joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f7a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xd0
mov dword [esp + 0x18], 0xd91ddb3f
mov dword [esp + 0x1c], 0xdd6edf68
mov dword [esp + 0x20], 0xd175d318
mov dword [esp + 0x24], 0xd571d764
mov dword [esp + 0x28], 0xa906ab2f
mov dword [esp + 0x2c], 0xad1faf7a
mov dword [esp + 0x30], 0xa119a318
mov dword [esp + 0x34], 0xa501a710
mov dword [esp + 0x38], 0xb947bb00
mov dword [esp + 0x3c], 0xbd12bf45
mov dword [esp + 0x40], 0xb109b309
mov dword [esp + 0x44], 0xb503b705
mov dword [esp + 0x48], 0x893b8b0b
mov dword [esp + 0x4c], 0x8d7c8f3a
mov dword [esp + 0x50], 0x81318304
mov dword [esp + 0x54], 0x8586873c
lea eax, [esp + 0x58]
mov word [esp + 0x58], 0
mov ecx, 0x2f
mov edx, 0x622866d0
nop
movzx esi, byte [esp + ecx - 0x17]
mov edi, ecx
xor edi, edx
and edi, esi
xor edi, edx
mov ebx, edi
not ebx
and edi, 0x47
and ebx, 0xb8
sub ebx, edi
add bl, 0x5c
mov byte [esp + ecx - 0x17], bl
inc ecx
dec edx
cmp ecx, 0x71
jne 0x42f840
lea ebx, [esp + 0x90]
lea edx, [esp + 0x18]
mov ecx, 0x10
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd0]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x8c]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x453168]
mov edi, dword [esp + 0x8c]
test edi, edi
jns 0x42f8b9
mov eax, 0xffffffff
jmp 0x42f8bc
lea eax, [edi + edi]
push eax
call fcn.0040d330
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x453168]
lea eax, [esp + 0x7c]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x98], ebp
push ebp
call fcn.004465d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44f1a0]
Function at 0x437360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0041e3d0
push eax
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
jmp 0x437387
cmp ebx, 0x24
setg cl
jmp 0x43738f
or al, cl
test al, 1
jne 0x437397
jmp 0x43739c
jmp 0x43751f
mov ecx, edi
mov eax, dword [ebp + 0x10]
add ecx, eax
add ecx, 0xffffffff
mov byte [edi + eax - 1], 0
cmp esi, 0
jne 0x4373be
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], 0x30
jmp 0x43751f
cmp ebx, 0xa
sete al
test al, 1
jne 0x4373cd
jmp 0x43744e
jmp 0x4373cf
cmp esi, 0x64
jb 0x43740e
mov edi, 0x64
mov eax, esi
xor edx, edx
div edi
shl edx, 1
mov al, byte [edx + 0x449761]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [edx + 0x449760]
add edi, 0xffffffff
mov byte [ecx - 2], al
mov ecx, 0x64
mov eax, esi
xor edx, edx
div ecx
mov esi, eax
mov ecx, edi
jmp 0x4373cf
cmp esi, 0xa
setb al
test al, 1
jne 0x43741a
jmp 0x43742b
mov al, byte [esi + 0x44a35f]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
jmp 0x437449
shl esi, 1
mov al, byte [esi + 0x449761]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [esi + 0x449760]
add edi, 0xffffffff
mov byte [ecx - 2], al
jmp 0x43751f
cmp ebx, 0x10
sete al
test al, 1
jne 0x43745f
jmp 0x43745a
jmp 0x4374f5
jmp 0x437461
cmp esi, 0x100
setae al
test al, 1
jne 0x437470
jmp 0x43749d
mov edx, esi
and edx, 0xff
shl edx, 1
mov bl, byte [edx + 0x44982a]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], bl
mov dl, byte [edx + 0x449829]
add eax, 0xffffffff
mov byte [ecx - 2], dl
shr esi, 8
mov ecx, eax
jmp 0x437461
cmp esi, 0x10
setb al
test al, 1
jne 0x4374a9
jmp 0x4374ba
mov al, byte [esi + 0x44a35f]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
jmp 0x43751f
mov edx, esi
and edx, 0xfffffffd
mov eax, esi
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov edx, esi
and edx, 2
or esi, 2
imul esi, edx
add esi, eax
mov al, byte [esi + 0x44982a]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [esi + 0x449829]
add edi, 0xffffffff
mov byte [ecx - 2], al
jmp 0x43751f
cmp esi, 0
