joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x451ae0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f8de
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bdac]
xor eax, eax
jmp 0x40fd2f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41e250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x41e270
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41e290
sar edi, 1
sar eax, 1
add eax, edi
add eax, 2
test eax, eax
jns 0x41e2af
mov eax, 0xffffffff
jmp 0x41e2b1
add eax, eax
push eax
call fcn.0040cb60
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x41e2e1
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41e2d0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x41e311
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e300
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00446a40
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x10], ebx
jmp dword [eax*4 + 0x44d4b8]
Function at 0x4258a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4258b0
cmp eax, 0xffffffed
jge 0x4258c7
mov eax, 0xffffffff
jmp 0x4258ca
add eax, 0x12
push eax
call fcn.0040cb60
add esp, 4
mov esi, eax
mov dword [esp], 0x51a34f90
mov dword [esp + 4], 0x55a953b7
mov dword [esp + 8], 0x59785760
mov dword [esp + 0xc], 0x5db85bbc
mov word [esp + 0x10], 0x5f5c
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x7998fc8d
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7998fc8d]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x3e
mov byte [esp + eax - 0x7998fc8d], cl
inc eax
cmp eax, 0x7998fca4
jne 0x425910
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425961
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425950
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425991
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425980
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00446bc0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44dda8]
Function at 0x4285f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x452e18]
mov dword [esp + 4], 0x43834165
mov dword [esp + 8], 0x47d645d4
mov dword [esp + 0xc], 0x4bab498c
mov dword [esp + 0x10], 0x4faf4dd8
mov dword [esp + 0x14], 0x738e7155
mov dword [esp + 0x18], 0x779e7580
mov dword [esp + 0x1c], 0x7b9479ed
mov dword [esp + 0x20], 0x7f9b7d98
mov dword [esp + 0x24], 0x638061f2
mov dword [esp + 0x28], 0x67f4658d
mov dword [esp + 0x2c], 0x6b96698c
mov dword [esp + 0x30], 0x6ffc6d9c
mov dword [esp + 0x34], 0x13f411ff
mov dword [esp + 0x38], 0x17fa15fd
mov dword [esp + 0x3c], 0x1b8919fd
mov word [esp + 0x40], 0x1d1c
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
xor edx, 0xef
mov esi, ecx
or esi, 0x78c3be10
and edx, esi
add edx, esi
xor dl, byte [esp + ecx + 4]
add dl, 0xb0
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x44
jne 0x428690
mov ecx, esp
lea edx, [esp + 4]
push ecx
push 0
push 0
push 0x1e
push edx
push 0
call eax
mov ebp, dword [esp]
jmp dword [0x44e49c]
Function at 0x42bd20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x179a1997
mov dword [esp + 0x58], 0x13f31589
mov dword [esp + 0x5c], 0xfdc1185
mov dword [esp + 0x60], 0xb820d91
mov dword [esp + 0x64], 0x7060995
mov word [esp + 0x68], 0
mov byte [esp + 0x6a], 0
mov eax, 0x65f9a446
mov ecx, 0x9a065bb9
nop
nop
nop
movzx edx, byte [esp + eax - 0x65f9a3f2]
mov esi, ecx
or esi, edx
lea edi, [edx + edx]
not edi
add edi, edx
or edi, eax
and edi, esi
mov edx, 0x70fe2c92
sub edx, edi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add dl, 0xe
mov byte [esp + eax - 0x65f9a3f2], dl
inc eax
dec ecx
cmp eax, 0x65f9a45d
jne 0x42bd90
lea ebx, [esp + 0x54]
lea ecx, [esp + 0x34]
push ebx
call fcn.00440aa0
shr eax, 0x1f
xor edx, edx
jmp dword [eax*4 + 0x44ebd8]
Function at 0x42ecf0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov eax, dword [0x452e18]
mov dword [esp + 0x20], 0x4f0f492d
mov dword [esp + 0x24], 0x43d24ddc
mov dword [esp + 0x28], 0x47e74104
mov dword [esp + 0x2c], 0xbb1b45d0
mov dword [esp + 0x30], 0xbf12b9dd
mov dword [esp + 0x34], 0xb321bd0e
mov dword [esp + 0x38], 0xb713b124
mov dword [esp + 0x3c], 0xab0bb524
mov dword [esp + 0x40], 0xaff1a90c
mov dword [esp + 0x44], 0xa30eadf3
mov dword [esp + 0x48], 0xa703a137
mov dword [esp + 0x4c], 0x9b0da533
mov dword [esp + 0x50], 0x9f0d9901
mov dword [esp + 0x54], 0x93c09d0e
mov dword [esp + 0x58], 0x970b9118
