, byte [esi]
xor byte [ebp + ecx - 0x14], al
inc ecx
inc esi
dec dword [ebp + 0x18]
jne 0x449ea9
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00451d80
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
cmp ebx, 0x10
jb 0x449f13
shr ebx, 4
mov eax, dword [esi]
xor dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
xor dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
xor dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
xor dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00451d80
sub dword [ebp + 0x20], 0x10
add esi, 0x10
dec ebx
jne 0x449ee5
cmp dword [ebp + 0x20], 0
jbe 0x449f33
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00449d95
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00451d80
push dword [ebp + 0x28]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call fcn.004421a0
add esp, 0xc
push 0x10
pop ecx
pop edi
pop esi
lea eax, [ebp - 0x14]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x449f4e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408ad6
leave
ret 0x24

Function at 0x44a23b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
not eax
cmp dword [ebp + 0x10], ecx
jbe 0x44a26b
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x45b930]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x44a24c
not eax
pop ebp
ret 0xc