joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417030
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x417050
sar esi, 1
lea edi, [esp + 0x6c]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44d624]
mov ebx, dword [esp + 0x6c]
test ebx, ebx
jns 0x41707f
mov eax, 0xffffffff
jmp 0x417082
lea eax, [ebx + ebx]
push eax
call fcn.00408fc0
add esp, 4
push edi
mov edi, eax
push ebx
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44d624]
mov dword [esp + 0x20], 0x33403552
mov dword [esp + 0x24], 0x2fbd31ad
mov dword [esp + 0x28], 0x2b0c2da2
mov dword [esp + 0x2c], 0x27b32940
mov dword [esp + 0x30], 0x23a925a8
mov dword [esp + 0x34], 0x5fb121b5
mov dword [esp + 0x38], 0x5b5c5dcc
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x43], 0
mov ecx, 0xc57829
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0xc57809]
xor edx, ecx
mov dword [esp + 0x8c], edx
mov edx, dword [esp + 0x8c]
mov esi, edx
not esi
and esi, 0x1f
and edx, 0xe0
sub edx, esi
mov byte [esp + ecx - 0xc57809], dl
cmp ecx, 0xc5784f
je 0x41716c
movzx edx, byte [esp + ecx - 0xc57808]
lea esi, [ecx + 1]
xor esi, edx
mov dword [esp + 0x8c], esi
mov edx, dword [esp + 0x8c]
mov esi, edx
not esi
and esi, 0x1f
and edx, 0xe0
sub edx, esi
mov byte [esp + ecx - 0xc57808], dl
add ecx, 2
jmp 0x417100
mov dword [esp + 0x1c], edi
lea edi, [esp + 0xb8]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x6c]
mov ecx, eax
add ecx, 0xd
jns 0x4171a6
mov eax, 0xffffffff
jmp 0x4171ad
lea eax, [eax*2 + 0x1a]
mov esi, dword [esp + 0x1c]
push eax
call fcn.00408fc0
add esp, 4
mov edi, eax
movzx ecx, word [esi]
test cx, cx
je 0x4171e1
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4171d0
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x417211
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417200
mov word [eax], 0
lea eax, [esp + 0x64]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.004407b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4480e4]

Function at 0x418990
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
jmp dword [eax*4 + 0x448264]
Function at 0x420720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov dword [esp + 8], 0x4b93558d
mov dword [esp + 0xc], 0x4fd849da
mov dword [esp + 0x10], 0x43ab4d8a
mov dword [esp + 0x14], 0x47a741d6
mov dword [esp + 0x18], 0x7ba8459d
mov dword [esp + 0x1c], 0x7fe0798e
mov dword [esp + 0x20], 0x73ee7df5
mov dword [esp + 0x24], 0x77eb7196
mov dword [esp + 0x28], 0x6b9275e0
mov dword [esp + 0x2c], 0x6ffe69f5
mov dword [esp + 0x30], 0x63806d8a
mov dword [esp + 0x34], 0x67f66192
mov dword [esp + 0x38], 0x1bfe65f7
mov dword [esp + 0x3c], 0x1f841985
mov dword [esp + 0x40], 0x13891d85
lea eax, [esp + 0x44]
mov word [esp + 0x44], 0x1112
mov dword [esp + 0x46], 0
mov dword [esp + 0x4a], 0
mov word [esp + 0x4e], 0
mov ecx, 0x30986418
lea edx, [esp + 8]
mov esi, 0x67b3cdf3
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
xor edi, 0x21222623
mov ebx, ecx
and ebx, 0x309821b8
add edi, ebx
add edi, 0x21222625
movzx ebx, byte [edx]
xor edi, ebx
mov dword [esp + 0x54], edi
mov ebx, dword [esp + 0x54]
add bl, 0xa5
mov byte [edx], bl
add ecx, 2
inc edx
dec esi
cmp ecx, 0x309864a8
jne 0x4207e0
lea esi, [esp + 0x54]
lea edx, [esp + 8]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 4]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44d624]
mov ebx, dword [esp + 4]
test ebx, ebx
jns 0x420860
mov eax, 0xffffffff
jmp 0x420863
lea eax, [ebx + ebx]
push eax
call fcn.00408fc0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
lea eax, [esp + 0x64]
push eax
push 0
call dword [0x44d624]
mov dword [esp + 8], 0x8338812a
mov dword [esp + 0xc], 0x9f2a9d0d
mov dword [esp + 0x10], 0x9b279922
mov dword [esp + 0x14], 0x97369528
mov dword [esp + 0x18], 0x9322912d
mov dword [esp + 0x1c], 0x6f6c6d2e
mov eax, 0x7aebbbec
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7aebbbe4]
lea edx, [eax - 1]
xor edx, ecx
mov dword [esp], edx
mov ecx, dword [esp]
add cl, 0x93
mov byte [esp + eax - 0x7aebbbe4], cl
movzx ecx, byte [esp + eax - 0x7aebbbe3]
xor ecx, eax
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x93
mov byte [esp + eax - 0x7aebbbe3], cl
