joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edi
push dword [esi + 4]
push dword [esi]
call fcn.004427c0
test al, al
je 0x444398
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
push ecx
push ebx
call fcn.0043f6f0
push dword [esp + 0x2c]
mov dword [esi], eax
mov dword [esi + 4], edx
push dword [esp + 0x2c]
call fcn.00420e00
push edx
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
call fcn.00444738
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esp, 0x58
ret 0x14
mov dword [esp + 0x6c], esi
mov eax, 0x4c0b20
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call fcn.0044a170
add esp, 4
call fcn.004440a8
mov ecx, dword [esp + 0x6c]
mov esi, eax
push dword [ecx + 4]
push dword [ecx]
push 2
push 1
lea eax, [esp + 0x64]
call fcn.00453cac
mov eax, dword [eax]
call fcn.004427d4
push edx
push eax
lea edx, [esp + 0x50]
xor eax, eax
push edx
call fcn.00447520
lea eax, [esp + 0x48]
call fcn.00447568
xor al, 1
je 0x4444ae
lea eax, [esp + 0x48]
call fcn.00447570
call fcn.00453ac0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
push edx
push eax
call fcn.004427c0
test al, al
je 0x444494
mov edx, dword [esp + 0x6c]
mov edx, dword [edx]
mov ecx, dword [esp + 0x40]
lea edi, [edx + 1]
sub ecx, edi
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x44]
lea edx, [ecx + edx + 1]
mov dword [esp + 0x34], edx
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
call fcn.00444738
lea ecx, [esi + 0x10]
mov ebx, eax
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], 0x4c0800
call fcn.0044d73c
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + edx*4]
mov dword [edx - 4], ebx
lea eax, [esp + 0x48]
call fcn.00447580
lea eax, [esp + 0x48]
call fcn.00447568
xor al, 1
jne 0x4443f9
mov eax, esi
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esp, 0x58
ret 0x14
Function at 0x44d53c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x44d717
push edx
mov edx, 2
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x44d55d
sub esp, 0x28
lea eax, [ebp - 0x2014]
push eax
mov eax, 0x1000
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], esi
mov dword [ebp - 0x2030], edi
call fcn.0045d3bc
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov ecx, 0x44d724
mov edx, 0x4c2180
push eax
mov eax, 0xd41
push ecx
push 0
push edx
push 0xa
call fcn.0045d3c4
mov ebx, eax
cmp eax, 0x1000
jae 0x44d5ea
lea esi, [ebp - 0x2014]
push esi
push ebx
call fcn.0045d41c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x2038]
mov esi, dword [ebp - 0x2034]
mov edi, dword [ebp - 0x2030]
mov esp, ebp
pop ebp
ret
mov eax, ebx
call fcn.0045d42c
mov dword [ebp - 0x2024], eax
lea eax, [ebp - 0x2024]
push 2
call fcn.0045d448
mov dword [ebp - 0x2020], eax
lea eax, [ebp - 0x2020]
call fcn.0045d45c
mov dword [ebp - 0x203c], eax
call fcn.004a9378
mov dword [ebp - 0x201c], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2024]
call fcn.0045d45c
mov edi, dword [ebp - 0x201c]
mov esi, eax
push dword [ebp - 0x201c]
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
je 0x44d660
lea eax, [ebp - 0x2024]
push ebx
call fcn.0045d464
test eax, eax
jg 0x44d664
xor edx, edx
jmp 0x44d669
mov edx, 1
mov ecx, 0x44d730
mov eax, 0xd4e
push edx
mov edx, 0x4c2180
push ecx
push 0
push edx
push 0xa
call fcn.0045d478
push dword [ebp - 0x201c]
push ebx
call fcn.0045d41c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x202c], eax
mov dword [ebp - 0x2028], edx
call fcn.0044d6de
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov edx, dword [ebp - 0x2028]
mov eax, dword [ebp - 0x202c]
mov ebx, dword [ebp - 0x2038]
mov esi, dword [ebp - 0x2034]
mov edi, dword [ebp - 0x2030]
mov esp, ebp
pop ebp
ret

