joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43b119
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43b12a
cmp eax, 2
je 0x43b19c
jmp 0x43b1c9
push 0xbbf966b4
push dword [0x44da90]
call fcn.00440ed0
add esp, 8
test eax, eax
je 0x43b167
mov ecx, dword [esi]
test ecx, ecx
je 0x43b194
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43b170
cmp dword [esp], 0
je 0x43b170
mov dword [esi + 4], 3
jmp 0x43b194
mov dword [esi + 4], 1
jmp 0x43b1c9
lea eax, [esp + 0xc]
push eax
call fcn.00441770
add esp, 4
test al, al
je 0x43b194
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43b191
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43b1c9
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x455ab8]
call fcn.00440ed0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43b2a7
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0x7c7d7a7b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
lea ecx, [esi + esi]
not ecx
add ecx, esi
mov ebx, esi
and ebx, 5
mov edx, ecx
and edx, 0xfa
or edx, ebx
lea ebx, [eax + 0xea]
xor edx, esi
xor edx, 0xfa
not esi
or esi, edx
mov edx, esi
not edx
or edx, ebx
add edx, esi
mov esi, 0xfe
sub esi, edx
or ecx, ebx
and ecx, esi
mov dl, 0x6d
sub dl, cl
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 1
or eax, 0xd8742c21
add eax, ecx
add eax, 0x278bd3e0
cmp eax, 7
jb 0x43b1f0
mov eax, dword [esp]
mov edx, dword [0x44da9c]
test edx, edx
je 0x43b2a7
xor esi, esi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43b280
inc esi
cmp edx, esi
jne 0x43b270
jmp 0x43b2a7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43b2a7
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push edx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43c340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov dword [esp + 0x4c], 0x71ca7fc2
mov dword [esp + 0x50], 0x75ce73d4
mov dword [esp + 0x54], 0x498877c8
mov dword [esp + 0x58], 0x4df64bec
mov dword [esp + 0x5c], 0x414e4ff0
mov dword [esp + 0x60], 0
mov eax, 0x95
mov ecx, 0x6a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x49]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
mov bl, 0x16
sub bl, dl
mov byte [esp + eax - 0x49], bl
inc eax
dec ecx
cmp eax, 0xad
jne 0x43c390
lea eax, [esp + 0x4c]
push eax
call fcn.00440990
add esp, 4
mov dword [0x455ab8], eax
mov dword [esp + 0x28], 0xe621f207
test eax, eax
je 0x43c3d4
mov dword [esp + 0x28], 0xe4b283
mov ebp, 0x86b48d
xor eax, eax
cmp ebp, 0xf431ee60
setl al
mov eax, dword [eax*4 + 0x44af30]
mov ecx, 0xc3493fb5
xor ecx, dword [0x44af38]
add eax, ecx
inc eax
mov dword [esp + 4], ecx
jmp eax

Function at 0x43e130
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44b88c]
Function at 0x43f580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43f5f0
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43f75e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43f75e
mov dword [esp], 0x888b8a8d
mov word [esp + 4], 0
mov byte [esp + 6], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, eax
and edx, 5
xor edx, 0x4266571d
mov edi, eax
and edi, 2
sub edi, edx
xor edi, ecx
mov ecx, edi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
add cl, 0x90
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43f610
mov eax, dword [esp]
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x43f69a
xor edx, edx
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43f670
inc edx
cmp ecx, edx
jne 0x43f660
jmp 0x43f69a
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f69a
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x43f75e
push 0x732f71fd
push dword [0x455ab8]
call fcn.00440ed0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x888b8a8d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
movzx esi, byte [esp + edx]
mov edi, edx
and edi, 5
xor edi, 0x4266571d
mov ebx, edx
and ebx, 2
sub ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0x90
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43f6e0
mov edx, dword [0x44da9c]
test edx, edx
je 0x43f75e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43f740
inc edi
cmp edx, edi
jne 0x43f730
jmp 0x43f75e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43f75e
push ecx
push 1
push edx
push dword [0x44daa4]
mov esi, eax
call fcn.0043e1f0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
push eax
push eax
mov dword [ebp - 0x10], esp
movzx edx, word [eax]
mov dword [ebp - 0x20], 0x1f1e4755
mov word [ebp - 0x1c], 0
mov ecx, 0x8b2fd53a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx + 0x74d02aa6]
xor esi, ecx
mov edi, esi
not edi
or edi, 0x4810d5dd
add edi, esi
inc edi
mov ebx, esi
and ebx, 0xdd
xor ebx, 0xf7ff2aff
add esi, ebx
add esi, 0x4810d5de
mov ebx, esi
and ebx, edi
xor esi, edi
lea ebx, [esi + ebx*2]
inc bl
mov byte [ebp + ecx + 0x74d02aa6], bl
inc ecx
cmp ecx, 0x8b2fd540
jne 0x440f00
xor ecx, ecx
cmp dword [ebp - 0x20], edx
setne cl
xor esi, esi
jmp dword [ecx*4 + 0x44c5cc]

Function at 0x4417c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4417e0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4417fb
mov eax, 0xffffffff
jmp 0x4417fe