add eax, 2
cmp eax, 0x7aebbc04
jne 0x4208c0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push esi
push dword [ebp + 8]
call fcn.0041a0e0
add esp, 0x14
jmp dword [0x448df0]
Function at 0x423bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.00423bf0
add esp, 4
test al, al
je 0x424420
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x118
mov dword [esp + 8], 0
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x449658]
Function at 0x436f90
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x43704d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x436ff0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0043a560
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x436fe0
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x437144
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x43712d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x4370f0
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x437144
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x437195
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.0043a560
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.0043a560
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
xor esi, esi
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
nop
nop
nop
cmp word [ecx + esi], 0
lea esi, [esi + 2]
jne 0x437ff0
cmp esi, 2
je 0x438014
lea eax, [esi - 2]
mov edx, eax
sar edx, 1
test al, 2
jne 0x43801b
cmp esi, 4
jne 0x43804e
jmp 0x4380ba
mov eax, edi
jmp 0x4380ba
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov edi, eax
and edi, 0xfefffe6c
mov ebx, eax
and ebx, 0x1000193
or eax, 0x1000193
imul eax, ebx
xor ebx, 0x1000193
imul ebx, edi
add eax, ebx
mov edi, eax
cmp esi, 4
je 0x4380ba
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0xfefffe6c
mov ebx, edi
and ebx, 0x1000193
or edi, 0x1000193
imul edi, ebx
xor ebx, 0x1000193
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0xfefffe6c
mov ebx, eax
and ebx, 0x1000193
or eax, 0x1000193
imul eax, ebx
xor ebx, 0x1000193
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x438060
pop esi
pop edi
pop ebx
ret
Function at 0x438540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0x3359356d
mov dword [esp + 0xc], 0x2fbd31b5
mov dword [esp + 0x10], 0x2bb72da2
mov dword [esp + 0x14], 0x275429b9
mov dword [esp + 0x18], 0x23b325a8
mov dword [esp + 0x1c], 0x5fbb21a8
mov dword [esp + 0x20], 0x5b5c5d05
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 0x24], 0
mov word [esp + 0x28], 0
mov edx, 0xbc2c4029
mov ecx, 0x43d3bfd6
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x43d3bfdf]
mov ebx, ecx
and ebx, 0x40c03dfa
mov eax, edx
and eax, 0x94244005
or eax, ebx
xor eax, edi
xor eax, 0x68c83dfa
mov dword [esp + 0x40], eax
mov ebx, dword [esp + 0x40]
mov eax, ebx
not eax
and eax, 0x1f
and ebx, 0xe0
sub ebx, eax
mov byte [esp + edx + 0x43d3bfdf], bl
inc edx
dec ecx
cmp edx, 0xbc2c404b
jne 0x4385b0
lea eax, [esp + 0x40]
lea ebx, [esp + 8]
mov edi, eax
mov ecx, 7
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
lea edi, [esp + 0x5c]
xor ecx, ecx
mov edx, dword [esp + 4]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
lea ecx, [esp + 0x30]
push ecx
push 8
lea edi, [esp + 0x10]
push edi
push 0xd
push eax
push 0
call dword [0x44d624]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44aec4]
Function at 0x43bc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], 0xc3c2c1b0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
not edx
mov esi, ecx
shr esi, 1
and esi, 1
movzx edi, byte [esp + ecx + 8]
mov ebx, edi
not ebx
mov eax, ebx
or ebx, 0x181ba7a3
add edi, ebx
inc edi
lea ebx, [ecx + 0x2cc52660]
and eax, 0xe7e4585c
or edi, eax
mov eax, ebx
and eax, 0x2cc5266d
and edx, 2
imul edx, eax
mov eax, ecx
or eax, 0x2cc52662
imul eax, esi
lea eax, [edx + eax*2]
neg eax
add eax, ecx
add eax, 0x2cc5265f
and eax, 0xe7e4585c
and ebx, 0x8012623
or ebx, eax
xor ebx, edi
mov dword [esp + 4], ebx
mov eax, dword [esp + 4]
add al, 0x60
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0xd
jne 0x43bc60
mov ecx, dword [esp + 8]
mov ecx, dword fs:[ecx]
push dword [ebp + 8]
push 0
push dword [ecx + 0x18]