Function at 0x44fb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ecx
ret
Function at 0x451b38
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0x30
mov dword [esp + 0x1c], esi
mov esi, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], edi
mov ebx, dword [eax + 0x9c8]
mov edi, ebx
dec edi
jns 0x451b5d
mov edi, 0x26f
mov ebp, ebx
mov eax, dword [esi + 0x9c0]
add ebp, 0xfffffe73
jns 0x451b73
lea ebp, [ebx + 0xe3]
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
cmp ebx, 0x270
jae 0x451c37
mov edx, dword [esi + ebx*4]
and edx, 0x80000000
cmp edi, 0x270
mov dword [esp + 0x24], edx
jae 0x451c5f
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
mov edx, dword [esi + edi*4]
and edx, 0x7fffffff
xor eax, ecx
or edx, dword [esp + 0x24]
mov ecx, eax
shl ecx, 0xf
mov dword [esp + 0x28], edx
and ecx, 0xefc60000
shr edx, 1
xor eax, ecx
test dword [esp + 0x28], 1
je 0x451bdc
xor edx, 0x9908b0df
cmp ebp, 0x270
jae 0x451c87
mov ecx, dword [esi + ebp*4]
xor ecx, edx
mov dword [esp + 0x2c], ecx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
cmp ebx, 0x270
jae 0x451caf
lea ebp, [esi + ebx*4]
mov edx, dword [esp + 0x2c]
mov dword [ebp], edx
mov ecx, dword [ebp]
mov dword [esi + 0x9c0], ecx
mov dword [esi + 0x9c8], edi
mov dword [esi + 0x9c4], eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x30
ret
mov dword [esp + 0x10], 0x270
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3cc
mov dword [esp], 0x4c29c0
call fcn.00449d20
mov dword [esp + 0x10], 0x270
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3cd
mov dword [esp], 0x4c29c0
call fcn.00449d20
mov dword [esp + 0x10], 0x270
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3d4
mov dword [esp], 0x4c29c0
call fcn.00449d20
mov dword [esp + 0x10], 0x270
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3d6
mov dword [esp], 0x4c29c0
call fcn.00449d20
int3
Function at 0x455ae8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x455c54
push edx
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], eax
mov cl, byte [0x5104cc]
mov byte [ebp - 0x1c], cl
mov byte [0x5104cc], 1
mov dword [ebp - 4], 0
mov ebx, eax
mov edi, eax
add edi, 0xc
push edi
mov edx, 0x4616c8
mov esi, dword [eax + 0x24]
push 4
add ebx, 8
push eax
push edx
push esi
push 0
call fcn.004a9dcc
mov dword [ebx], eax
add esp, 0x18
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 8], 0
jne 0x455b61
mov ebx, 0x4c3390
push ebx
push 0x15
call fcn.0046186c
mov esi, 0x510304
mov ebx, 0x5102f8
push esi
call sub.KERNEL32.DLL_EnterCriticalSection
mov dword [ebp - 4], 1
inc dword [0x510358]
mov eax, dword [0x510358]
shl eax, 2
push eax
push dword [0x510354]
call fcn.004a93a4
mov dword [0x510354], eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [0x510358]
lea ebx, [eax + ecx*4]
mov dword [ebx - 4], edx
add esp, 8
mov esi, dword [ebp - 0x18]
push dword [esi + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x455bc9
mov eax, 0x4c33b0
push eax
push 0x15
call fcn.0046186c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push ecx
push 0x4c32d0
call fcn.004540c0
add esp, 0xc
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret

Function at 0x457f4c
Capabilities:
Delete file

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_DeleteFileW
push eax
mov eax, 0x4c2180
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0xc]
push eax
mov eax, 0x415
push 0xa
call fcn.00462d2c
pop eax
ret 8

Function at 0x457f78
Capabilities:
Move file

Disassembly:
sub esp, 0xc
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push 1
push dword [esp + 0xc]
push ebx
call sub.KERNEL32.DLL_MoveFileExW
test eax, eax
jne 0x457ff5
mov eax, dword [esp + 0x20]
or eax, dword [esp + 0x1c]
jne 0x457fba
mov dword [esp], ebx
call fcn.004a9390
mov ecx, ebx
push ebx
push eax
call fcn.00462ddc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x18]
or edx, dword [esp + 0x14]
jne 0x457fe3
mov ebx, dword [esp + 8]
mov dword [esp], ebx
call fcn.004a9390
mov ecx, dword [esp + 8]
push ecx
push eax
call fcn.00462ddc
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push 0
lea eax, [esp + 0x10]
mov edx, 0x458000
push edx
push eax
call fcn.0044c084
mov ebx, dword [esp + 4]
add esp, 0xc
ret 0x14
Function at 0x458068
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
test al, al
mov dword [esp], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
je 0x4580ea
push 0
push 0x8000080
push 4
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
cmp eax, 0xffffffff
setne cl
mov edx, 0x4c2180
mov eax, 0x35b
push ecx
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edx
push 0xa
call fcn.00420a4c
push 2
push 0
push 0
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
setne cl
push ecx
mov edx, 0x4c2180
mov eax, 0x35c
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edx
push 0xa
call fcn.00420a4c
jmp 0x458126
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
cmp eax, 0xffffffff
setne cl
mov edx, 0x4c2180
mov eax, 0x367
push ecx
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edx
push 0xa
call fcn.00420a4c
mov dword [esp + 0x1c], ebx
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x45816c
push 0
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x18]
push ecx
sub edx, ebx
mov ecx, 0x40000000
cmp edx, ecx
jae 0x45814c
mov esi, edx
jmp 0x45814e
mov esi, ecx
mov edx, dword [esp + 0x20]
add edx, ebx
push esi
push edx
push edi
call sub.KERNEL32.DLL_WriteFile
cmp dword [esp + 0xc], esi
jne 0x45816c
add ebx, dword [esp + 0xc]
cmp ebx, dword [esp + 0x14]
jne 0x458132
cmp ebx, dword [esp + 0x14]
jne 0x45817c
push edi
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
jne 0x458180
xor ecx, ecx
jmp 0x458185
mov ecx, 1
mov edx, 0x4c2180
mov eax, 0x374
push ecx
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push edx
push 0xa
call fcn.00420a4c
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x10
ret 0x14

Function at 0x4582e8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x20
lea ecx, [esp + 4]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
push ecx
call fcn.00458288
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
je 0x458350
lea eax, [esp + 4]
call fcn.0045a484
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
call fcn.0045a584
mov ecx, dword [eax]
push ecx
lea eax, [esp + 0x18]
call fcn.0045a580
pop ecx
sub ecx, dword [eax]
add ebx, ecx
lea eax, [esp + 4]
call fcn.0045a550
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
jne 0x45830f
mov eax, ebx
mov ebx, dword [esp]
add esp, 0x20
ret
Function at 0x45b0f8
Capabilities:
Get file size

Disassembly:
sub esp, 0x14
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [esp + 8], 0
push edx
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
setne bl
mov byte [esp + 0xc], bl
je 0x45b14c
push eax
mov eax, dword [esp + 0xc]
call fcn.00461f10
mov esi, dword [esp + 0x10]
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, byte [esp + 0xc]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x14
ret 4

Function at 0x45b160
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x24]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
or ecx, dword [esp + 0x1c]
je 0x45b200
push 0
lea edx, [esp + 0x18]
mov eax, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
sub eax, dword [esp + 0x14]
sbb edx, dword [esp + 0x18]
push edx
push eax
mov eax, 0xffff0000
call fcn.00464934
mov ecx, dword [esp + 0x14]
add ecx, esi
push eax
mov ebx, eax
push ecx
push edi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x45b1cd
cmp dword [esp + 0x14], ebx
je 0x45b1e0
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x18
xor eax, eax
ret 0x10
mov eax, ebx
xor edx, edx
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x20]
jne 0x45b190
cmp eax, dword [esp + 0x1c]
jne 0x45b190
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x18
mov eax, 1
ret 0x10
Function at 0x45bc50
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov ecx, 9
xor eax, eax
mov dword [esp], edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [esp + 8]
mov dword [0x5104d4], edx
mov edi, dword [esp]
add esp, 0x28
ret

Function at 0x45c90c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], ebp
mov ebp, eax
test ebp, ebp
mov dword [esp + 8], esi
mov esi, dword [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 0xc], edi
je 0x45c935
mov ecx, dword [esi]
mov eax, esi
call dword [ecx + 0x20]
mov ebx, eax
test eax, eax
jne 0x45c94c
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
xor eax, eax
ret 8
mov eax, esi
call fcn.0045c9e8
xor al, 1
je 0x45c98e
mov esi, ebx
imul esi, ebp
mov edi, dword [esp + 0x20]
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
push edx
push eax
xor eax, eax
call fcn.0040eb5c
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
ret 8
mov dword [esp + 0x18], ebx
xor edi, edi
xor ebx, ebx
test ebp, ebp
je 0x45c9cf
mov edx, ebx
imul edx, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, esi
add edx, dword [esp + 0x20]
push edx
call dword [ecx + 0x14]
inc ebx
imul edx, eax, 0xcc9e2d51
rol edx, 0xf
imul ecx, edx, 0x1b873593
xor ecx, edi
rol ecx, 0xd
lea edx, [ecx + ecx*4 - 0x19ab949c]
mov edi, edx
cmp ebx, ebp
jb 0x45c99a
mov eax, edi
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
ret 8

Function at 0x45e4d8
Capabilities:
Create directory

Disassembly:
push eax
push 0
mov eax, dword [esp + 4]
add eax, 0xfffffee4
call fcn.00420314
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
pop ecx
ret

Function at 0x461094
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov ecx, 9
xor eax, eax
mov dword [esp], edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
push 1
mov eax, dword [esp + 0x1c]
call fcn.0043dfd4
mov edi, dword [esp]
add esp, 0x28
ret
Function at 0x4611bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], edi
mov edi, 0xffff
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov esi, dword [ecx]
cmp esi, dword [esp + 0x30]
jae 0x46138f
mov ecx, dword [esp + 0x34]
movzx ebx, byte [ecx + esi]
test bl, 0x80
je 0x461329
mov byte [esp + 0x24], bl
mov edx, 1
movzx ecx, byte [esp + 0x24]
mov ebx, ecx
mov al, bl
mov cl, dl
shl al, cl
test al, 0x80
jne 0x46121e
mov bl, byte [esp + 0x24]
cmp edx, 1
je 0x461347
jmp 0x46122a
inc edx
cmp edx, 4
ja 0x461347
jmp 0x461205
mov ecx, 7
mov edi, 1
sub ecx, edx
shl edi, cl
dec edi
movzx ecx, bl
and edi, ecx
lea ecx, [edx + esi - 1]
cmp ecx, dword [esp + 0x30]
jae 0x461347
lea ecx, [esi + 1]
cmp ecx, dword [esp + 0x30]
jae 0x4613b7
mov ecx, dword [esp + 0x34]
add ecx, esi
movzx eax, byte [ecx + 1]
mov cl, bl
and cl, 0xfe
cmp cl, 0xc0
je 0x461347
cmp bl, 0xe0
jne 0x461287
mov cl, al
and cl, 0xe0
cmp cl, 0x80
je 0x461347
cmp bl, 0xf0
jne 0x46129a
mov cl, al
and cl, 0xf0
cmp cl, 0x80
je 0x461347
cmp bl, 0xf8
jne 0x4612ad
mov cl, al
and cl, 0xf8
cmp cl, 0x80
je 0x461347
cmp bl, 0xfc
jne 0x4612c0
mov cl, al
and cl, 0xfc
cmp cl, 0x80
je 0x461347
mov ebx, 1
cmp edx, ebx
je 0x461301
lea ecx, [ebx + esi]
cmp ecx, dword [esp + 0x30]
jae 0x4613df
lea ecx, [ebx + esi]
mov eax, dword [esp + 0x34]
movzx ecx, byte [ecx + eax]
mov byte [esp + 0x24], cl
and cl, 0xc0
cmp cl, 0x80
jne 0x461347
mov cl, byte [esp + 0x24]
shl edi, 6
inc ebx
and ecx, 0x3f
or edi, ecx
cmp ebx, edx
jne 0x4612c9
cmp edi, 0xd800
jb 0x46131b
lea ecx, [edi - 0xe000]
cmp ecx, 0x101fff
jbe 0x46131b
xor ecx, ecx
jmp 0x461320
mov ecx, 1
xor cl, 1
jne 0x461347
add esi, edx
jmp 0x46132d
movzx edi, bl
inc esi
mov edx, dword [esp + 0x28]
mov eax, edi
mov dword [edx], esi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x2c
ret 8
mov ecx, 0x4da790
mov ebx, 0x17
mov edx, 0x4da7b0
mov dword [esp + 0x14], 0x124
mov eax, 0x16
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045f578
mov eax, edi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x2c
ret 8
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xdf
mov dword [esp], 0x4da790
call fcn.00449d20
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x107
mov dword [esp], 0x4da790
call fcn.00449d20
mov dword [esp + 8], 0
mov edx, dword [esp + 0x30]
lea ecx, [esi + ebx]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x111
mov dword [esp], 0x4da790
call fcn.00449d20
int3
Function at 0x46291c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x462a0f
push edx
mov dword fs:[0], esp
sub esp, 0x6c
mov dword [ebp - 0x78], ebx
mov ebx, eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], edi
mov dword [ebp - 4], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
push eax
lea eax, [ebp - 0x6c]
call fcn.0046c52c
lea ecx, [ebp - 0x2c]
lea eax, [ebp + 8]
push ecx
call fcn.00458288
lea eax, [ebp - 0x2c]
call fcn.0045a560
xor al, 1
je 0x4629a9
lea eax, [ebp - 0x2c]
call fcn.0045a484
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x6c]
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push dword [ebp - 0x18]
push 1
call fcn.0046c5e8
lea eax, [ebp - 0x2c]
call fcn.0045a550
lea eax, [ebp - 0x2c]
call fcn.0045a560
xor al, 1
jne 0x462977
push ebx
lea eax, [ebp - 0x6c]
call fcn.0046c674
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004629e3
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
mov edi, dword [ebp - 0x70]
mov esp, ebp
pop ebp
ret 8
Function at 0x464574
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x4646f5
push edx
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x54], esi
mov esi, eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
call fcn.0046d444
lea ecx, [ebp - 0x4c]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp + 8]
push ecx
call fcn.0042c7e8
mov dword [ebp - 4], 1
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x4c]
push edx
call fcn.0045835c
lea eax, [ebp - 0x3c]
call fcn.0045843c
xor al, 1
je 0x464636
lea eax, [ebp - 0x3c]
call fcn.00458434
mov ebx, eax
call fcn.00458bd0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], edx
call fcn.00458d88
xor al, 1
je 0x464622
lea eax, [ebp - 0x24]
call fcn.00458d04
mov ebx, eax
push eax
lea eax, [ebp + 8]
call fcn.0042c9e0
lea eax, [ebp - 0x24]
call fcn.00458dc0
lea eax, [ebp - 0x24]
call fcn.00458d88
xor al, 1
jne 0x4645fb
lea eax, [ebp - 0x3c]
call fcn.00458448
lea eax, [ebp - 0x3c]
call fcn.0045843c
xor al, 1
jne 0x4645da
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ebx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
call fcn.0042c604
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
lea ecx, [ebp - 0xc]
mov eax, esi
push esi
push 0xffffffffffffffff
push ecx
mov dword [esi + 4], edx
push 0x4e2480
call fcn.004540c0
add esp, 0xc
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0x50]
mov esp, ebp
pop ebp
ret 8