joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423c6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov dword [esp], 0xb14d8fab
mov dword [esp + 4], 0xb522b320
mov dword [esp + 8], 0xb955b770
mov dword [esp + 0xc], 0xbd59bb2c
mov dword [esp + 0x10], 0xa142bf9b
mov dword [esp + 0x14], 0xa54aa354
mov dword [esp + 0x18], 0xa948a733
mov dword [esp + 0x1c], 0xad4dab4c
mov dword [esp + 0x20], 0x514caf3e
mov dword [esp + 0x24], 0x55c053bb
mov dword [esp + 0x28], 0x59aa57b0
mov dword [esp + 0x2c], 0x5dc85ba8
mov dword [esp + 0x30], 0x41b85fcd
mov dword [esp + 0x34], 0x45ae43ab
mov dword [esp + 0x38], 0x49d347a3
lea eax, [esp + 0x3c]
mov word [esp + 0x3c], 0x4b48
mov dword [esp + 0x3e], 0
mov ecx, 0x53bc545d
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x53bc545d]
mov esi, ecx
or esi, edx
not edx
mov edi, ecx
or edi, edx
sub edx, edi
add edx, esi
add dl, 0x2f
mov byte [esp + ecx - 0x53bc545d], dl
inc ecx
cmp ecx, 0x53bc549f
jne 0x423bc0
lea ebp, [esp + 0x62]
mov edx, esp
mov edi, ebp
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x9e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x44]
push edi
push 0
push 0
push 0x1e
push ebp
push 0
call dword [0x44bccc]
mov dword [esp], 0xa1e6e7d9
mov byte [esp + 4], 0
xor ecx, ecx
nop
movzx esi, byte [esp + ecx]
lea ebx, [ecx + 0xa9]
mov edx, 0x56
sub edx, ecx
xor edx, ebx
and edx, esi
xor edx, ebx
add dl, 0xb3
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb case.default.0x423c67
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446664]
mov ebx, dword [esp + 0x44]
test ebx, ebx
jns 0x423c7d
mov eax, 0xffffffff
jmp 0x423c80
lea eax, [ebx + ebx]
push eax
call fcn.00409550
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
push ebp
push 0
call dword [0x44bccc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44666c]
xor ebx, ebx
jmp dword [0x446674]
mov dword [esp], 0x99f29bc0
mov dword [esp + 4], 0xa5d4a7e3
mov dword [esp + 8], 0xa1c9a3c8
mov dword [esp + 0xc], 0xadc0afde
mov dword [esp + 0x10], 0xa9d4abdb
mov dword [esp + 0x14], 0xb5b6b7c4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0
mov eax, 0x7f84771b
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7f84771b]
xor ecx, eax
mov ebx, ecx
xor ebx, 0x7d965387
mov edi, ecx
or edi, 0x2002478
and edi, ebx
mov ebp, edi
and ebp, 2
mov ebx, edi
or edi, 2
imul edi, ebp
xor ebp, 2
and ebx, 0xfd
imul ebx, ebp
xor ecx, 0x78
add ecx, edi
add ecx, ebx
inc cl
mov byte [esp + eax - 0x7f84771b], cl
inc eax
cmp eax, 0x7f847737
jne 0x423cf0
lea eax, [esp + 0x4a]
mov ebx, esp
mov ebp, ebx
mov edi, eax
mov ecx, 6
xchg esi, ebp
rep movsd dword es:[edi], dword [esi]
xchg esi, ebp
lea edi, [esp + 0x62]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 8], esi
mov dword [esp], eax
push 0
push 0
push ebx
push dword [esp + 0xc0]
call fcn.0041f760
add esp, 0x10
mov ebx, eax
jmp dword [0x446674]
jmp dword [0x44667c]
mov eax, dword [case.0x423c67.1]
nop
nop
nop
jmp eax
mov eax, ebx
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x427f0c
Capabilities:
Copy file

Disassembly:
push edi
call fcn.00409560
add esp, 4
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x446d8c]

Function at 0x427f26
Capabilities:
Copy file

Disassembly:
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x446d8c]

Function at 0x428856
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, ebx
and al, 1
movzx ecx, al
mov eax, ebx
jmp dword [ecx*4 + 0x446ecc]

Function at 0x428c82
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ebp, ebx
sete al
jmp dword [eax*4 + 0x446e0c]

Function at 0x428fc8
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x60]
test ebx, ebx
jns 0x428fd7
mov eax, 0xffffffff
jmp 0x428fda
lea eax, [ebx + ebx]
push eax
call fcn.00409550
add esp, 4
push edi
push ebx
mov dword [esp + 0x44], eax
push eax
push 9
push esi
push 0
call dword [0x44bccc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446ef4]

Function at 0x429c4f
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x4c]
or eax, 0x10
test ebp, ebp
jns 0x429c5f
mov eax, 0xffffffff
push eax
call fcn.00409550
add esp, 4
mov dword [esp + 4], 0xc366c12f
mov dword [esp + 8], 0xc728c554
mov dword [esp + 0xc], 0xcb52c95c
mov dword [esp + 0x10], 0xcfcecd58
lea ecx, [esp + 0x14]
mov byte [ecx + 2], 0
mov word [ecx], 0
xor edi, edi
xor edx, edx
lea esi, [esp + 4]
nop
nop
nop
movzx ebp, byte [esi]
mov ecx, edi
and ecx, 0xe8df10a0
mov ebx, edx
xor ebx, 0x8b9077af
sub ebx, ecx
inc ebx
xor ebx, ebp
mov ecx, ebx
xor ecx, 0x71
and ebx, 0xe
add ebx, ebx
sub ebx, ecx
inc bl
mov byte [esi], bl
inc esi
dec edx
add edi, 0xfffffffe
cmp edx, 0xffffffed
jne 0x429ca0
mov esi, dword [esp + 0x44]
movzx edx, word [esi]
mov ecx, eax
test dx, dx
je 0x429d01
add esi, 2
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x429cf0
mov word [ecx], 0
movzx edx, word [esp + 4]
test dx, dx
mov ebp, dword [esp + 0x38]
je 0x429d31
lea esi, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x429d20
mov word [ecx], 0
mov ecx, dword [esp + 0x100]
push dword [esp + 0x54]
push dword [esp + 0x5c]
push eax
call fcn.0040a300
jmp case.0x427feb.105
Function at 0x429d9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc4
push eax
mov dword [ebp - 0x14], esp
sub esp, 8
mov esi, esp
push eax
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x20
mov eax, esp
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x90], 0x93d391ad
mov dword [ebp - 0x8c], 0xafdeaddc
mov dword [ebp - 0x88], 0xabcba9f4
mov dword [ebp - 0x84], 0xa7c7a528
mov dword [ebp - 0x80], 0xa3c6a19d
mov dword [ebp - 0x7c], 0xbfc9bdea
mov dword [ebp - 0x78], 0xbbc7b934
mov dword [ebp - 0x74], 0xb7d7b5c4
mov dword [ebp - 0x70], 0xb389b1cc
mov dword [ebp - 0x6c], 0xcfaacdf7
mov dword [ebp - 0x68], 0xcbb7c9bb
mov dword [ebp - 0x64], 0xc7b5c5b7
mov dword [ebp - 0x60], 0xc3b5c1b9
mov dword [ebp - 0x5c], 0xdfe8ddaa
mov dword [ebp - 0x58], 0xdbafd950
mov dword [ebp - 0x54], 0xd7d6d5a0
lea eax, [ebp - 0x50]
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x50], 0
mov byte [ebp - 0x4e], 0
mov ecx, 0x5f8639c
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x5f8642c]
xor edx, ecx
lea edi, [edx - 0x1dd9f20d]
not edx
add edx, edx
and edx, 2
mov ebx, edx
and ebx, edi
or edx, edi
xor edx, 1
add edx, ebx
mov byte [ebp + ecx - 0x5f8642c], dl
inc ecx
cmp ecx, 0x5f863df
jne 0x429e60
lea eax, [ebp - 0xd0]
lea edx, [ebp - 0x90]
mov ecx, 0x10
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x90]
xor ebx, ebx
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
push dword [ebp - 0x14]
push 0
push 0
push 0x1f
push eax
push 0
call dword [0x44bccc]
mov dword [esi], 0x77b689a7
mov word [esi + 4], 0
nop
nop
nop
movzx ecx, byte [esi + ebx]
lea edx, [ebx + 0x1e]
and edx, ecx
add ecx, ebx
add ecx, 0x1e
add edx, edx
sub ecx, edx
add cl, 0x6a
mov byte [esi + ebx], cl
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
cmp ebx, 6
jb case.default.0x429f11
xor ecx, ecx
cmp eax, dword [esi]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446fb4]
Function at 0x437a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043ec70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448268]

