joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ba00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xc6563362
nop
nop
nop
movzx ecx, byte [esp + eax + 0x39a9cc9e]
xor ecx, eax
mov edx, 0xea
sub edx, ecx
not ecx
and ecx, 1
or edx, 1
sub ecx, edx
mov byte [esp + eax + 0x39a9cc9e], cl
inc eax
cmp eax, 0xc6563369
jne 0x43ba30
mov edi, dword [esp]
mov eax, dword [0x44e1c8]
test eax, eax
je 0x43baa6
xor ecx, ecx
mov edx, dword [0x44e1cc]
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43ba80
inc ecx
cmp eax, ecx
jne 0x43ba70
jmp 0x43baa6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43baa6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xf332314c
xor eax, eax
nop
mov ecx, eax
add cl, 0xc
xor cl, byte [esp + eax]
add cl, 0xc4
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43bab0
cmp edi, dword [esp]
jne 0x43bc40
mov dword [esp + 0x10], esi
push dword [esp + 8]
call fcn.0043b900
add esp, 4
mov esi, dword [esp + 8]
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx + 0x39a9cc9e]
xor ecx, edx
mov edi, 0xea
sub edi, ecx
not ecx
and ecx, 1
or edi, 1
sub ecx, edi
mov byte [esp + edx + 0x39a9cc9e], cl
inc edx
cmp edx, 0xc6563369
jne 0x43bb00
mov edi, dword [esp]
mov edx, dword [0x44e1c8]
test edx, edx
je 0x43bb76
xor ecx, ecx
mov ebp, dword [0x44e1cc]
cmp dword [ebp + ecx*8], 0x61813e67
je 0x43bb51
inc ecx
cmp edx, ecx
jne 0x43bb40
jmp 0x43bb76
mov edx, dword [ebp + ecx*8 + 4]
cmp edx, edi
je 0x43bb76
push 0
push esi
push eax
push 5
push 0x10
push edx
push dword [0x44e1d0]
mov esi, eax
call fcn.0043e5b0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43bc37
mov dword [esp], 0xb7f607e5
mov word [esp + 4], 0
mov ecx, 0xd5ac507e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x2a53af82]
mov edx, ecx
and edx, esi
add edx, edx
add esi, ecx
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
add dl, 0x8a
mov byte [esp + ecx + 0x2a53af82], dl
inc ecx
cmp ecx, 0xd5ac5084
jne 0x43bba0
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov edx, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
mov ebp, dword [ecx + edx + 0x3c]
add ecx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ebp + esi]
movzx edi, word [ebx + esi]
test edx, edx
je 0x43bc05
add esi, 2
cmp dx, di
je 0x43bbf0
movzx esi, di
mov edi, edx
not edi
and edi, esi
not esi
and esi, edx
cmp esi, edi
je 0x43bc22
mov edx, dword [ecx]
test edx, edx
jne 0x43bbe0
mov edi, dword [esp + 0xc]
jmp 0x43bc37
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043b990
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43bc70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43bd40
xor eax, eax
cmp dword [ecx], 0
jne 0x43bd92
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x39a9cc9e]
xor ebx, eax
mov esi, 0xea
sub esi, ebx
not ebx
and ebx, 1
or esi, 1
sub ebx, esi
mov byte [esp + eax + 0x39a9cc9e], bl
inc eax
cmp eax, 0xc6563369
jne 0x43bcf0
mov eax, dword [esp]
mov esi, dword [0x44e1c8]
test esi, esi
je 0x43bd92
xor edi, edi
mov ebx, dword [0x44e1cc]
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43bd9b
inc edi
cmp esi, edi
jne 0x43bd30
jmp 0x43bd92
mov dword [esp + 8], 0x733231c8
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov esi, eax
and esi, 8
mov ebx, ecx
xor ebx, 0x5c338f4c
add ebx, esi
mov esi, edx
and esi, ebx
add esi, esi
sub ebx, esi
add bl, dl
add bl, 0x84
mov byte [esp + ecx + 8], bl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x43bd60
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43bd92
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x1c
jmp 0x43bd92

Function at 0x43bdd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43be85
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x39a9cc9e]
xor ebx, edx
mov esi, 0xea
sub esi, ebx
not ebx
and ebx, 1
or esi, 1
sub ebx, esi
mov byte [esp + edx + 0x39a9cc9e], bl
inc edx
cmp edx, 0xc6563369
jne 0x43be00
mov edx, dword [0x44e1c8]
test edx, edx
je 0x43be78
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44e1cc]
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43be5a
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, edx
jb 0x43be40
jmp 0x43be78
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43be78
push eax
push 4
push edx
push dword [0x44e1d0]
mov esi, ecx
call fcn.0043e5b0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x39a9cc9e]
xor edx, eax
mov esi, 0xea
sub esi, edx
not edx
and edx, 1
or esi, 1
sub edx, esi
mov byte [esp + eax + 0x39a9cc9e], dl
inc eax
cmp eax, 0xc6563369
jne 0x43c1a0
test ebx, ebx
jne 0x43c1d2
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44e1c8]
test ebp, ebp
je 0x43c224
xor edx, edx
mov esi, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43c200