add eax, 0xa
push eax
call fcn.0040c8c0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x441841
add edi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x441830
mov word [ecx], 0
lea ecx, [esi + 4]
mov edx, ecx
or edx, 2
and esi, 2
imul edx, esi
xor esi, 2
and ecx, 0xfffd
imul ecx, esi
lea esi, [edx + ecx]
mov word [esp + 8], si
add ecx, edx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov ecx, 0xf3d9c9f1
mov edx, 0xe
nop
nop
movzx edi, byte [esp + ecx + 0xc26360f]
mov esi, edx
xor esi, ecx
and esi, edi
xor esi, ecx
mov edi, esi
xor edi, 0xc340f1b6
and esi, 0x30990849
add esi, esi
sub esi, edi
mov ebx, esi
or ebx, 1
add ebx, esi
not esi
or esi, 1
add ebx, esi
inc bl
mov byte [esp + ecx + 0xc26360f], bl
inc ecx
dec edx
cmp ecx, 0xf3d9c9f7
jne 0x4418c0
mov esi, dword [esp]
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x44197c
xor edx, edx
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x44193a
mov ebx, edx
xor ebx, 1
and edx, 1
lea edx, [ebx + edx*2]
cmp edx, ecx
jb 0x441920
jmp 0x44197c
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x44197c
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0xb
push ecx
push dword [0x44daa4]
mov edi, eax
call fcn.0043e1f0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.0040c8d0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441990
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4419b0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4419cb
mov eax, 0xffffffff
jmp 0x4419ce
add eax, 0xa
push eax
call fcn.0040c8c0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x441a11
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x441a00
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov ecx, 0xf3d9c9f1
mov edx, 0xe
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0xc26360f]
mov esi, edx
xor esi, ecx
and esi, ebx
xor esi, ecx
mov ebx, esi
xor ebx, 0xc340f1b6
and esi, 0x30990849
add esi, esi
sub esi, ebx
mov ebx, esi
or ebx, 1
add ebx, esi
not esi
or esi, 1
add ebx, esi
inc bl
mov byte [esp + ecx + 0xc26360f], bl
inc ecx
dec edx
cmp ecx, 0xf3d9c9f7
jne 0x441a80
mov esi, dword [esp]
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x441b21
xor edx, edx
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x441af0
inc edx
cmp ecx, edx
jne 0x441ae0
jmp 0x441b21
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x441b21
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x44daa4]
mov edi, eax
call fcn.0043e1f0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c8d0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x441b60
mov ebx, eax
sar ebx, 1
lea esi, [ebx + 4]
and eax, 2
mov ecx, esi
xor ecx, 1
add ecx, eax
jns 0x441b85
mov ecx, 0xffffffff
jmp 0x441b87
add ecx, ecx
push ecx
call fcn.0040c8c0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x441bd1
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x441bc0
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, ebx
lea ecx, [esi + edx]
mov word [esp], cx
lea ecx, [esi + edx]
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x40474645
mov word [esp + 0x24], 0
mov ecx, 0xf3d9c9f1
mov edx, 0xe
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0xc26362f]
mov esi, edx
xor esi, ecx
and esi, edi
xor esi, ecx
mov edi, esi
xor edi, 0xc340f1b6
and esi, 0x30990849
add esi, esi
sub esi, edi
mov ebx, esi
or ebx, 1
add ebx, esi
not esi
or esi, 1
add ebx, esi
inc bl
mov byte [esp + ecx + 0xc26362f], bl
inc ecx
dec edx
cmp ecx, 0xf3d9c9f7
jne 0x441c50
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x441ce9
xor edx, edx
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x441cc0
inc edx
cmp ecx, edx
jne 0x441cb0
jmp 0x441ce9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x441ce9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x44daa4]
mov edi, eax
call fcn.0043e1f0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040c8d0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x441cff
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov eax, 0xf3d9c9f1
mov edx, 0xe
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc26360f]
mov ebx, edx
xor ebx, eax
and ebx, ecx
xor ebx, eax
mov ecx, ebx
xor ecx, 0xc340f1b6
and ebx, 0x30990849
add ebx, ebx
sub ebx, ecx
mov ecx, ebx
or ecx, 1
add ecx, ebx
not ebx
or ebx, 1
add ecx, ebx
inc cl
mov byte [esp + eax + 0xc26360f], cl
inc eax
dec edx
cmp eax, 0xf3d9c9f7
jne 0x441d40
mov eax, dword [esp]
mov edx, dword [0x44da9c]
test edx, edx
je 0x441dd8
xor ebx, ebx
mov ecx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x441db0
inc ebx
cmp edx, ebx
jne 0x441da0
jmp 0x441dd8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x441dd8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push edx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x20
test edi, edi
je 0x441de2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x441dee
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov eax, 0xf3d9c9f1
mov ebx, 0xe
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc26360f]
mov ebp, ebx
xor ebp, eax
and ebp, ecx
xor ebp, eax
mov ecx, ebp
xor ecx, 0xc340f1b6
and ebp, 0x30990849
add ebp, ebp
sub ebp, ecx
mov ecx, ebp
or ecx, 1
add ecx, ebp
not ebp
or ebp, 1
add ecx, ebp
inc cl
mov byte [esp + eax + 0xc26360f], cl
inc eax
dec ebx
cmp eax, 0xf3d9c9f7
jne 0x441e30
mov eax, dword [esp]
mov ebx, dword [0x44da9c]
test ebx, ebx
je 0x441ed2
mov ecx, edi
xor ebp, ebp
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x441ea2
inc ebp
cmp ebx, ebp
jne 0x441e90
mov edi, ecx
jmp 0x441ed2
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
mov edi, ecx
je 0x441ed2
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x30
cmp eax, 0x103
jne 0x441f9d
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov eax, 0xf3d9c9f1
mov ecx, 0xe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc26360f]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
xor esi, 0xc340f1b6
and edx, 0x30990849
add edx, edx
sub edx, esi
mov ebx, edx
or ebx, 1
add ebx, edx
not edx
or edx, 1
add ebx, edx
inc bl
mov byte [esp + eax + 0xc26360f], bl
inc eax
dec ecx
cmp eax, 0xf3d9c9f7
jne 0x441f00
mov eax, dword [esp]
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x441f95
mov esi, edi
xor edx, edx
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x441f72
inc edx
cmp ecx, edx
jne 0x441f60
mov edi, esi
jmp 0x441f95
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, esi
je 0x441f95
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x18
test eax, eax
js 0x441f9d
mov eax, dword [esp + 8]
test edi, edi
je 0x441fb0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x441fae
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov eax, 0xf3d9c9f1
mov ebx, 0xe
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc26360f]
mov ebp, ebx
xor ebp, eax
and ebp, ecx
xor ebp, eax
mov ecx, ebp
xor ecx, 0xc340f1b6
and ebp, 0x30990849
add ebp, ebp
sub ebp, ecx
mov ecx, ebp
or ecx, 1
add ecx, ebp
not ebp
or ebp, 1
add ecx, ebp
inc cl
mov byte [esp + eax + 0xc26360f], cl
inc eax
dec ebx
cmp eax, 0xf3d9c9f7
jne 0x441ff0
mov eax, dword [esp]
mov ebx, dword [0x44da9c]
test ebx, ebx
je 0x442092
mov ecx, edi
xor ebp, ebp
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x442062
inc ebp
cmp ebx, ebp
jne 0x442050
mov edi, ecx
jmp 0x442092
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
mov edi, ecx
je 0x442092
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x30
cmp eax, 0x103
jne 0x44215d
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov eax, 0xf3d9c9f1
mov ecx, 0xe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc26360f]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
xor esi, 0xc340f1b6
and edx, 0x30990849
add edx, edx
sub edx, esi
mov ebx, edx
or ebx, 1
add ebx, edx
not edx
or edx, 1
add ebx, edx
inc bl
mov byte [esp + eax + 0xc26360f], bl
inc eax
dec ecx
cmp eax, 0xf3d9c9f7
jne 0x4420c0
mov eax, dword [esp]
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x442155
mov esi, edi
xor edx, edx
mov edi, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x442132
inc edx
cmp ecx, edx
jne 0x442120
mov edi, esi
jmp 0x442155
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, esi
je 0x442155
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x18
test eax, eax
js 0x44215d
mov eax, dword [esp + 8]
test edi, edi
je 0x442167
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x442190
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov eax, 0xf3d9c9f1
mov edi, 0xe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc26360f]
mov ebx, edi
xor ebx, eax
and ebx, ecx
xor ebx, eax
mov ecx, ebx
xor ecx, 0xc340f1b6
and ebx, 0x30990849
add ebx, ebx
sub ebx, ecx
mov ecx, ebx
or ecx, 1
add ecx, ebx
not ebx
or ebx, 1
add ecx, ebx
inc cl
mov byte [esp + eax + 0xc26360f], cl
inc eax
dec edi
cmp eax, 0xf3d9c9f7
jne 0x442220
mov eax, dword [esp]
mov edi, dword [0x44da9c]
test edi, edi
je 0x4422b5
xor ebx, ebx
mov ebp, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x442291
inc ebx
cmp edi, ebx
jne 0x442280
jmp 0x4422b5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x4422b5
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push edi
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4011a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4011c0
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x4011bf
mov dl, byte [esp + 0x10]
xor byte [eax + ecx], dl
inc eax
cmp eax, esi
jl 0x4011b7
pop esi
ret

Function at 0x401290
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x148
mov eax, dword [0x40c118]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x15c]
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x160]
push edi
push eax
mov esi, 0xf4240
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea ecx, [ecx]
push esi
lea ecx, [esp + 0x14]
push 0x40a1fc
push ecx
call fcn.00402f28
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push edi
lea eax, [esp + 0x58]
push eax
call ebx
lea ecx, [esp + 0x50]
push ecx
inc esi
call ebp
test eax, eax
jne 0x4012d0
lea eax, [esp + 0x50]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401306
push edi
call fcn.00402efc
mov ecx, dword [esp + 0x158]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00402b55
add esp, 0x148
ret