Function at 0x437cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043f390
add esp, 0x14
test eax, eax
js 0x437e16
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043f7a0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x437d5a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x437d28
mov eax, 0xffffffff
jmp 0x437d2f
lea eax, [eax*2 + 2]
push eax
call fcn.00409550
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043fdf0
add esp, 0x14
test eax, eax
jns 0x437d5a
push esi
call fcn.00409560
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xd0cfcecd
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [edi + 0xd]
mov edx, ecx
or edx, 0xe2
sub edx, edi
add edx, 0xd3
and ecx, 0x1d
or ecx, edx
xor cl, byte [esp + edi + 4]
xor cl, 0xe2
add cl, 0x1f
mov byte [esp + edi + 4], cl
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, 7
jb 0x437d80
mov ecx, dword [0x44bcd0]
test ecx, ecx
je 0x437dfa
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44bcd4]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x437de0
inc edi
cmp ecx, edi
jne 0x437dd0
jmp 0x437dfa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x437dfa
push eax
push 4
push ecx
push dword [0x44bcd8]
call fcn.0043c460
add esp, 0x10
test esi, esi
jne 0x437e18
lea eax, [esp + 4]
push eax
call fcn.0043ea80
add esp, 4
test al, al
je 0x437e16
cmp dword [esp + 4], 1
je 0x437e18
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4399c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp], 0x77760958
mov word [esp + 4], 0
mov ecx, 0xe5fa7d3e
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x1a0582c2]
xor esi, ecx
lea edx, [esi + 0xc9]
and esi, 1
and edx, 0xfe
sub edx, esi
add dl, 2
mov byte [esp + ecx + 0x1a0582c2], dl
inc ecx
cmp ecx, 0xe5fa7d44
jne 0x4399e0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x453cf4]
add esp, 8
pop esi
ret