jbe 0x43751b
mov eax, esi
xor edx, edx
div ebx
mov al, byte [edx + 0x44a35f]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov eax, esi
xor edx, edx
div ebx
mov esi, eax
mov ecx, edi
jmp 0x4374f5
mov edi, ecx
jmp 0x43751f
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x453168]
mov dword [esp + 4], eax
mov dword [esp + 0x18], 0x19c71bf7
mov dword [esp + 0x1c], 0xe55be79f
mov dword [esp + 0x20], 0xe149e358
mov dword [esp + 0x24], 0xed22ef53
mov dword [esp + 0x28], 0xe95deb52
mov dword [esp + 0x2c], 0xf55df752
mov dword [esp + 0x30], 0xf1f2f31f
mov word [esp + 0x34], 0
mov byte [esp + 0x36], 0
mov ecx, 0x44c52def
mov edi, 0x898a5bde
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x44c52dd7]
mov eax, edi
and eax, 0x818244f6
mov ebx, ecx
xor ebx, 0xf9c9227b
lea edx, [ebx + eax]
mov dword [esp + 8], edx
add ebx, eax
add ebx, 0xbb3ad211
and ebx, esi
mov edx, ebx
or edx, 0xfffffffd
inc edx
mov eax, ebx
and eax, 0xfffffffd
imul eax, edx
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
sub eax, ebx
mov edx, dword [esp + 8]
add edx, esi
add edx, 0xbb3ad211
add eax, edx
and edx, 1
or eax, 1
add eax, edx
add al, 0x98
mov byte [esp + ecx - 0x44c52dd7], al
inc ecx
add edi, 2
cmp ecx, 0x44c52e0e
jne 0x43c4e0
lea eax, [esp + 0x58]
lea esi, [esp + 0x84]
lea edi, [esp + 0x18]
push eax
push 8
push esi
push 0xd
push edi
push 0
call dword [esp + 0x1c]
shr eax, 0x1f
jmp dword [eax*4 + 0x4505c0]
Function at 0x43ce40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.00446e30
add esp, 0x14
test eax, eax
js 0x43cfc9
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call 0x4472e0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43cedc
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43cead
mov eax, 0xffffffff
jmp 0x43ceaf
add eax, eax
push eax
call fcn.0040d330
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call 0x4479f0
add esp, 0x14
test eax, eax
js 0x43ced3
mov esi, edi
jmp 0x43cedc
push edi
call fcn.0040d340
add esp, 4
mov eax, dword [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xf8fbfafd
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov ecx, 0x11736eab
mov edx, 0xee8c9154
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x11736ea7]
mov edi, ecx
and edi, ebx
add edi, edi
sub edi, ebx
add edi, edx
and edi, ecx
mov eax, edi
and eax, 2
mov ebp, edi
or edi, 2
imul edi, eax
xor eax, 2
and ebp, 0x11736ebd
imul ebp, eax
add edi, ebp
lea ebp, [edx + 0x11736f00]
and ebp, edi
mov eax, edi
not eax
and eax, ecx
sub eax, ebp
add al, bl
add al, 0xa9
mov byte [esp + ecx - 0x11736ea7], al
inc ecx
dec edx
cmp ecx, 0x11736eb2
jne 0x43cf10
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x43cfad
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43cf90
inc edi
cmp ecx, edi
jne 0x43cf80
jmp 0x43cfad
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43cfad
push dword [esp + 0xc]
push 1
push dword [0x453174]
push ecx
call fcn.00442df0
add esp, 0x10
test esi, esi
jne 0x43cfcb
lea eax, [esp + 4]
push eax
call fcn.00446380
add esp, 4
test al, al
je 0x43cfc9
cmp dword [esp + 4], 1
je 0x43cfcb
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43ff50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp], 0x81868774
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x1afc41e1
mov edx, 0xe503be1e
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1afc41e1]
mov edi, edx
and edi, 0xe4009a0b
mov ebx, ecx
and ebx, 0x101c40a4
or ebx, edi
xor ebx, esi
mov esi, ebx
not esi
and esi, 1
xor ebx, 0x4a
lea ebx, [ebx + esi*2]
add bl, 0x9a
mov byte [esp + ecx - 0x1afc41e1], bl
inc ecx
dec edx
cmp ecx, 0x1afc41e8
jne 0x43ff80
