joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d570
Capabilities:
Terminate process

Disassembly:
sub esp, 8
call fcn.0043b140
test al, al
je 0x40d5ef
call fcn.00434110
test al, al
je 0x40d5ea
mov dword [esp], 0x11397241
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x7a
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7a]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x9e
mov byte [esp + eax - 0x7a], cl
inc eax
cmp eax, 0x81
jne 0x40d5a0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d5d7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e700
test al, al
je 0x40d5ea
call fcn.00411320
call fcn.004100a0
call fcn.0043c950
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40d6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d805
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d710
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x40d7b0
cmp ebx, 0x7ff
ja 0x40d740
cmp edx, 2
jb 0x40d740
mov eax, ebx
shr eax, 6
xor al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x40d7b0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d7ca
cmp edx, 4
jb 0x40d7ca
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
and ebx, 0x9ffc00
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea eax, [ebx + edi]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov eax, edi
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d805
test edx, edx
jne 0x40d6f0
jmp 0x40d805
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d7d8
mov esi, edi
jmp 0x40d7b8
cmp edx, 3
jb 0x40d801
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x40d7b0
mov eax, ebp
jmp 0x40d7b0
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d828
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d820
test ecx, ecx
je 0x40d83c
mov ebx, ecx
jmp 0x40d820
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00409240
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x44af98]
mov dword [esp + 0x120], 0x13121910
mov word [esp + 0x124], 0
mov byte [esp + 0x126], 0
mov ecx, 0x78a87404
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x78a872e4]
xor edx, ecx
mov esi, edx
not esi
and esi, 1
mov edi, 0x14
sub edi, edx
and edx, 1
and edi, 0xfe
or edi, edx
xor edi, 0xfe
lea edx, [edi + esi*2]
mov byte [esp + ecx - 0x78a872e4], dl
inc ecx
cmp ecx, 0x78a8740b
jne 0x40e740
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x20], 0xb1658f15
mov dword [esp + 0x24], 0xb55ab35e
mov dword [esp + 0x28], 0xb922b720
mov dword [esp + 0x2c], 0xbd94bb28
mov dword [esp + 0x30], 0xa152bf58
mov dword [esp + 0x34], 0xa5a2a34c
mov word [esp + 0x38], 0
mov byte [esp + 0x3a], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xdd
xor bl, byte [esp + edx + 0x20]
add bl, 0xaf
mov byte [esp + edx + 0x20], bl
inc edx
cmp edx, 0x1b
jne case.default.0x40e813
lea edx, [esp + 0x20]
push ecx
push 0
push edx
call eax
mov ecx, 0x44af60
push eax
call fcn.0043aef0
movzx eax, al
mov eax, dword [eax*4 + 0x445ad4]
mov ecx, 0xe408cd00
xor ecx, dword [0x445adc]
add eax, ecx
inc eax
jmp eax
sbb eax, 0x29000000
ret 0xca21
invalid
retf 0xd709
Function at 0x410c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x299b2bf7
mov dword [esp + 0x40], 0x2d812f96
mov dword [esp + 0x44], 0x319e3380
mov dword [esp + 0x48], 0x35c73797
mov dword [esp + 0x4c], 0x39c83bcf
mov dword [esp + 0x50], 0x3dde3fc8
mov dword [esp + 0x54], 0x1db03d4
mov dword [esp + 0x58], 0x5b407af
mov dword [esp + 0x5c], 0x9bb0ba0
mov dword [esp + 0x60], 0xdbb0fb1
mov dword [esp + 0x64], 0x11c013ec
mov dword [esp + 0x68], 0x15f617c4
mov dword [esp + 0x6c], 0x19ea1be3
mov dword [esp + 0x70], 0x1dee1fea
mov dword [esp + 0x74], 0xe102e3e1
mov dword [esp + 0x78], 0xe549e739
mov dword [esp + 0x7c], 0xe910eb56
mov dword [esp + 0x80], 0xed13ef1c
mov dword [esp + 0x84], 0xf14af30c
mov dword [esp + 0x88], 0xf502f70a
mov dword [esp + 0x8c], 0xf91afb1b
mov dword [esp + 0x90], 0xfd4eff3f
mov dword [esp + 0x94], 0xc16ec34c
mov dword [esp + 0x98], 0xc51fc76b
mov dword [esp + 0x9c], 0xc96ccb6f
mov dword [esp + 0xa0], 0xcd61cf05
mov dword [esp + 0xa4], 0xd123d378
mov dword [esp + 0xa8], 0xd523d72b
mov dword [esp + 0xac], 0xd928db2d
mov dword [esp + 0xb0], 0xdd24df2d
mov dword [esp + 0xb4], 0xa14aa33c
mov dword [esp + 0xb8], 0xa56ea76d
mov dword [esp + 0xbc], 0xa979ab70
mov dword [esp + 0xc0], 0xad42af64
mov dword [esp + 0xc4], 0xb11eb34c
mov dword [esp + 0xc8], 0xb51bb71f
mov dword [esp + 0xcc], 0xb95abb1f
mov dword [esp + 0xd0], 0xbd15bf71
mov dword [esp + 0xd4], 0x812f8319