Function at 0x439a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448578]
Function at 0x439ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov dword [esp + 8], 0
mov dword [esp], 0xd0cfcecd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x2d
xor cl, byte [esp + eax]
add cl, 0x1f
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x439b00
mov ebx, dword [esp]
mov eax, dword [0x44bcd0]
test eax, eax
je 0x439b66
xor ecx, ecx
mov edx, dword [0x44bcd4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x439b40
inc ecx
cmp eax, ecx
jne 0x439b30
jmp 0x439b66
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x439b66
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44bcd8]
call fcn.0043c460
add esp, 0x1c
mov ebx, eax
mov dword [esp], 0x713e3f38
mov dword [esp + 4], 0
mov eax, 0xf961f6bb
mov ecx, 0xf2c3ed76
nop
mov esi, ecx
and esi, 0x74
mov edx, eax
xor edx, 0xba
add edx, esi
xor dl, byte [esp + eax + 0x69e0945]
add dl, 0xb7
mov byte [esp + eax + 0x69e0945], dl
inc eax
add ecx, 2
cmp eax, 0xf961f6c3
jne 0x439b80
cmp ebx, dword [esp]
jne 0x439d04
mov dword [esp + 0x10], edi
push dword [esp + 8]
call fcn.004399c0
add esp, 4
mov edi, dword [esp + 8]
mov dword [esp], 0xd0cfcecd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
mov ecx, edx
add cl, 0x2d
xor cl, byte [esp + edx]
add cl, 0x1f
mov byte [esp + edx], cl
inc edx
cmp edx, 7
jne 0x439be0
mov ebx, dword [esp]
mov edx, dword [0x44bcd0]
test edx, edx
je 0x439c45
xor ebp, ebp
mov esi, dword [0x44bcd4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x61813e67
je 0x439c20
inc ebp
cmp edx, ebp
jne 0x439c10
jmp 0x439c45
mov edx, dword [esi + ebp*8 + 4]
cmp edx, ebx
je 0x439c45
push 0
push edi
push eax
push 5
push 0x10
push edx
push dword [0x44bcd8]
mov esi, eax
call fcn.0043c460
add esp, 0x1c
mov ebx, eax
mov eax, esi
test ebx, ebx
js 0x439cfb
mov dword [esp], 0xe3222345
mov word [esp + 4], 0
mov ecx, 8
mov edx, 0x1e0425f7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 8]
mov esi, edx
and esi, 0x160400d7
xor esi, edi
xor esi, 0xd7ffdadf
and edi, ecx
not edi
and edi, esi
lea ebx, [edi + edi]
sub ebx, edi
add bl, 0xd8
mov byte [esp + ecx - 8], bl
inc ecx
dec edx
cmp ecx, 0xe
jne 0x439c70
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov esi, dword [eax]
mov ecx, eax
mov ebx, dword [esp + 0x28]
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x439cd5
add ebp, 2
cmp si, di
je 0x439cc0
cmp si, di
je 0x439ce6
mov esi, dword [ecx]
test esi, esi
jne 0x439cb0
mov ebx, dword [esp + 0xc]
jmp 0x439cfb
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebx, ebx
push eax
call fcn.00439a30
add esp, 4
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x439d30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x439de0
xor eax, eax
cmp dword [ecx], 0
jne 0x439e1a
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xd0cfcecd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov ebx, eax
add bl, 0x2d
xor bl, byte [esp + eax]
add bl, 0x1f
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x439da0
mov eax, dword [esp]
mov esi, dword [0x44bcd0]
test esi, esi
je 0x439e1a
xor edi, edi
mov ebx, dword [0x44bcd4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x439e23
inc edi
cmp esi, edi
jne 0x439dd0
jmp 0x439e1a
mov dword [esp + 8], 0x81c6c7cc
mov word [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x31
xor cl, byte [esp + eax + 8]
add cl, 0xb
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 6
jne 0x439e00
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x439e1a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44bcd8]
call fcn.0043c460
add esp, 0x1c
jmp 0x439e1a

Function at 0x439e50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x439eea
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xd0cfcecd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x2d
xor bl, byte [esp + edx]
add bl, 0x1f
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x439e80
mov edx, dword [0x44bcd0]
test edx, edx
je 0x439ede
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44bcd4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439ec0
inc edi
cmp edx, edi
jne 0x439eb0
jmp 0x439ede
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x439ede
push eax
push 4
push edx
push dword [0x44bcd8]
mov esi, ecx
call fcn.0043c460
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x439ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x439f63
mov edx, dword [ecx]
test edx, edx
je 0x439f63
mov dword [esp + 4], 0xd0cfcecd
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
mov ebx, eax
add bl, 0x2d
xor bl, byte [esp + eax + 4]
add bl, 0x1f
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 7
jne 0x439f20
mov eax, dword [esp + 4]
mov ebx, dword [0x44bcd0]
test ebx, ebx
je 0x439fe1
xor edi, edi
mov esi, dword [0x44bcd4]
cmp dword [esi + edi*8], 0xaf0e0c2e
je 0x439fc0
inc edi
cmp ebx, edi
jne 0x439f50
jmp 0x439fe1
mov dword [esp + 4], 0x73323138
mov edx, 0x72d553f4
movzx eax, byte [esp + edx - 0x72d553f0]
mov ebx, eax
mov esi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xf5
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x3c
mov byte [esp + edx - 0x72d553f0], al
inc edx
cmp edx, 0x72d553f8
jne 0x439f70
mov eax, dword [esp + 4]
jmp 0x43a13b
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x439fe1
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x44bcd8]
mov esi, ecx
call fcn.0043c460
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43a0a4
cmp eax, 0xc000010a
jne 0x43a0a4
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov ebx, dword [ecx]
mov dword [esp + 4], 0xd0cfcecd
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x2d
xor dl, byte [esp + eax + 4]
add dl, 0x1f
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 7
jne 0x43a030
xor edi, edi
cmp esi, 0xffffffff
je 0x43a051
lea edi, [esp + 0x10]
mov eax, dword [esp + 4]
mov esi, dword [0x44bcd0]
test esi, esi
je 0x43a0a4
mov dword [esp + 0xc], ebx
xor ebx, ebx
mov edx, dword [0x44bcd4]
nop
nop
nop
nop
nop
cmp dword [edx + ebx*8], 0x4c697c35
je 0x43a080
inc ebx
cmp esi, ebx
jne 0x43a070
jmp 0x43a0a4
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0x43a0a4
push edi
push 0
push dword [esp + 0x14]
push 0xc
push edx
push dword [0x44bcd8]
mov esi, ecx
call fcn.0043c460
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43a13b
mov edx, dword [ecx]
test edx, edx
je 0x43a13b
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xd0cfcecd
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor ebx, ebx
mov edx, ebx
add dl, 0x2d
xor dl, byte [esp + ebx + 4]
add dl, 0x1f
mov byte [esp + ebx + 4], dl
inc ebx
cmp ebx, 7
jne 0x43a0d0
mov esi, dword [0x44bcd0]
test esi, esi
je 0x43a135
mov edx, dword [esp + 4]
xor ebx, ebx
mov edi, dword [0x44bcd4]
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x1b6183f2
je 0x43a110
inc ebx
cmp esi, ebx
jne 0x43a100
jmp 0x43a135
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x43a135
push dword [esp + 0xc]
push 4
push esi
push dword [0x44bcd8]
mov esi, ecx
mov edi, eax
call fcn.0043c460
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43a150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0xd0cfcecd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x2d
xor dl, byte [esp + eax]
add dl, 0x1f
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43a180
test ebx, ebx
jne 0x43a19c
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44bcd0]
test ebp, ebp
je 0x43a201
xor edx, edx
mov esi, dword [0x44bcd4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43a1da
mov edi, edx
xor edi, 1
and edx, 1
lea edx, [edi + edx*2]
cmp edx, ebp
jb 0x43a1c0
jmp 0x43a201
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43a201
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44bcd8]
call fcn.0043c460
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43ad70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov dword [esp + 0x28], 0xf37ef166
mov dword [esp + 0x2c], 0xef7aed70
mov dword [esp + 0x30], 0xeb3ce97c
mov dword [esp + 0x34], 0xe772e578
mov dword [esp + 0x38], 0xe3e2e174
mov word [esp + 0x3c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x2c
xor cl, byte [esp + eax + 0x28]
add cl, 0x24
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x16
jne 0x43adb0
lea eax, [esp + 0x28]
push eax
call fcn.0043dcb0
add esp, 4
mov dword [0x453cec], eax
mov esi, 0xd0d0c32
test eax, eax
je 0x43ade6
mov esi, 0xd4123fb2
mov ebp, 0xf51ef565
xor eax, eax
cmp ebp, 0xd0d0c32
setl al
mov eax, dword [eax*4 + 0x448590]
mov ecx, 0x49539f57
xor ecx, dword [0x448598]
add eax, ecx
inc eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ecx
jmp eax

Function at 0x43c2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x448a0c]

Function at 0x43d400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [esp + 0x48]
movzx eax, word [edi]
mov dword [esp + 8], 0xd1ce9583
mov dword [esp + 0xc], 0
xor ecx, ecx
mov edx, ecx
add dl, 0xcd
xor dl, byte [esp + ecx + 8]
dec dl
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 8
jne 0x43d420
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x448e20]
mov ecx, dword [0x448e28]
mov edx, ecx
and edx, 0x94bc666b
or edx, 0x8039180
and ecx, 0x6b439994
xor ecx, edx
xor ecx, 0x63400814
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x43e290
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, dword [esp + 0x48]
movzx eax, word [esi]
mov dword [esp], 0xd1ce9583
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x4d
xor dl, byte [esp + ecx]
add dl, 0x7f
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne case.default.0x43e2ce
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4494b0]