inc edx
cmp ebp, edx
jne 0x43c1f0
jmp 0x43c224
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43c224
push ebx
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e4d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44af94]
Function at 0x440270
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x898a8b7c
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, eax
and edi, 6
mov ebx, edx
xor ebx, 0x6ef7363
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0x10
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 7
jne case.default.0x4402dc
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44b988]
Function at 0x440b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440ba0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x440bbb
mov eax, 0xffffffff
jmp 0x440bbe
add eax, 0xa
push eax
call fcn.004084d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x440c01
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x440bf0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x9b
xor dl, byte [esp + ecx]
add dl, 0xf9
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 7
jne 0x440c80
mov esi, dword [esp]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x440d02
xor edx, edx
mov edi, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440cc0
inc edx
cmp ecx, edx
jne 0x440cb0
jmp 0x440d02
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x440d02
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44e1d0]
mov edi, eax
call fcn.0043e5b0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004084e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440d40
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x440d5b
mov eax, 0xffffffff
jmp 0x440d5e
add eax, 0xa
push eax
call fcn.004084d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440da1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440d90
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9b
xor dl, byte [esp + ecx]
add dl, 0xf9
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 7
jne 0x440e10
mov esi, dword [esp]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x440e81
xor edx, edx
mov ebx, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440e50
inc edx
cmp ecx, edx
jne 0x440e40
jmp 0x440e81
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440e81
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44e1d0]
mov edi, eax
call fcn.0043e5b0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004084e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440ec0
mov ebx, eax
sar ebx, 1
mov ecx, eax
and ecx, 8
mov esi, ebx
xor esi, 4
add esi, ecx
and eax, 2
mov ecx, esi
xor ecx, 1
add ecx, eax
jns 0x440eee
mov ecx, 0xffffffff
jmp 0x440ef0
add ecx, ecx
push ecx
call fcn.004084d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x440f31
add edi, 2
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x440f20
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, ebx
lea ecx, [esi + edx]
mov word [esp], cx
lea ecx, [esi + edx]
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x989b9a9d
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9b
xor dl, byte [esp + ecx + 0x20]
add dl, 0xf9
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 7
jne 0x440fb0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x441019
xor edx, edx
mov edi, dword [0x44e1cc]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x440ff0
inc edx
cmp ecx, edx
jne 0x440fe0
jmp 0x441019
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x441019
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44e1d0]
mov edi, eax
call fcn.0043e5b0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.004084e0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44102f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x9b
xor cl, byte [esp + eax]
add cl, 0xf9
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x441070
mov eax, dword [esp]
mov edx, dword [0x44e1c8]
test edx, edx
je 0x4410d8
xor ebx, ebx
mov ecx, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x4410b0
inc ebx
cmp edx, ebx
jne 0x4410a0
jmp 0x4410d8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x4410d8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x20
test edi, edi
je 0x4410e2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x4410ee
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x441100
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x9b
xor bl, byte [esp + eax]
add bl, 0xf9
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x441130
mov eax, dword [esp]
mov ebx, dword [0x44e1c8]
test ebx, ebx
je 0x44119e
xor ebp, ebp
mov edi, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x441170
inc ebp
cmp ebx, ebp
jne 0x441160