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov edx, dword [0x450bb8]
nop
nop
nop
nop
nop
nop
nop
jmp edx
Function at 0x440300
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x4403d7
xor eax, eax
cmp dword [ecx], 0
jne 0x440451
mov ebp, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xf8fbfafd
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x2b]
mov ebx, edx
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0x29
mov byte [esp + eax - 0x2b], dl
inc eax
cmp eax, 0x32
jne 0x440380
mov eax, dword [esp]
mov esi, dword [0x45316c]
test esi, esi
je 0x440451
xor edi, edi
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x44045b
inc edi
cmp esi, edi
jne 0x4403c0
jmp 0x440451
mov dword [esp + 8], 0xbf7e7970
mov word [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
lea edx, [eax + 0x61fe2dea]
mov esi, 0x15
sub esi, eax
and esi, 0x1b
mov edi, edx
and edi, 0x61c829c4
or edi, esi
xor edi, ecx
xor edi, 0x61c829c4
and edi, edx
add edi, edi
neg edi
lea edx, [eax + edi]
add edx, 0x61fe2dea
add edx, ecx
mov ecx, 0x92
sub ecx, edx
not edx
and edx, 1
or ecx, 1
sub edx, ecx
mov byte [esp + eax + 8], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 6
jb 0x4403f0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x440451
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push ebp
push ecx
push 4
push dword [0x453174]
push esi
call fcn.00442df0
add esp, 0x1c
jmp 0x440451
Function at 0x4465d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4465e0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4465fb
mov eax, 0xffffffff
jmp 0x4465fe
add eax, 0xa
push eax
call fcn.0040d330
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 8], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x446641
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x446630
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x2d2e5e76
mov eax, 0xd2d1a189
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x2d2e5e76]
mov esi, ecx
and esi, ebx
add esi, esi
sub esi, ebx
add esi, eax
and esi, ecx
mov edi, esi
and edi, 0x2d2e5e7d
mov edx, esi
and edx, 2
mov ebp, esi
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
or esi, 2
imul esi, edx
add ebp, ebx
sub ebp, esi
add ebp, ecx
mov ebx, ebp
and ebx, 0x31
add ebx, ebx
xor ebp, 0x4e
sub ebx, ebp
mov byte [esp + ecx - 0x2d2e5e76], bl
inc ecx
dec eax
cmp ecx, 0x2d2e5e7d
jne 0x4466c0
mov esi, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x446773
xor edx, edx
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x446740
inc edx
cmp ecx, edx
jne 0x446730
jmp 0x446773
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x446773
mov eax, esp
lea edx, [esp + 0x14]
push dword [esp + 0x50]
push dword [esp + 0x50]
push eax
push edx
push dword [esp + 0x58]
push dword [esp + 0x58]
push 6
push dword [0x453174]
push ecx
call fcn.00442df0
add esp, 0x24
mov esi, eax
push dword [esp + 8]
call fcn.0040d340
add esp, 4
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4467b0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4467cb
mov eax, 0xffffffff
jmp 0x4467ce
add eax, 0xa
push eax
call fcn.0040d330
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x446821
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x446810
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp + 8], si
add ecx, edx
add ecx, 2
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x34353a3b
mov word [esp + 0x2c], 0
mov byte [esp + 0x2e], 0
mov ecx, 0x2d2e5e76
mov eax, 0xd2d1a189
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x2d2e5e4e]
mov esi, ecx
and esi, ebx
add esi, esi
sub esi, ebx
add esi, eax
and esi, ecx
mov edx, esi
and edx, 0x2d2e5e7d
mov edi, esi
or edi, 0xfffffffd