mov dword [esp + 0x5c], 0x8b8a9508
mov word [esp + 0x60], 0
mov byte [esp + 0x62], 0
mov ecx, 0x78439472
nop
nop
nop
movzx edx, byte [esp + ecx - 0x78439452]
xor edx, ecx
mov esi, edx
and esi, 0x45
xor edx, 0xc5
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x78439452], dl
inc ecx
cmp ecx, 0x784394b5
jne 0x42ed90
lea edx, [esp + 0x78]
lea ecx, [esp + 0x20]
push edx
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x78]
test edi, edi
jns 0x42eddd
mov eax, 0xffffffff
jmp 0x42ede0
lea eax, [edi + edi]
push eax
call fcn.0040cb60
add esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [0x452e18]
mov dword [esp + 0x20], 0x99559bb7
mov dword [esp + 0x24], 0xa556a768
mov dword [esp + 0x28], 0xa14da368
mov dword [esp + 0x2c], 0xad41af5c
mov dword [esp + 0x30], 0xa94eab87
mov dword [esp + 0x34], 0xb547b77a
mov dword [esp + 0x38], 0xb159b348
mov dword [esp + 0x3c], 0xbd51bf40
mov dword [esp + 0x40], 0xb98fbb50
mov dword [esp + 0x44], 0x45a2478d
mov dword [esp + 0x48], 0x41a943b9
mov dword [esp + 0x4c], 0x4db34fbd
mov dword [esp + 0x50], 0x49bb4bbb
mov dword [esp + 0x54], 0x556457ba
mov dword [esp + 0x58], 0x51a153ac
mov dword [esp + 0x5c], 0x5d5e5fa4
mov word [esp + 0x60], 0
mov esi, 0x2a717e5b
mov edx, 0xa4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x2a717e3b]
mov ebp, edx
and ebp, 0xe4
mov ecx, esi
and ecx, 0x1b
or ecx, ebp
xor ecx, 0x1b
and ecx, edx
mov ebp, esi
or ebp, ebx
not ebx
or ebx, ecx
and ebx, ebp
add bl, 0x39
mov byte [esp + esi - 0x2a717e3b], bl
inc esi
dec edx
cmp esi, 0x2a717e9d
jne 0x42ee90
lea ecx, [esp + 0x78]
push ecx
push edi
mov ebp, dword [esp + 0x20]
push ebp
push 0x1f
lea ecx, [esp + 0x30]
push ecx
push 0
call eax
lea eax, [esp + 0x1c]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00446a40
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x44ef48]
Function at 0x437820
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x43796c
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
jmp 0x437878
xor ebx, ebx
test al, 1
jne 0x437883
jmp 0x437966
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.0040cc70
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4378ab
jmp 0x437958
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0xa5
mov byte [esp + 0x16], 0xab
mov byte [esp + 0x17], 0xa3
mov byte [esp + 0x18], 0xce
mov byte [esp + 0x19], 0xda
mov byte [esp + 0x1a], 0xcf
mov byte [esp + 0x1b], 0xdd
mov byte [esp + 0x1c], 0xd4
mov byte [esp + 0x1d], 0x1f
mov byte [esp + 0x1e], 0xe6
mov byte [esp + 0x1f], 0xe3
mov byte [esp + 0x20], 0xe8
mov byte [esp + 0x21], 0x65
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x14
jne 0x4378fe
xor esi, esi
jmp 0x43790f
cmp esi, 0x14
jae 0x437934
mov bl, byte [esp + esi + 0x14]
mov ecx, esi
shl ecx, 1
and ecx, 0x78
mov edx, esi
xor edx, 0x3c
add edx, ecx
xor dl, bl
add dl, 0xd4
mov byte [esp + esi + 0x14], dl
add esi, 1
jmp 0x43790f
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040d690
sub esp, 0xc
mov bl, al
jmp 0x437953
jmp 0x437955
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x437966
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00447090
add esp, 0x14
test eax, eax
js 0x43dd16
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00447430
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43dc67
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43dc33
mov eax, 0xffffffff
jmp 0x43dc3a
lea eax, [eax*2 + 2]
push eax
call fcn.0040cb60
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00447a30
add esp, 0x14
test eax, eax
js 0x43dc5e
mov esi, edi
jmp 0x43dc67
push edi
call fcn.0040cb70
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0x101f1e1d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov ecx, 0x45
mov edx, 0xba
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x41]
mov ebx, edx
xor ebx, ecx
and ebx, edi
xor ebx, ecx
add bl, 0xa7
mov byte [esp + ecx - 0x41], bl
inc ecx
dec edx
cmp ecx, 0x4c
jne 0x43dc90
mov ecx, dword [0x452e1c]
test ecx, ecx
je 0x43dcfa
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43dce0
inc edi
cmp ecx, edi
jne 0x43dcd0
jmp 0x43dcfa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43dcfa
push eax
push 1
push dword [0x452e24]
push ecx
call fcn.00443a10
add esp, 0x10
test esi, esi
jne 0x43dd18
lea eax, [esp + 4]
push eax
call fcn.00446850
add esp, 4
test al, al
je 0x43dd16
cmp dword [esp + 4], 1
je 0x43dd18
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440940
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x14]
mov dword [esp], 0x23222150
mov ecx, esp
mov edx, 0xf7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
lea edi, [edx - 0x2c90800]
or edi, esi
not edi
and esi, edx
or esi, edi
mov edi, esi
and edi, 0x57
xor esi, 0xd7
lea ebx, [esi + edi*2]
inc bl
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xf3
jne 0x440960
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [0x4509ac]
nop
nop
nop
nop
jmp edx
Function at 0x440aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edx, eax
and edx, 0xa
mov edi, ecx
xor edi, 0xf9f82b45
add edi, edx
mov edx, edi
not edx
lea edx, [edi + edx*2]
inc edx
xor edx, edi
and edx, esi
xor edx, edi
add dl, 0xa7
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x440ad0
mov edi, dword [esp]
mov eax, dword [0x452e1c]
test eax, eax
je 0x440b56
xor ecx, ecx
mov edx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x440b30
inc ecx
cmp eax, ecx
jne 0x440b20
jmp 0x440b56
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x440b56
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x452e24]
push eax
call fcn.00443a10
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x440c85
mov dword [esp + 0x10], ebp
push dword [esp + 8]
call fcn.00440940
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edi]
mov ecx, edx
and ecx, 0xa
mov ebp, edi
xor ebp, 0xf9f82b45
add ebp, ecx
mov ecx, ebp
not ecx
lea ecx, [ecx*2 + 1]
add ecx, ebp
xor ecx, ebp
and ecx, esi
xor ecx, ebp
add cl, 0xa7
mov byte [esp + edi], cl
inc edi
add edx, 2
cmp edi, 7
jne 0x440ba0
mov edi, dword [esp]
mov edx, dword [0x452e1c]
test edx, edx
je 0x440c28
xor ebp, ebp
mov esi, dword [0x452e20]
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x440c00
inc ebp
cmp edx, ebp
jne 0x440bf0
jmp 0x440c28
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x440c28
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x452e24]
push edx
mov esi, eax
call fcn.00443a10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x440c7c
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x440c55
add edi, 2
cmp si, bp
je 0x440c40
cmp si, bp
je 0x440c67
mov esi, dword [ecx]
test esi, esi
jne 0x440c30
mov edi, 0xc0000225
jmp 0x440c7c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.004409c0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x440cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x440da0
xor eax, eax
cmp dword [ecx], 0
jne 0x440dda
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, eax
and ebx, 0xa
mov ebp, esi
xor ebp, 0xf9f82b45
add ebp, ebx
mov ebx, ebp
not ebx
lea ebx, [ebx*2 + 1]
add ebx, ebp
xor ebx, ebp
and ebx, edi
xor ebx, ebp
add bl, 0xa7
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 7
jne 0x440d40
mov eax, dword [esp]
mov esi, dword [0x452e1c]
test esi, esi
je 0x440dda
xor edi, edi
mov ebx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x440de4
inc edi
cmp esi, edi
jne 0x440d90
jmp 0x440dda
mov dword [esp + 8], 0xb3f2f1c8
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x2c
xor cl, byte [esp + eax + 8]
add cl, 0x24
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 7
jne 0x440dc0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x440dda
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x452e24]
push esi
call fcn.00443a10
add esp, 0x1c
jmp 0x440dda

Function at 0x440e20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x440edb
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, edx
and ebx, 0xa
mov ebp, esi
xor ebp, 0xf9f82b45
add ebp, ebx
mov ebx, ebp
not ebx
lea ebx, [ebx*2 + 1]
add ebx, ebp
xor ebx, ebp
and ebx, edi
xor ebx, ebp
add bl, 0xa7
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 7
jne 0x440e50
mov edx, dword [0x452e1c]
test edx, edx
je 0x440ece
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x440eb0
inc edi
cmp edx, edi
jne 0x440ea0
jmp 0x440ece
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x440ece
push eax
push 1
push dword [0x452e24]
push edx
mov esi, ecx
call fcn.00443a10
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0xc], ecx
cmp dword [ecx + 8], 0
je 0x440f80
mov eax, dword [esp + 0xc]
mov ebx, dword [eax]
test ebx, ebx
je 0x440f80
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor edi, edi
nop
movzx edx, byte [esp + edi]
mov ecx, eax
and ecx, 0xa
mov esi, edi
xor esi, 0xf9f82b45
add esi, ecx
mov ecx, esi
not ecx
lea ecx, [esi + ecx*2]
inc ecx
xor ecx, esi
and ecx, edx
xor ecx, esi
add cl, 0xa7
mov byte [esp + edi], cl
inc edi
add eax, 2
cmp edi, 7
jne 0x440f20
mov eax, dword [esp]
mov esi, dword [0x452e1c]
test esi, esi
je 0x440ffd
xor edi, edi
mov edx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + edi*8], 0xdef797a3
je 0x440fe0
inc edi
cmp esi, edi
jne 0x440f70
jmp 0x440ffd
mov dword [esp], 0x91cecfc4
mov word [esp + 4], 0
mov eax, 0x2d
mov ecx, 0xd2
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2d]
mov edx, ecx
or edx, edi
lea esi, [edi + edi]
not esi
add esi, edi
mov edi, eax
and edi, 0x32
mov ebx, ecx
and ebx, 0xcd
or ebx, edi
xor ebx, 0xcd
or ebx, esi
and ebx, edx
mov dl, 0x1e
sub dl, bl
mov byte [esp + eax - 0x2d], dl
inc eax
dec ecx
cmp eax, 0x33
jne 0x440fa0
mov eax, dword [esp]
jmp 0x441125
mov edx, dword [edx + edi*8 + 4]
cmp edx, eax
je 0x440ffd
push dword [ebp + 8]
push ebx
push 2
push dword [0x452e24]
push edx
call fcn.00443a10
add esp, 0x14
cmp dword [ebp + 0xc], 1
mov ecx, dword [ebp + 0x10]
sbb ecx, 0
jl 0x441114
cmp eax, 0xc000010a
jne 0x441114
mov esi, dword [ebp + 0xc]
mov edi, esi
and edi, 0xffffd8f0
mov eax, edi
xor eax, 0xffffd8f0
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
not ecx
mov edx, esi
and edx, 0x270f
imul ecx, edx
mul edx
mov dword [esp + 8], eax
add edx, ecx
mov ecx, edx
or esi, 0xffffd8f0
mov eax, esi
mul edi
imul ebx, esi
add edx, ebx
sub edx, edi
add eax, dword [esp + 8]
adc edx, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx]
mov edi, eax
and edi, 0xa
mov esi, edx
xor esi, 0xf9f82b45
add esi, edi
mov edi, esi
not edi
lea ebx, [esi + edi*2]
inc ebx
xor ebx, esi
and ebx, ecx
xor ebx, esi
add bl, 0xa7
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 7
jne 0x441090
mov eax, dword [esp]
mov esi, dword [0x452e1c]
test esi, esi
je 0x441114
xor edi, edi
mov ecx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0x53f09cfa
je 0x4410f0
inc edi
cmp esi, edi
jne 0x4410e0
jmp 0x441114
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x441114
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x10]
push 3
push dword [0x452e24]
push ecx
call fcn.00443a10
add esp, 0x18
test eax, eax
js 0x441125
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.00440e20
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x441130
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4411c0
push 0xf8eb88df
push dword [0x452e10]
call fcn.00445fa0
add esp, 8
test eax, eax
je 0x441185
mov ecx, dword [esi]
test ecx, ecx
je 0x4411bd
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x441199
cmp dword [esp], 0
je 0x441199
mov dword [esi + 4], 3
jmp 0x4411bd
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x441257
lea eax, [esp + 0xc]
push eax
call fcn.00446850
add esp, 4
test al, al
je 0x4411bd
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x4411ba
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x441257
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp]
mov ebx, eax
and ebx, 0xa
mov edx, ebp
xor edx, 0xf9f82b45
add edx, ebx
mov ebx, edx
not ebx
lea ebx, [edx + ebx*2]
inc ebx
xor ebx, edx
and ebx, esi
xor ebx, edx
add bl, 0xa7
mov byte [esp + ebp], bl
inc ebp
add eax, 2
cmp ebp, 7
jne 0x4411f0
mov eax, dword [esp]
mov edx, dword [0x452e1c]
test edx, edx
je 0x4412f7
xor esi, esi
mov ebx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x4412d0
inc esi
cmp edx, esi
jne 0x441240
jmp 0x4412f7
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor edx, edx
nop
nop
movzx esi, byte [esp + edx]
mov ebx, eax
and ebx, 0xa
mov ebp, edx
xor ebp, 0xf9f82b45
add ebp, ebx
mov ebx, ebp
not ebx
lea ebx, [ebx*2 + 1]
add ebx, ebp
xor ebx, ebp
and ebx, esi
xor ebx, ebp
add bl, 0xa7
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 7
jne 0x441270
mov eax, dword [esp]
mov edx, dword [0x452e1c]
test edx, edx
je 0x4412f7
xor esi, esi
mov ebx, dword [0x452e20]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x4412d0
inc esi
cmp edx, esi
jne 0x4412c0
jmp 0x4412f7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x4412f7
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push edi
push dword [esp + 0x18]
push 5
push dword [0x452e24]
push edx
call fcn.00443a10
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10