call dword [0x455648]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], 0x636261b0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, 0x13079490
mov edx, 0xecf86b6f
nop
nop
movzx edi, byte [esp + eax - 0x13079488]
lea esi, [eax - 0x13079400]
and esi, edi
mov ebx, esi
and ebx, 2
mov ecx, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and ecx, 0xffffff9d
imul ecx, ebx
add esi, ecx
lea ecx, [eax + edi]
xor ecx, esi
mov ebx, edx
sub ebx, edi
or ebx, esi
mov esi, ebx
not esi
mov edi, esi
and edi, 0xfffffffd
and ebx, 2
imul ebx, edi
sub ebx, ecx
mov ecx, esi
and ecx, 2
or esi, 2
imul esi, ecx
add esi, ebx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
add cl, 0x10
mov byte [esp + eax - 0x13079488], cl
inc eax
dec edx
cmp eax, 0x1307949c
jne 0x43f940
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
mov edi, dword [ebp + 8]
test edi, edi
sete cl
jmp dword [ecx*4 + 0x44c090]
Function at 0x4405a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4405c0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x4405db
mov eax, 0xffffffff
jmp 0x4405de
add eax, 0xa
push eax
call fcn.00408fc0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440621
add esi, 2
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440610
mov word [ecx], 0
lea eax, [edi*2 + 8]
mov word [esp + 0xc], ax
lea eax, [edi*2 + 0xa]
mov word [esp + 0xe], ax
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], 0x2a252427
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
xor edx, edx
nop
movzx esi, byte [esp + edx + 0x18]
mov dword [esp + 8], esi
mov ecx, edx
and ecx, 0xb
xor ecx, 0x2828347b
mov eax, edx
and eax, 4
sub eax, ecx
mov ecx, esi
not ecx
lea ecx, [esi + ecx*2]
mov edi, 0xfffffffe
sub edi, ecx
mov ebx, 0xfe
sub ebx, ecx
and ebx, esi
or ebx, edi
lea edi, [ebx + ebx]
not edi
add edi, ebx
mov ebx, eax
not ebx
mov dword [esp + 4], ebx
mov ecx, eax
and ecx, 0xd7d7cb9d
and ebx, 2
imul ebx, ecx
mov ecx, eax
and ecx, 2
mov esi, eax
or esi, 2
imul esi, ecx
lea ecx, [esi + ebx]
add esi, ebx
inc esi
xor esi, eax
xor ecx, 0x17d7cb9e
and ecx, eax
add ecx, ecx
sub ecx, esi
and ecx, dword [esp + 4]
or ecx, edi
or eax, dword [esp + 8]
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x5d
mov byte [esp + edx + 0x18], al
inc edx
cmp edx, 0xc
jne 0x440690
mov esi, dword [esp + 0x18]
mov eax, dword [0x44d628]
test eax, eax
je 0x44078d
xor ecx, ecx
mov edx, dword [0x44d62c]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xbc8a835b
je 0x440750
inc ecx
cmp eax, ecx
jne 0x440740
jmp 0x44078d
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, esi
je 0x44078d
lea eax, [esp + 0x18]
lea edx, [esp + 0x2c]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push eax
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x38
mov esi, eax
push dword [esp]
call fcn.00408fd0
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4407b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4407d0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x4407eb
mov eax, 0xffffffff
jmp 0x4407ee
add eax, 0xa
push eax
call fcn.00408fc0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440831
add esi, 2
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440820
mov word [ecx], 0
lea eax, [edi*2 + 8]
mov word [esp + 0xc], ax
lea eax, [edi*2 + 0xa]
mov word [esp + 0xe], ax
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], 0x2a252427
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
xor edx, edx
nop
movzx esi, byte [esp + edx + 0x18]
mov dword [esp + 8], esi
mov ecx, edx
and ecx, 0xb
xor ecx, 0x2828347b
mov eax, edx
and eax, 4
sub eax, ecx
mov ecx, esi
not ecx
lea ecx, [esi + ecx*2]
mov edi, 0xfffffffe
sub edi, ecx
mov ebx, 0xfe
sub ebx, ecx
and ebx, esi
or ebx, edi
lea edi, [ebx + ebx]
not edi
add edi, ebx
mov ebx, eax
not ebx
mov dword [esp + 4], ebx
mov ecx, eax
and ecx, 0xd7d7cb9d
and ebx, 2
imul ebx, ecx
mov ecx, eax
and ecx, 2
mov esi, eax
or esi, 2
imul esi, ecx
lea ecx, [esi + ebx]
add esi, ebx
inc esi
xor esi, eax
xor ecx, 0x17d7cb9e
and ecx, eax
add ecx, ecx
sub ecx, esi
and ecx, dword [esp + 4]
or ecx, edi
or eax, dword [esp + 8]
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x5d
mov byte [esp + edx + 0x18], al
inc edx
cmp edx, 0xc
jne 0x4408a0
mov esi, dword [esp + 0x18]
mov eax, dword [0x44d628]
test eax, eax
je 0x440991
xor ecx, ecx
mov edx, dword [0x44d62c]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcd669f2f
je 0x440960
inc ecx
cmp eax, ecx
jne 0x440950
jmp 0x440991
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x440991
lea ecx, [esp + 0x18]
lea edx, [esp + 0x2c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44d630]
push eax
call fcn.0043dbc0
add esp, 0x24
mov esi, eax
push dword [esp]
call fcn.00408fd0
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4409b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4409d0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4409eb
mov eax, 0xffffffff
jmp 0x4409ee
add eax, 0xa
push eax
call fcn.00408fc0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x440a41
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x440a30
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov eax, ecx
and eax, 0xfffd
imul eax, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + eax]
mov word [esp + 0x14], dx
add eax, ecx
add eax, 2
mov word [esp + 0x16], ax
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0x40
lea eax, [esp + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0x2a252427
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebx + 0x38]
mov dword [esp + 0x10], esi
mov ecx, ebx
and ecx, 0xb
xor ecx, 0x2828347b
mov edx, ebx
and edx, 4
sub edx, ecx
mov ecx, esi
not ecx
lea ecx, [esi + ecx*2]
mov edi, 0xfffffffe
sub edi, ecx
mov eax, 0xfe
sub eax, ecx
and eax, esi
or eax, edi
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0xc], ecx
mov edi, edx
not edi
mov dword [esp + 8], edi
mov eax, edx
and eax, 0xd7d7cb9d
and edi, 2
imul edi, eax
mov eax, edx
and eax, 2
mov esi, edx
or esi, 2
imul esi, eax
lea ecx, [esi + edi]
lea eax, [esi + edi]
inc eax
xor eax, edx
xor ecx, 0x17d7cb9e
and ecx, edx
add ecx, ecx
sub ecx, eax
and ecx, dword [esp + 8]
or ecx, dword [esp + 0xc]
or edx, dword [esp + 0x10]
and edx, ecx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0x5d
mov byte [esp + ebx + 0x38], al
inc ebx
cmp ebx, 0xc
jne 0x440ad0
mov esi, dword [esp + 0x38]
mov eax, dword [0x44d628]
test eax, eax
je 0x440bc5
xor ecx, ecx
mov edx, dword [0x44d62c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xdcc9f508
je 0x440ba0
inc ecx
cmp eax, ecx
jne 0x440b90
jmp 0x440bc5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x440bc5
lea ecx, [esp + 0x38]
lea edx, [esp + 0x20]
push ecx
push edx
push 2
push dword [0x44d630]
push eax
call fcn.0043dbc0
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.00408fd0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x440bde
mov eax, dword [esp + 0x58]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x2a252427
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 8]
mov dword [esp + 4], ebx
mov ecx, eax
and ecx, 0xb
xor ecx, 0x2828347b
mov edx, eax
and edx, 4
sub edx, ecx
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2]
mov esi, 0xfffffffe
sub esi, ecx
mov edi, 0xfe
sub edi, ecx
and edi, ebx
or edi, esi
lea ecx, [edi + edi]
not ecx
add ecx, edi
mov esi, edx
not esi
mov dword [esp], esi
mov edi, edx
and edi, 0xd7d7cb9d
and esi, 2
imul esi, edi
mov edi, edx
and edi, 2
mov ebx, edx
or ebx, 2
imul ebx, edi
lea edi, [ebx + esi]
add esi, ebx
inc esi
xor esi, edx
xor edi, 0x17d7cb9e
and edi, edx
add edi, edi
sub edi, esi
and edi, dword [esp]
or edi, ecx
or edx, dword [esp + 4]
and edx, edi
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x24]
add cl, 0x5d
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0xc
jne 0x440c20
mov eax, dword [esp + 8]
mov ecx, dword [0x44d628]
test ecx, ecx
je 0x440d0a
xor edx, edx
mov esi, dword [0x44d62c]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xd75bc899
je 0x440ce0
inc edx
cmp ecx, edx
jne 0x440cd0
jmp 0x440d0a
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x440d0a
lea eax, [esp + 8]
lea edx, [esp + 0x24]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x440d17
mov ecx, dword [esp + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x440d26
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret