joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43daf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43db84
push 0xf8eb88df
push dword [0x44fa04]
call fcn.00442c90
add esp, 8
test eax, eax
je 0x43db49
mov ecx, dword [esi]
test ecx, ecx
je 0x43db81
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43db5d
cmp dword [esp], 0
je 0x43db5d
mov dword [esi + 4], 3
jmp 0x43db81
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43dc03
lea eax, [esp + 0xc]
push eax
call fcn.00443510
add esp, 4
test al, al
je 0x43db81
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43db7e
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43dc03
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 2
mov ebx, edx
xor ebx, 0x21
add ebx, esi
add bl, 0x3a
xor bl, byte [esp + edx]
add bl, 0x39
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 6
jne 0x43dbb0
mov eax, dword [esp]
mov edx, dword [0x44fa10]
test edx, edx
je 0x43dc94
xor esi, esi
mov ebx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43dc70
inc esi
cmp edx, esi
jne 0x43dbf0
jmp 0x43dc94
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 2
mov ebx, edx
xor ebx, 0x21
add ebx, esi
add bl, 0x3a
xor bl, byte [esp + edx]
add bl, 0x39
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 6
jne 0x43dc20
mov eax, dword [esp]
mov edx, dword [0x44fa10]
test edx, edx
je 0x43dc94
xor esi, esi
mov ebx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43dc70
inc esi
cmp edx, esi
jne 0x43dc60
jmp 0x43dc94
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43dc94
push ecx
push ebp
push edi
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push dword [0x44fa18]
push edx
call fcn.00440700
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43dfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43dff9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43e00a
cmp eax, 2
je 0x43e080
jmp 0x43e0ad
push 0xf8eb88df
push dword [0x44fa04]
call fcn.00442c90
add esp, 8
test eax, eax
je 0x43e04b
mov ecx, dword [esi]
test ecx, ecx
je 0x43e078
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43e054
cmp dword [esp + 4], 0
je 0x43e054
mov dword [esi + 4], 3
jmp 0x43e078
mov dword [esi + 4], 1
jmp 0x43e0ad
lea eax, [esp + 0xc]
push eax
call fcn.00443510
add esp, 4
test al, al
je 0x43e078
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e075
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43e0ad
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x457a24]
call fcn.00442c90
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43e144
mov ecx, dword [esi]
mov dword [esp + 4], 0x989b9a9d
mov word [esp + 8], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 2
mov ebx, edx
xor ebx, 0x21
add ebx, esi
add bl, 0x3a
xor bl, byte [esp + edx + 4]
add bl, 0x39
mov byte [esp + edx + 4], bl
inc edx
add eax, 2
cmp edx, 6
jne 0x43e0d0
mov eax, dword [esp + 4]
mov edx, dword [0x44fa10]
test edx, edx
je 0x43e144
xor esi, esi
mov ebx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43e120
inc esi
cmp edx, esi
jne 0x43e110
jmp 0x43e144
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43e144
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44fa18]
push edx
call fcn.00440700
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x440650
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44dbf4]
Function at 0x4417d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x441842
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44199e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44199e
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x92
mov ecx, 0x2d
nop
mov edi, ecx
and edi, 0x2e
mov edx, eax
and edx, 0x91
sub edx, edi
xor dl, byte [esp + eax - 0x92]
add dl, 0xc
mov byte [esp + eax - 0x92], dl
inc eax
dec ecx
cmp eax, 0x99
jne 0x441860
mov eax, dword [esp]
mov ecx, dword [0x44fa10]
test ecx, ecx
je 0x4418da
xor edx, edx
mov edi, dword [0x44fa14]
nop
nop
cmp dword [edi + edx*8], 0x7789b0cb
je 0x4418b0
inc edx
cmp ecx, edx
jne 0x4418a0
jmp 0x4418da
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4418da
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x44fa18]
push ecx
call fcn.00440700
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x44199e
push 0x1e03da9a
push dword [0x457a24]
call fcn.00442c90
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x92
mov esi, 0x2d
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x2e
mov ebx, edx
and ebx, 0x91
sub ebx, edi
xor bl, byte [esp + edx - 0x92]
add bl, 0xc
mov byte [esp + edx - 0x92], bl
inc edx
dec esi
cmp edx, 0x99
jne 0x441930
mov edx, dword [0x44fa10]
test edx, edx
je 0x44199e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44fa14]
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x441980
inc edi
cmp edx, edi
jne 0x441970
jmp 0x44199e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44199e
push ecx
push 1
push dword [0x44fa18]
push edx
mov esi, eax
call fcn.00440700
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4426d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0x939291a0
mov byte [esp + 0xc], 0
mov eax, 0x5c9979c
mov edx, 0x7a366863
nop
nop
movzx esi, byte [esp + eax - 0x5c99794]
mov edi, edx
and edi, 0x5a240844
mov ebx, eax
xor ebx, 0x480104
mov ecx, eax
or ecx, 0x58196bb
and ecx, ebx
or ecx, edi
xor ecx, esi
mov esi, ecx
and esi, 0xf1
xor esi, 0x40
mov edi, ecx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor ecx, 0xb7
add ecx, ebx
add ecx, esi
inc cl
mov byte [esp + eax - 0x5c99794], cl
inc eax
dec edx
cmp eax, 0x5c997a1
jne 0x4426f0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x44e44c]

Function at 0x442b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x73727180
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x6a0c1aeb
mov edx, 0x5f3e514
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x5f3e514]
lea edi, [eax - 0x6a0c1a00]
lea ebp, [esi + esi]
not ebp
add ebp, esi
mov ecx, eax
and ecx, 0x42001ae9
mov ebx, edx
and ebx, 0x5532416
or ebx, ecx
xor ebx, ebp
xor ebx, 0xd2a0dbe9
and ebx, ebp
not esi
or esi, edi
lea ecx, [ebx + ebx]
not ecx
add ecx, ebx
and ecx, esi
add cl, 0x9c
mov byte [esp + edx - 0x5f3e514], cl
dec eax
inc edx
cmp edx, 0x5f3e51b
jne 0x442b90
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor ecx, ecx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
sete cl
jmp dword [ecx*4 + 0x44e51c]
Function at 0x443740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443750
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44376b
mov eax, 0xffffffff
jmp 0x44376e
add eax, 0xa
push eax
call fcn.0040c4e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 8], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4437b1
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4437a0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0x10], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0x12], cx
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0xacb6265
mov edx, 0xf5349d9a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0xacb6265]
lea esi, [edx + 1]
mov dword [esp + 0xc], esi
lea esi, [ecx - 1]
or esi, eax
mov ebx, esi
sub ebx, eax
lea ebp, [edx + ebx]
inc ebp
mov edi, eax
not edi
and edi, dword [esp + 0xc]
mov ebx, edi
not ebx
or ebx, ebp
lea ebp, [edi + eax]
add ebp, ebx
sub ebp, esi
add ebp, ecx
sub esi, ebx
sub esi, edi
sub esi, eax
add esi, edx
and esi, 0xb
xor ebp, 0xf4
lea eax, [esi*2]
add eax, ebp
inc al
mov byte [esp + ecx - 0xacb6265], al
inc ecx
dec edx
cmp ecx, 0xacb626c
jne 0x443830
mov esi, dword [esp]
mov ecx, dword [0x44fa10]
test ecx, ecx
je 0x4438fd
xor edx, edx
mov edi, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x266686e9
je 0x4438ca
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, ecx
jb 0x4438b0
jmp 0x4438fd
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4438fd
mov eax, esp
lea edx, [esp + 0x18]
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
push edx
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44fa18]
push ecx
call fcn.00440700
add esp, 0x24
mov esi, eax
push dword [esp + 8]
call fcn.0040c4f0
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443940
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44395b
mov eax, 0xffffffff
jmp 0x44395e
add eax, 0xa
push eax
call fcn.0040c4e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4439a1
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443990
mov word [ecx], 0
lea eax, [ebx*2 + 8]
mov word [esp + 0x10], ax
lea eax, [ebx*2 + 0xa]
mov word [esp + 0x12], ax
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x94959697
mov word [esp + 0x34], 0
mov byte [esp + 0x36], 0
mov ecx, 0xacb6265
mov edx, 0xf5349d9a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0xc], edx
movzx eax, byte [esp + ecx - 0xacb6235]
lea esi, [edx + 1]
mov dword [esp + 8], esi
lea esi, [ecx - 1]
or esi, eax
mov ebx, esi
sub ebx, eax
lea edi, [edx + ebx]
inc edi
mov edx, eax
not edx
and edx, dword [esp + 8]
mov ebx, edx
not ebx
or ebx, edi
lea edi, [edx + eax]
add edi, ebx
sub edi, esi
sub esi, ebx
sub esi, edx
mov edx, dword [esp + 0xc]
sub esi, eax
add edi, ecx
add esi, edx
and esi, 0xb
xor edi, 0xf4
lea eax, [edi + esi*2]
inc al
mov byte [esp + ecx - 0xacb6235], al
inc ecx
dec edx
cmp ecx, 0xacb626c
jne 0x443a20
mov esi, dword [esp + 0x30]
mov eax, dword [0x44fa10]
test eax, eax
je 0x443ad5
xor ecx, ecx
mov edx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x87573896
je 0x443ab0
inc ecx
cmp eax, ecx
jne 0x443aa0
jmp 0x443ad5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x443ad5
lea ecx, [esp + 0x30]
lea edx, [esp + 0x18]
push ecx
push edx
push 2
push dword [0x44fa18]
push eax
call fcn.00440700
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.0040c4f0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x443aee
mov eax, dword [esp + 0x50]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x94959697
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov eax, 0xacb6265
mov ecx, 0xf5349d9a
nop
nop
nop
nop
nop
nop
mov dword [esp], ecx
movzx edx, byte [esp + eax - 0xacb625d]
inc ecx
mov dword [esp + 4], ecx
lea ebx, [eax - 1]
or ebx, edx
mov ecx, ebx
sub ecx, edx
mov esi, dword [esp]
add esi, ecx
inc esi
mov edi, edx
not edi
and edi, dword [esp + 4]
mov ecx, edi
not ecx
or ecx, esi
lea esi, [edi + edx]
add esi, ecx
sub esi, ebx
sub ebx, ecx
sub ebx, edi
sub ebx, edx
add esi, eax
add ebx, dword [esp]
and ebx, 0xb
xor esi, 0xf4
lea ecx, [esi + ebx*2]
inc cl
mov byte [esp + eax - 0xacb625d], cl
mov ecx, dword [esp]
inc eax
dec ecx
cmp eax, 0xacb626c
jne 0x443b30
mov eax, dword [esp + 8]
mov ecx, dword [0x44fa10]
test ecx, ecx
je 0x443bea
xor edx, edx
mov esi, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa70a987f
je 0x443bc0
inc edx
cmp ecx, edx
jne 0x443bb0
jmp 0x443bea
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x443bea
lea eax, [esp + 8]
lea edx, [esp + 0x24]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x44fa18]
push ecx
call fcn.00440700
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x443bf7
mov ecx, dword [esp + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x443c06
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xacb6265
mov ebx, 0xf5349d9a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xacb6265]
lea ecx, [ebx + 1]
mov dword [esp + 8], ecx
lea ebp, [eax - 1]
or ebp, edx
mov edi, ebp
sub edi, edx
lea esi, [ebx + edi]
inc esi
mov ecx, edx
not ecx
and ecx, dword [esp + 8]
mov edi, ecx
not edi
or edi, esi
lea esi, [ecx + edx]
add esi, edi
sub esi, ebp
add esi, eax
sub ebp, edi
sub ebp, ecx
sub ebp, edx
add ebp, ebx
and ebp, 0xb
xor esi, 0xf4
lea ecx, [esi + ebp*2]
inc cl
mov byte [esp + eax - 0xacb6265], cl
inc eax
dec ebx
cmp eax, 0xacb626c
jne 0x443c40
mov eax, dword [esp]
mov ecx, dword [0x44fa10]
test ecx, ecx
je 0x443cf4
xor esi, esi
mov edi, dword [0x44fa14]
nop
nop
cmp dword [edi + esi*8], 0xd41f89d1
je 0x443cc0
inc esi
cmp ecx, esi
jne 0x443cb0
jmp 0x443cf4
mov ebx, dword [edi + esi*8 + 4]
cmp ebx, eax
je 0x443cf4
lea eax, [esp + 0xc]
push 0
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push eax
push 0
push 0
push 0
push dword [esp + 0x48]
push 9
push dword [0x44fa18]
push ebx
call fcn.00440700
add esp, 0x30
cmp eax, 0x103
jne 0x443dd3
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xacb6265
mov ebp, 0xf5349d9a
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xacb6265]
lea edx, [ebp + 1]
mov dword [esp + 8], edx
lea edx, [eax - 1]
or edx, ecx
mov ebx, edx
sub ebx, ecx
lea esi, [ebx + ebp]
inc esi
mov edi, ecx
not edi
and edi, dword [esp + 8]
mov ebx, edi
not ebx
or ebx, esi
lea esi, [edi + ecx]
add esi, ebx
sub esi, edx
add esi, eax
sub edx, ebx
sub edx, edi
sub edx, ecx
add edx, ebp
and edx, 0xb
xor esi, 0xf4
lea ecx, [esi + edx*2]
inc cl
mov byte [esp + eax - 0xacb6265], cl
inc eax
dec ebp
cmp eax, 0xacb626c
jne 0x443d20
mov eax, dword [esp]
mov ecx, dword [0x44fa10]
test ecx, ecx
je 0x443dcb
xor edx, edx
mov esi, dword [0x44fa14]
nop
nop
cmp dword [esi + edx*8], 0x53f09cfa
je 0x443daa
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
cmp edx, ecx
jb 0x443d90
jmp 0x443dcb
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x443dcb
push 0
push 0
push dword [esp + 0x30]
push 3
push dword [0x44fa18]
push ecx
call fcn.00440700
add esp, 0x18
test eax, eax
js 0x443dd3
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x34]
test edx, edx
je 0x443dea
xor ecx, ecx
cmp eax, 0xc0000011
je 0x443de8
mov ecx, dword [esp + 0x10]
mov dword [edx], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x444000
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, ecx
add ebx, edx
mov word [esp + 0xc], bx
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ecx, [ebx + ecx*2]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xacb6265
mov edi, 0xf5349d9a
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xacb6265]
lea ecx, [edi + 1]
mov dword [esp + 8], ecx
lea ebx, [eax - 1]
or ebx, esi
mov ebp, ebx
sub ebp, esi
lea ecx, [edi + ebp]
inc ecx
mov edx, esi
not edx
and edx, dword [esp + 8]
mov ebp, edx
not ebp
or ebp, ecx
lea ecx, [edx + esi]
add ecx, ebp
sub ecx, ebx
add ecx, eax
sub ebx, ebp
sub ebx, edx
sub ebx, esi
add ebx, edi
and ebx, 0xb
xor ecx, 0xf4
lea ecx, [ecx + ebx*2]
inc cl
mov byte [esp + eax - 0xacb6265], cl
inc eax
dec edi
cmp eax, 0xacb626c
jne 0x444090
mov eax, dword [esp]
mov ecx, dword [0x44fa10]
test ecx, ecx
je 0x44413a
xor edx, edx
mov edi, dword [0x44fa14]
nop
nop
cmp dword [edi + edx*8], 0x9ecf05eb
je 0x444110
inc edx
cmp ecx, edx
jne 0x444100
jmp 0x44413a
mov edi, dword [edi + edx*8 + 4]
cmp edi, eax
je 0x44413a
lea eax, [esp + 0x14]
push dword [esp + 0x4c]
push eax
push dword [esp + 0x50]
push dword [esp + 0x50]
push 4
push dword [0x44fa18]
push edi
call fcn.00440700
add esp, 0x1c
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4011f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp loc.0043036f

Function at 0x4013f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x40c7dc]
mov ecx, dword [eax + 0x4c]
push ecx
call fcn.00401df0
add esp, 4
mov edx, dword [0x40c7dc]
mov dword [edx + 0x110], eax
mov eax, dword [0x40c7dc]
mov ecx, dword [eax + 0x114]
push ecx
jmp loc.004303b0

Function at 0x401870
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
jmp loc.0042fe6c

Function at 0x4019a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [0x40c7dc]
jmp loc.004309e0

Function at 0x401df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
push edi
push esi
mov eax, dword fs:[0x30]
pop esi
pop edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401e36
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 0
je 0x401e5d
cmp dword [ebp - 0xc], 0
jne 0x401e5d
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
push eax
call fcn.00401e80
add esp, 8
mov dword [ebp - 0xc], eax
jmp 0x401e2e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401e70
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0x78
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
jmp loc.0043077c

Function at 0x401fa0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 1
jmp loc.00430142

Function at 0x40241a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b110]
jne 0x402424
repz ret
jmp fcn.004028e9