jmp 0x44119e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44119e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x30
cmp eax, 0x103
jne 0x441233
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x9b
xor cl, byte [esp + eax]
add cl, 0xf9
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x4411c0
mov eax, dword [esp]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x44122b
xor edx, edx
mov ebx, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x4c697c35
je 0x44120a
mov edi, edx
xor edi, 1
and edx, 1
lea edx, [edi + edx*2]
cmp edx, ecx
jb 0x4411f0
jmp 0x44122b
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x44122b
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x18
test eax, eax
js 0x441233
mov eax, dword [esp + 8]
test esi, esi
je 0x441246
xor ecx, ecx
cmp eax, 0xc0000011
je 0x441244
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x9b
xor bl, byte [esp + eax]
add bl, 0xf9
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x441280
mov eax, dword [esp]
mov ebx, dword [0x44e1c8]
test ebx, ebx
je 0x4412ee
xor ebp, ebp
mov edi, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x4412c0
inc ebp
cmp ebx, ebp
jne 0x4412b0
jmp 0x4412ee
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4412ee
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x30
cmp eax, 0x103
jne 0x441383
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x9b
xor cl, byte [esp + eax]
add cl, 0xf9
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x441310
mov eax, dword [esp]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x44137b
xor edx, edx
mov ebx, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x4c697c35
je 0x44135a
mov edi, edx
xor edi, 1
and edx, 1
lea edx, [edi + edx*2]
cmp edx, ecx
jb 0x441340
jmp 0x44137b
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x44137b
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x18
test eax, eax
js 0x441383
mov eax, dword [esp + 8]
test esi, esi
je 0x44138d
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4413a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4413c0
sar ebx, 1
mov ebp, ebx
and ebp, 0xfffd
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
xor ecx, 2
imul ecx, ebp
lea ebp, [ecx + ebx]
mov word [esp + 8], bp
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x9b
xor cl, byte [esp + eax]
add cl, 0xf9
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x441440
mov eax, dword [esp]
mov edi, dword [0x44e1c8]
test edi, edi
je 0x4414a5
xor ebx, ebx
mov ebp, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x441481
inc ebx
cmp edi, ebx
jne 0x441470
jmp 0x4414a5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x4414a5
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 0x10
push edi
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0xd1f380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x973015
lea edi, [esi - 0x572015]
push edi
or ebp, 0xffffffff
jmp 0xd1f3a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd1f3a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd1f398
mov eax, 1
add ebx, ebx
jne 0xd1f3bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd1f3cc
jne 0xd1f3eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd1f3eb
dec eax
add ebx, ebx
jne 0xd1f3d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd1f3b0
add ebx, ebx
jne 0xd1f3e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd1f43d
xor ecx, ecx
sub eax, 3
jb 0xd1f403
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd1f472
sar eax, 1
mov ebp, eax
jmp 0xd1f40e
add ebx, ebx
jne 0xd1f40e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd1f3dc
inc ecx
add ebx, ebx
jne 0xd1f41c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd1f3dc
add ebx, ebx
jne 0xd1f429
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd1f41e
jne 0xd1f43a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd1f41e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd1f45c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd1f44e
jmp 0xd1f39e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd1f45c
add edi, ecx
jmp 0xd1f39e
pop esi
mov edi, esi
mov ecx, 0x1c920
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd1f47a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd1f47f
lea edi, [esi + 0x91d000]
mov eax, dword [edi]
or eax, eax
je 0xd1f4e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x91f050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd1f4a5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x91f058]
or eax, eax
je 0xd1f4e1
mov dword [ebx], eax
add ebx, 4
jmp 0xd1f4c2
call dword [esi + 0x91f054]
mov ebp, dword [esi + 0x91f05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd1f51b
sub esp, 0xffffff80
jmp 0x44d8b0