inc edi
imul edi, edx
mov edx, esi
and edx, 2
or esi, 2
imul esi, edx
add edi, ebx
sub edi, esi
add edi, ecx
mov ebx, edi
and ebx, 0x31
add ebx, ebx
xor edi, 0x4e
sub ebx, edi
mov byte [esp + ecx - 0x2d2e5e4e], bl
inc ecx
dec eax
cmp ecx, 0x2d2e5e7d
jne 0x4468b0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x446955
xor edx, edx
mov edi, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x87573896
je 0x446930
inc edx
cmp ecx, edx
jne 0x446920
jmp 0x446955
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x446955
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 2
push dword [0x453174]
push ecx
call fcn.00442df0
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.0040d340
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44696e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov edx, 0xd2d1a189
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x2d2e5e76]
mov ebx, eax
and ebx, ecx
add ebx, ebx
sub ebx, ecx
add ebx, edx
and ebx, eax
mov edi, ebx
and edi, 0x2d2e5e7d
mov esi, ebx
or esi, 0xfffffffd
inc esi
imul esi, edi
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
add esi, ecx
sub esi, ebx
add esi, eax
mov ecx, esi
and ecx, 0x31
add ecx, ecx
xor esi, 0x4e
sub ecx, esi
mov byte [esp + eax - 0x2d2e5e76], cl
inc eax
dec edx
cmp eax, 0x2d2e5e7d
jne 0x4469b0
mov eax, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x446a58
xor edx, edx
mov esi, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa70a987f
je 0x446a30
inc edx
cmp ecx, edx
jne 0x446a20
jmp 0x446a58
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x446a58
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x453174]
push ecx
call fcn.00442df0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x446a65
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x446a74
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov ebx, 0xd2d1a189
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2d2e5e76]
mov ebp, eax
and ebp, edi
add ebp, ebp
sub ebp, edi
add ebp, ebx
and ebp, eax
mov ecx, ebp
and ecx, 0x2d2e5e7d
mov edx, ebp
and edx, 2
mov esi, ebp
or esi, 0xfffffffd
inc esi
imul esi, ecx
or ebp, 2
imul ebp, edx
add esi, edi
sub esi, ebp
add esi, eax
mov ecx, esi
and ecx, 0x31
add ecx, ecx
xor esi, 0x4e
sub ecx, esi
mov byte [esp + eax - 0x2d2e5e76], cl
inc eax
dec ebx
cmp eax, 0x2d2e5e7d
jne 0x446ab0
mov eax, dword [esp]
mov esi, dword [0x45316c]
test esi, esi
je 0x446b64
xor edi, edi
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xd41f89d1
je 0x446b30
inc edi
cmp esi, edi
jne 0x446b20
jmp 0x446b64
mov ebx, dword [ebx + edi*8 + 4]
cmp ebx, eax
je 0x446b64
lea eax, [esp + 8]
push 0
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x453174]
push ebx
call fcn.00442df0
add esp, 0x30
cmp eax, 0x103
jne 0x446c39
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov ecx, 0xd2d1a189
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2d2e5e76]
mov edx, eax
and edx, edi
add edx, edx
sub edx, edi
add edx, ecx
and edx, eax
mov ebx, edx
and ebx, 0x2d2e5e7d
mov ebp, edx
and ebp, 2
mov esi, edx
or esi, 0xfffffffd
inc esi
imul esi, ebx
or edx, 2
imul edx, ebp
add esi, edi
sub esi, edx
add esi, eax
mov edx, esi
and edx, 0x31
add edx, edx
xor esi, 0x4e
sub edx, esi
mov byte [esp + eax - 0x2d2e5e76], dl
inc eax
dec ecx
cmp eax, 0x2d2e5e7d
jne 0x446b90
mov eax, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x446c31
xor edx, edx
mov esi, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x53f09cfa
je 0x446c10
inc edx
cmp ecx, edx
jne 0x446c00
jmp 0x446c31
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x446c31
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x453174]
push ecx
call fcn.00442df0
add esp, 0x18
test eax, eax
js 0x446c39
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x446c50
xor ecx, ecx
cmp eax, 0xc0000011
je 0x446c4e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x3c]
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edi], 0
lea edi, [edi + 2]
jne 0x446e50
add edi, 0xfffffffe
and edi, 0xfffe
mov word [esp + 8], di
add edi, 2
mov word [esp + 0xa], di
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov edi, 0xd2d1a189
nop
nop
nop
movzx ebp, byte [esp + eax - 0x2d2e5e76]
mov ebx, eax
and ebx, ebp
add ebx, ebx
sub ebx, ebp
add ebx, edi
and ebx, eax
mov edx, ebx
and edx, 0x2d2e5e7d
mov esi, ebx
and esi, 2
mov ecx, ebx
or ecx, 0xfffffffd
inc ecx
imul ecx, edx
or ebx, 2
imul ebx, esi
add ecx, ebp
sub ecx, ebx
add ecx, eax
mov ebx, ecx
and ebx, 0x31
add ebx, ebx
xor ecx, 0x4e
sub ebx, ecx
mov byte [esp + eax - 0x2d2e5e76], bl
inc eax
dec edi
cmp eax, 0x2d2e5e7d
jne 0x446ec0
mov eax, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x446f6a
xor edi, edi
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x9ecf05eb
je 0x446f40
inc edi
cmp ecx, edi
jne 0x446f30
jmp 0x446f6a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, eax
je 0x446f6a
lea eax, [esp + 0x10]
push dword [esp + 0x48]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 4
push dword [0x453174]
push ecx
call fcn.00442df0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56a0c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x115000]
push edi
jmp 0x56a0da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x56a0e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56a0d0
mov eax, 1
add ebx, ebx
jne 0x56a0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x56a104
jne 0x56a123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56a123
dec eax
add ebx, ebx
jne 0x56a110
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x56a0e8
add ebx, ebx
jne 0x56a11f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x56a175
xor ecx, ecx
sub eax, 3
jb 0x56a13b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x56a1aa
sar eax, 1
mov ebp, eax
jmp 0x56a146
add ebx, ebx
jne 0x56a146
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56a114
inc ecx
add ebx, ebx
jne 0x56a154
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56a114
add ebx, ebx
jne 0x56a161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x56a156
jne 0x56a172
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x56a156
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x56a194
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x56a186
jmp 0x56a0d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x56a194
add edi, ecx
jmp 0x56a0d6
pop esi
mov edi, esi
mov ecx, 0x3eef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x56a1b2
cmp byte [edi], 0x11
jne 0x56a1b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x56a1b7
lea edi, [esi + 0x163000]
mov eax, dword [edi]
or eax, eax
je 0x56a22f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1fc768]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1fc8e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x56a1e4
mov ecx, edi
jns 0x56a213
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1fc8e8]
or eax, eax
je 0x56a229
mov dword [ebx], eax
add ebx, 4
jmp 0x56a201
call dword [esi + 0x1fc8f8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x56a260
cmp al, 0xef
ja 0x56a253
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x56a235
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x56a242
mov ebp, dword [esi + 0x1fc8ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x56a294
sub esp, 0xffffff80
jmp 0x426bf7