mov dword [esp + 0xd8], 0x85698731
mov dword [esp + 0xdc], 0x894f8b64
mov dword [esp + 0xe0], 0x8d388f20
mov dword [esp + 0xe4], 0x9121933d
mov dword [esp + 0xe8], 0x9567973b
mov dword [esp + 0xec], 0x996d9b63
mov dword [esp + 0xf0], 0x9d6c9f67
mov dword [esp + 0xf4], 0x6190636c
mov dword [esp + 0xf8], 0x65946790
mov dword [esp + 0xfc], 0x698a6b94
mov dword [esp + 0x100], 0x6dc96fbd
mov dword [esp + 0x104], 0x71d573c6
mov dword [esp + 0x108], 0x75d977c6
mov dword [esp + 0x10c], 0x79817b85
mov dword [esp + 0x110], 0x7d877f8d
mov dword [esp + 0x114], 0x41b7438e
mov dword [esp + 0x118], 0x454647ba
mov eax, dword [0x44af68]
mov ecx, 0x19a23847
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x19a2380b]
lea esi, [ecx - 0x19a23800]
and esi, edx
or edx, ecx
xor edx, esi
mov esi, edx
not esi
or esi, 0x7fd4e69c
add esi, edx
or edx, 0x7fd4e69c
add edx, esi
inc edx
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx - 0x19a2380b], dl
inc ecx
cmp ecx, 0x19a23927
jne 0x410e50
lea ebx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x44611c]
mov ecx, 0xfcc0361e
xor ecx, dword [0x446124]
add eax, ecx
inc eax
jmp eax
pushfd
ror dword [ecx - 0x28373], 0xff
dec dword [ebx - 0x28773]
dec dword [ebx - 0x2836b]
dec dword [ebx - 0x1e006ef4]
dec dword [ebx - 0x28773]
dec dword [ebx - 0x2836b]
dec dword [ebx - 0x1e006ef4]
xor ecx, ecx
sub eax, 0x12915635
sete cl
mov dword [ebp - 0x234], ecx
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov eax, dword [eax + ecx*4]
jmp eax
Function at 0x417e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1148
call fcn.0040cd20
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x417eb0
add ecx, eax
add ecx, 0xfffffffe
mov esi, eax
not esi
and esi, ecx
add esi, esi
xor ecx, eax
sub esi, ecx
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44c2ac]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x417ef4
mov eax, 0xffffffff
jmp 0x417ef7
lea eax, [ebx + ebx]
push eax
call fcn.0040cdc0
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44c2ac]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x417f2c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cdc0
add esp, 4
mov esi, eax
mov dword [esp + 0x144], 0x8fd28924
mov dword [esp + 0x148], 0x83358d2d
mov dword [esp + 0x14c], 0x87e68134
mov dword [esp + 0x150], 0x9b3f852e
mov dword [esp + 0x154], 0x9f29992e
mov dword [esp + 0x158], 0x93219d25
mov dword [esp + 0x15c], 0x97969122
mov word [esp + 0x160], 0
mov byte [esp + 0x162], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa2
xor cl, byte [esp + eax + 0x144]
add cl, 0xd6
mov byte [esp + eax + 0x144], cl
inc eax
cmp eax, 0x1f
jne 0x417fa0
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x417ff1
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417fe0
mov word [eax], 0
movzx ecx, word [esp + 0x144]
test cx, cx
je 0x418021
lea edx, [esp + 0x146]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418010
mov word [eax], 0
lea eax, [esp + 0xb0]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.004404e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4468c0]
Function at 0x420a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x420a90
cmp eax, 0xffffffed
jge 0x420aa7
mov eax, 0xffffffff
jmp 0x420aaa
add eax, 0x12
push eax
call fcn.0040cdc0
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x63f961cc
mov dword [esp + 4], 0x67ef65c1
mov dword [esp + 8], 0x5b84598c
mov dword [esp + 0xc], 0x5ffc5df8
mov word [esp + 0x10], 0x5150
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
xor eax, eax
mov ecx, 0x48abd98
mov edx, 0x7b754267
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x48abd98]
mov ebp, ecx
xor ebp, ebx
lea esi, [ebp*2]
not esi
add esi, ebp
or esi, edx
add esi, eax
add esi, esi
sub ebx, esi
lea esi, [ecx + ebx]
lea ebp, [ecx + ebx]
add ebp, 0xe034d0d5
xor ebp, 0x304dff
lea ebx, [esi*2 - 0x3f965e56]
add ebx, ebp
and ebp, 1
or ebx, 1
add ebx, ebp
inc bl
mov byte [esp + ecx - 0x48abd98], bl
inc eax
inc ecx
dec edx
cmp ecx, 0x48abdaf
jne 0x420b00
movzx ecx, word [edi]
mov esi, dword [esp + 0x18]
mov eax, esi
test cx, cx
je 0x420b81
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420b70
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420bb1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420ba0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440670
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446e60]
Function at 0x429930
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x429950
lea esi, [ebx + 1]
push esi
call fcn.0040cdc0
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x4299b3
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x429a64
neg ebx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, edx
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, eax
shl edx, 0x1e
sar edx, 0x1f
and edx, 0xedb88320
xor edx, esi
mov edi, eax
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, eax
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, eax
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, edi
xor eax, esi
mov esi, edx
shr esi, 6
xor eax, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0xedb88320
xor edx, ecx
inc ebp
inc ebx
jne 0x4299c0
not edx
mov eax, dword [esp + 4]
mov dword [eax + 4], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp 0x429a55
Function at 0x4367a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x4367c0
add edx, ecx
add edx, 0xfffffffe
mov esi, ecx
not esi
and esi, edx
xor edx, ecx
add esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
sub esi, edx
mov dword [esp], 0xd2cecc59
mov byte [esp + 4], 0
mov ebx, 0xd2
mov ebp, 0x2d
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebp - 0x2d]
mov edi, ebp
or edi, edx
not edx
or edx, ebx
and edx, edi
add dl, 0x1f
mov byte [esp + ebp - 0x2d], dl
dec ebx
inc ebp
cmp ebp, 0x32
jne 0x436800
mov edx, dword [esp + 8]
cmp dword [esp + 0xc], edx
je 0x43688e
mov edx, dword [esp]
sar esi, 1
lea edi, [esi - 1]
mov ebx, esi
and ebx, 3
je 0x436851
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
dec esi
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, edx
mov ebp, eax
dec ebx
jne 0x436840
cmp edi, 3
jb 0x43688e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, edx
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, edx
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, edx
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, edx
add edi, 4
cmp esi, edi
jne 0x436860
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.00440bc0
add esp, 0x14
test eax, eax
js 0x4378c9
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00440fb0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x4377fa
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc ecx
jns 0x4377c8
mov eax, 0xffffffff
jmp 0x4377cf
lea eax, [eax*2 + 2]
push eax
call fcn.0040cdc0
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00441580
add esp, 0x14
test eax, eax
jns 0x4377fa
push esi
call fcn.0040cdd0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x9c9d9a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 4]
mov ebx, edi
xor ebx, 0x711d51a6
lea ecx, [edi + edi]
and ecx, 2
mov ebp, ecx
sub ebp, ebx
mov ebx, ebp
xor ebx, 0x14
mov eax, edx
xor eax, 0x6b
and eax, ebx
xor ebp, 0xeb
xor edx, 0x14
and edx, ebp
or edx, eax
add dl, 0x3e
mov byte [esp + edi + 4], dl
xor edi, 1
add edi, ecx
cmp edi, 7
jb 0x437820
mov ecx, dword [0x44c2b0]
test ecx, ecx
je 0x4378ad
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x437890
inc edi
cmp ecx, edi
jne 0x437880
jmp 0x4378ad
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4378ad
push dword [esp + 0xc]
push 1
push ecx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x10
test esi, esi
jne 0x4378cb
lea eax, [esp + 4]
push eax
call fcn.004402f0
add esp, 4
test al, al
je 0x4378c9
cmp dword [esp + 4], 1
je 0x4378cb
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4394f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xf1feff8c
mov word [esp + 4], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov ebx, ecx
and ebx, 0xa
mov esi, edx
xor esi, 0x1c4fe355
add esi, ebx
mov ebp, esi
and ebp, edi
mov eax, ebp
and eax, 0x7d
mov ebx, ebp
or ebx, 0xfffffffd
inc ebx
imul ebx, eax
mov eax, ebp
and eax, 2
or ebp, 2
imul ebp, eax
sub ebx, ebp
add esi, edi
mov edi, 0x5bc4f17f
sub edi, esi
sub edi, ebx
add ebx, esi
add ebx, 0xa43b0f00
not edi
and edi, 0x56
or ebx, 0x56
add ebx, edi
inc bl
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 6
jne 0x439510
mov eax, dword [esp]
mov ecx, dword fs:[eax]
push dword [esp + 0x1c]
push 0
push dword [ecx + 0x18]
call dword [0x4542d4]
mov ecx, dword [0x449b2c]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx

Function at 0x4395a0
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449b34]
Function at 0x439600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x5a
xor cl, byte [esp + eax]
add cl, 0x3e
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x439630
mov edi, dword [esp]
mov eax, dword [0x44c2b0]
test eax, eax
je 0x439696
xor ecx, ecx
mov edx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x439670
inc ecx
cmp eax, ecx
jne 0x439660
jmp 0x439696
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x439696
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xa3e2e1e4
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x28
xor cl, byte [esp + eax]
add cl, 0x38
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x4396b0
cmp edi, dword [esp]
jne 0x4397d5
push dword [esp + 0xc]
call fcn.004394f0
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0x5a
xor cl, byte [esp + edx]
add cl, 0x3e
mov byte [esp + edx], cl
inc edx
cmp edx, 7
jne 0x439700
mov edi, dword [esp]
mov edx, dword [0x44c2b0]
test edx, edx
je 0x43976c
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44c2b4]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x439742
inc ebp
cmp edx, ebp
jne 0x439730
mov ebp, ecx
jmp 0x43976c
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43976c
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push edx
push dword [0x44c2b8]
mov esi, eax
call fcn.0043ca30
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x4397cc
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x4397a5
add edi, 2
cmp si, bp
je 0x439790
cmp si, bp
je 0x4397b7
mov esi, dword [ecx]
test esi, esi
jne 0x439780
mov edi, 0xc0000225
jmp 0x4397cc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.004395a0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x439820
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x4398d0
xor eax, eax
cmp dword [ecx], 0
jne 0x43990f
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov ebx, eax
add bl, 0x5a
xor bl, byte [esp + eax]
add bl, 0x3e
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x439890
mov eax, dword [esp]
mov esi, dword [0x44c2b0]
test esi, esi
je 0x43990f
xor edi, edi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x439918
inc edi
cmp esi, edi
jne 0x4398c0
jmp 0x43990f
mov dword [esp + 8], 0x599a9b94
mov eax, 0x1b
mov ecx, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x13]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x79
mov byte [esp + eax - 0x13], dl
inc eax
dec ecx
cmp eax, 0x1f
jne 0x4398f0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43990f
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x1c
jmp 0x43990f

Function at 0x439950
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4399ea
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x5a
xor bl, byte [esp + edx]
add bl, 0x3e
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x439980
mov edx, dword [0x44c2b0]
test edx, edx
je 0x4399de
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4399c0
inc edi
cmp edx, edi
jne 0x4399b0
jmp 0x4399de
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4399de
push eax
push 1
push edx
push dword [0x44c2b8]
mov esi, ecx
call fcn.0043ca30
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x439c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x439cea
push 0xbbf966b4
push dword [0x44c2a4]
call fcn.0043f9e0
add esp, 8
test eax, eax
je 0x439cb5
mov ecx, dword [esi]
test ecx, ecx
je 0x439ce7
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x439cc3
cmp dword [esp], 0
je 0x439cc3
mov dword [esi + 4], 3
jmp 0x439ce7
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x439d53
lea eax, [esp + 8]
push eax
call fcn.004402f0
add esp, 4
test al, al
je 0x439ce7
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x439ce4
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x439d53
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x5a
xor dl, byte [esp + eax]
add dl, 0x3e
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x439d10
mov eax, dword [esp]
mov edx, dword [0x44c2b0]
test edx, edx
je 0x439dd4
xor esi, esi
mov ebx, dword [0x44c2b4]
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x439db0
inc esi
cmp edx, esi
jne 0x439d40
jmp 0x439dd4
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x5a
xor dl, byte [esp + eax]
add dl, 0x3e
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x439d70
mov eax, dword [esp]
mov edx, dword [0x44c2b0]
test edx, edx
je 0x439dd4
xor esi, esi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x439db0
inc esi
cmp edx, esi
jne 0x439da0
jmp 0x439dd4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x439dd4
push dword [esp + 0x2c]
push edi
push ebp
push dword [esp + 0x2c]
push ecx
push 5
push edx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10