joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436e00
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 0
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], 0x436d30
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], str.About_Windows
movups xmm0, xmmword [ebp - 0x30]
mov dword [ebp - 4], 0
push 0x4b6ee4
movups xmmword [0x4b6ee4], xmm0
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [0x4b6ef4], xmm0
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [0x4b6f04], xmm0
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp byte [0x4b6e99], 0
jne 0x436f46
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00439490
cmp dword [eax + 0x10], 0
je 0x436f35
push 0x4b7288
call fcn.00439490
mov eax, dword [eax + 0x10]
push eax
call edi
push 0x4b72b0
call fcn.00439490
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x4b72b0]
mov dword [0x4b7288], eax
mov eax, dword [0x4b72b4]
mov dword [0x4b728c], eax
call fcn.00439490
mov ecx, dword [0x4b7290]
mov dword [eax + 0x1c], ecx
call fcn.00439490
mov ecx, dword [0x4b7294]
mov dword [eax + 0x18], ecx
call fcn.00439490
cmp dword [eax + 0x1c], 0x3e8
jle 0x436f35
call fcn.00439490
movzx ecx, byte [0x4b6e99]
cmp dword [eax + 0x18], 0x2bc
mov eax, 1
cmovg ecx, eax
mov byte [0x4b6e99], cl
push 0x64
call esi
cmp byte [0x4b6e99], 0
je 0x436ea3
push 0
push 0
push 0
push 0
call fcn.00439490
mov eax, dword [eax + 0x18]
push eax
call fcn.00439490
mov eax, dword [eax + 0x1c]
push eax
call fcn.00439490
mov eax, dword [eax + 0x28]
push eax
call fcn.00439490
mov eax, dword [eax + 0x20]
push eax
push 0x90000000
push str.Winver
push str.About_Windows
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0x49dbc4
push eax
mov dword [0x4b6f14], eax
call dword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
push 0x800a0
push 0xffffffffffffffec
push dword [0x4b6f14]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 5
push dword [0x4b6f14]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b6f14]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x437000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
movaps xmm0, xmmword [0x493af0]
xor eax, eax
movups xmmword [esp + 0x1a], xmm0
push ebx
movaps xmm0, xmmword [0x4938b0]
push esi
movups xmmword [esp + 0x32], xmm0
mov dword [esp + 0x42], 0x6a76767a
mov word [esp + 0x46], 0x100
lea ecx, [eax - 0x13]
xor byte [esp + eax + 0x22], cl
inc eax
cmp eax, 0x24
jb 0x437034
lea ecx, [esp + 0x22]
mov byte [esp + 0x47], 0
mov dword [esp + 0x18], 0
lea edx, [ecx + 1]
mov dword [esp + 0x1c], 0xf
mov byte [esp + 8], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437062
sub ecx, edx
lea eax, [esp + 0x22]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.0043b330
call fcn.004633ac
xor edx, edx
mov esi, dword [esp + 0x1c]
mov ecx, 0x18
div ecx
mov ecx, 0x17
mov eax, edx
xor edx, edx
div ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 8]
cmp esi, 0x10
cmovae eax, ecx
mov bl, byte [eax + edx + 1]
jb 0x4370d2
lea edx, [esi + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x4370c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4370da
push edx
push ecx
call fcn.0043f63c
add esp, 8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00465175
int3

Function at 0x4371a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x38], 0
je 0x4371c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x37
jb 0x4371b0
mov byte [esi + 0x38], 0
mov eax, esi
pop esi
ret
Function at 0x438540
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4a], 0
je 0x438562
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x49
jb 0x438550
mov byte [esi + 0x4a], 0
mov eax, esi
pop esi
ret

Function at 0x438570
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x6f], 0
je 0x438592
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x6e
jb 0x438580
mov byte [esi + 0x6f], 0
mov eax, esi
pop esi
ret
Function at 0x438ba0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x48], 0
je 0x438bc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x47
jb 0x438bb0
mov byte [esi + 0x48], 0
pop esi
ret

Function at 0x438bd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x438bf2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x438be0
mov byte [esi + 0x29], 0
pop esi
ret

Function at 0x438cf0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x438d12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x438d00
mov byte [esi + 3], 0
pop esi
ret

Function at 0x438d20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x438d42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x438d30
mov byte [esi + 0x1c], 0
pop esi
ret

Function at 0x438d50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x438d72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x2b
jb 0x438d60
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x438d80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xff], 0
je 0x438da7
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0xfe
jb 0x438d90
mov byte [esi + 0xff], 0
pop esi
ret

Function at 0x438db0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x438dd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x1f
jb 0x438dc0
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x438de0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x438e02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x438df0
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x438e10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x55], 0
je 0x438e32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x54
jb 0x438e20
mov byte [esi + 0x55], 0
pop esi
ret

Function at 0x438e40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4f], 0
je 0x438e62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x4e
jb 0x438e50
mov byte [esi + 0x4f], 0
pop esi
ret
Function at 0x438e70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x49], 0
je 0x438e92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x48
jb 0x438e80
mov byte [esi + 0x49], 0
pop esi
ret

Function at 0x438eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3a], 0
je 0x438ed2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x39
jb 0x438ec0
mov byte [esi + 0x3a], 0
pop esi
ret

Function at 0x438ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2a], 0
je 0x438f02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x438ef0
mov byte [esi + 0x2a], 0
pop esi
ret

Function at 0x438f10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x438f32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x438f20
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x438f40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x37], 0
je 0x438f62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x36
jb 0x438f50
mov byte [esi + 0x37], 0
pop esi
ret

Function at 0x438f70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3d], 0
je 0x438f92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x3c
jb 0x438f80
mov byte [esi + 0x3d], 0
pop esi
ret

Function at 0x438fa0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa0], 0
je 0x438fc7
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x9f
jb 0x438fb0
mov byte [esi + 0xa0], 0
pop esi
ret

Function at 0x438fd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4d], 0
je 0x438ff2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x4c
jb 0x438fe0
mov byte [esi + 0x4d], 0
pop esi
ret

Function at 0x439000
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4c], 0
je 0x439022
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x4b
jb 0x439010
mov byte [esi + 0x4c], 0
pop esi
ret

Function at 0x439030
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x46], 0
je 0x439052
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x45
jb 0x439040
mov byte [esi + 0x46], 0
pop esi
ret
Function at 0x439060
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x28], 0
je 0x439082
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x27
jb 0x439070
mov byte [esi + 0x28], 0
pop esi
ret

Function at 0x439090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x25], 0
je 0x4390b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x24
jb 0x4390a0
mov byte [esi + 0x25], 0
pop esi
ret

Function at 0x4390c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x4390e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x4390d0
mov byte [esi + 0x19], 0
pop esi
ret

Function at 0x4390f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x6b], 0
je 0x439112
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x6a
jb 0x439100
mov byte [esi + 0x6b], 0
pop esi
ret

Function at 0x439130
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x439152
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x439140
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x439160
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x439182
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x439170
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x439190
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x4391b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x4391a0
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x4391c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1f], 0
je 0x4391e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x1e
jb 0x4391d0
mov byte [esi + 0x1f], 0
pop esi
ret

Function at 0x4391f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x439212
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x439200
mov byte [esi + 0x21], 0
pop esi
ret

Function at 0x439220
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x439242
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x23
jb 0x439230
mov byte [esi + 0x24], 0
pop esi
ret
Function at 0x439250
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x439272
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x1a
jb 0x439260
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x439280
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x4392a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x439290
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x4392b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x4392d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x4392c0
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x4392e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x439302
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x4392f0
mov byte [esi + 0x2b], 0
pop esi
ret

Function at 0x439310
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x439332
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x439320
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x439340
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x439362
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x439350
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x439370
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x439392
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x439380
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x4393a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x40], 0
je 0x4393c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x3f
jb 0x4393b0
mov byte [esi + 0x40], 0
pop esi
ret

Function at 0x4393d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x4393f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x4393e0
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x439400
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x439422
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x439410
mov byte [esi + 0x2e], 0
pop esi
ret
Function at 0x439430
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x439452
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x439440
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x439460
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x439482
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x439470
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x439590
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x4395b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x4395a0
mov byte [esi + 8], 0
pop esi
ret

Function at 0x4395c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x4395e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x4395d0
mov byte [esi + 5], 0
pop esi
ret

Function at 0x4395f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x439612
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x439600
mov byte [esi + 4], 0
pop esi
ret

Function at 0x439620
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x439642
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x439630
mov byte [esi + 6], 0
pop esi
ret

Function at 0x439650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x439672
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x439660
mov byte [esi + 7], 0
pop esi
ret

Function at 0x439680
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x4396a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x13]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x439690
mov byte [esi + 9], 0
pop esi
ret
Function at 0x439bc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d99a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
push esi
mov dword [ebx], 0x492ba0
push edi
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea edi, [ebx + 4]
mov eax, dword [ebx]
push 0
push edi
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0043bb80
mov dword [ebp - 4], 2
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], edi
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0043fbd2
mov esi, eax
push 1
mov byte [ebp - 4], 3
call fcn.0043da99
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.0043b580
mov byte [ebp - 4], 4
cmp dword [edi + 0x4c], 0
jne 0x439d6a
push 0x40
push 2
push dword [ebp + 8]
call fcn.0043dfca
add esp, 0xc
test eax, eax
je 0x439d6a
push 1
push eax
mov ecx, edi
call fcn.0043b580
mov eax, dword [edi + 0x34]
mov byte [ebp - 4], 5
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 6
push eax
call fcn.0043c3c0
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
call edx
test al, al
je 0x439d44
mov dword [edi + 0x38], 0
jmp 0x439d51
mov eax, dword [ebp + 8]
mov ecx, edi
mov dword [edi + 0x38], eax
call fcn.0043ba70
mov byte [ebp - 4], 7
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
test eax, eax
je 0x439d8b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
jmp 0x439d8b
mov eax, dword [ebx]
push 0
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, ebx
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00429d40
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43a040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x43a06b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043a800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x43a08d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x43a08f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x43a113
jg 0x43a0a4
test esi, esi
je 0x43a113
test ecx, ecx
jl 0x43a0ed
jg 0x43a0ae
test eax, eax
je 0x43a0ed
cmp edi, ecx
jg 0x43a0c2
jl 0x43a0b8
cmp esi, eax
jae 0x43a0c2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00456f50
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x43a0f0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x43a113
jg 0x43a0fa
test esi, esi
je 0x43a113
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x43a113
push eax
push esi
push 1
push edx
call fcn.0045bec3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc