joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428120
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x844
xor ebp, ebp
xor edi, edi
mov eax, 0x20219
mov ecx, 1
mov dword [esp], 0
jmp dword [ecx*4 + 0x447cc4]
Function at 0x42a970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xf4
mov dword [esp], 0x8fcf89ed
mov dword [esp + 4], 0x83328d3c
mov dword [esp + 8], 0x872781c4
mov dword [esp + 0xc], 0x9b3b8530
mov dword [esp + 0x10], 0x9f9e99fd
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x22
xor dl, byte [esp + ecx]
add dl, 0x56
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x16
jne 0x42a9b0
lea esi, [esp + 0x9e]
mov edx, esp
mov edi, esi
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb2]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push 9
push esi
push 0
call dword [0x44cd1c]
mov dword [esp], 0x17d6c9e7
mov word [esp + 4], 0
mov ecx, 0xabf119ce
nop
movzx edx, byte [esp + ecx + 0x540ee632]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xfa
mov byte [esp + ecx + 0x540ee632], dl
inc ecx
cmp ecx, 0xabf119d4
jne 0x42aa10
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447fd4]
Function at 0x42b790
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov dword [esp + 0x20], 0x8fcf89ed
mov dword [esp + 0x24], 0x83328d3c
mov dword [esp + 0x28], 0x872781c4
mov dword [esp + 0x2c], 0x9b3b8530
mov dword [esp + 0x30], 0x9f3299fd
mov dword [esp + 0x34], 0x93219dce
mov dword [esp + 0x38], 0x97339124
mov dword [esp + 0x3c], 0xeb4b9524
mov dword [esp + 0x40], 0xef91e94c
mov dword [esp + 0x44], 0xe34eed93
mov dword [esp + 0x48], 0xe743e157
mov dword [esp + 0x4c], 0xfb4de553
mov dword [esp + 0x50], 0xff4df941
mov dword [esp + 0x54], 0xf380fd4e
mov dword [esp + 0x58], 0xf74bf178
mov dword [esp + 0x5c], 0xcbcaf548
lea ebp, [esp + 0x60]
mov word [esp + 0x60], 0
mov esi, 0x94b01f22
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi + 0x6b4fe0fe]
mov ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x56
mov byte [esp + esi + 0x6b4fe0fe], al
inc esi
cmp esi, 0x94b01f64
jne 0x42b830
lea edx, [esp + 0x80]
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xc0]
xor ecx, ecx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0x1f
push edx
push 0
call dword [0x44cd1c]
mov dword [esp + 0x20], 0xb10e0fe9
mov byte [esp + 0x24], 0
mov edi, 0x1e8ccc7d
mov edx, 0x82
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x1e8ccc5d]
mov esi, edx
or esi, ebp
mov ebx, edi
or ebx, ebp
mov ecx, edi
xor ecx, ebp
add ecx, ebp
not ecx
add ecx, ebx
and ecx, esi
mov bl, 0x8e
sub bl, cl
mov byte [esp + edi - 0x1e8ccc5d], bl
inc edi
dec edx
cmp edi, 0x1e8ccc82
jne 0x42b8d0
xor ecx, ecx
cmp eax, dword [esp + 0x20]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44810c]
Function at 0x4349a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00418ca0
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4349d9
jmp 0x434b57
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x434a15
jmp 0x434b4f
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042fbf0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x434a49
jmp 0x434b40
mov dword [ebp - 0x1c], eax
mov ebx, eax
sub ebx, 0xffffffff
sub esp, 4
mov dword [esp], ebx
call fcn.00408300
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042fc60
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xff
mov byte [edi + 1], 0x95
mov byte [edi + 2], 0x97
mov byte [edi + 3], 0xaf
mov byte [edi + 4], 0x9a
mov byte [edi + 5], 0xae
mov byte [edi + 6], 0x83
mov byte [edi + 7], 0xb5
mov byte [edi + 8], 0x84
mov byte [edi + 9], 0xf3
mov byte [edi + 0xa], 0xb2
mov byte [edi + 0xb], 0xbf
mov byte [edi + 0xc], 0xb0
mov byte [edi + 0xd], 0x25
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x434ab9
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x14
jae 0x434b0e
movzx edx, byte [edi + eax]
mov ebx, 0xb5
sub ebx, eax
and ebx, edx
mov esi, edx
shl esi, 1
xor esi, 0xffffffff
add esi, edx
mov edx, eax
add edx, 0x4b330c4a
and edx, esi
mov ecx, dword [ebp + 8]
or ebx, edx
add ebx, 0x8800c28d
mov edx, ebx
shl edx, 1
and edx, 2
xor ebx, 1
add ebx, edx
mov byte [edi + eax], bl
add eax, 1
jmp 0x434aca
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x18]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.00409200
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00408310
add esp, 4
jmp 0x434b3c
jmp 0x434b3e
jmp 0x434b40
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x434b57
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00440530
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4493d4]

Function at 0x4399d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00440b70
add esp, 0x14
test eax, eax
js 0x439b13
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00440f00
add esp, 0x24
xor esi, esi
test eax, eax
js 0x439a69
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x439a35
mov eax, 0xffffffff
jmp 0x439a3c
lea eax, [eax*2 + 2]
push eax
call fcn.00408300
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.004414b0
add esp, 0x14
test eax, eax
js 0x439a60
mov esi, edi
jmp 0x439a69
push edi
call fcn.00408310
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp], 0x34353637
mov ecx, 0x3631664c
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3631664c]
xor edx, ecx
mov edi, edx
not edi
lea ebx, [edx - 0xef6ff7d]
or ebx, edi
and ebx, 1
lea edi, [edx*2 - 0x1dedfefa]
and edi, 2
sub edx, edi
lea edx, [edx + ebx*2]
add dl, 0x84
mov byte [esp + ecx - 0x3631664c], dl
inc ecx
cmp ecx, 0x36316650
jne 0x439a80
mov ecx, dword [0x44cd20]
test ecx, ecx
je 0x439afa
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44cd24]
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439ae0
inc edi
cmp ecx, edi
jne 0x439ad0
jmp 0x439afa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x439afa
push eax
push 4
push ecx
push dword [0x44cd28]
call fcn.0043e090
add esp, 0x10
test esi, esi
jne 0x439b15
mov eax, esp
push eax
call fcn.00440360
add esp, 4
test al, al
je 0x439b13
cmp dword [esp], 1
je 0x439b15
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b670
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov dword [esp], 0xe3e2e1d0
mov ecx, 0x82eb20a8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7d14df58]
xor edx, ecx
mov esi, edx
and esi, 0x6800b7
xor edx, 0x71685cb7
lea esi, [edx + esi*2]
mov edx, esi
xor edx, 0xfe
or esi, 1
and edx, esi
add edx, esi
mov byte [esp + ecx + 0x7d14df58], dl
inc ecx
cmp ecx, 0x82eb20ac
jne 0x43b690
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x454d44]
add esp, 4
pop esi
ret

Function at 0x43b6f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4496ec]
Function at 0x43ba30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43baf0
xor eax, eax
cmp dword [ecx], 0
jne 0x43bb1a
mov ebp, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x34353637
mov eax, esp
mov esi, 0xb3
nop
nop
nop
nop
nop
nop
lea edi, [esi - 0xa0]
and edi, 0x12
mov ebx, esi
and ebx, 0xa1
or ebx, edi
xor bl, byte [eax]
mov dl, 0x83
sub dl, bl
mov byte [eax], dl
inc eax
dec esi
cmp esi, 0xaf
jne 0x43baa0
mov eax, dword [esp]
mov esi, dword [0x44cd20]
test esi, esi
je 0x43bb1a
xor edi, edi
mov ebx, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43bb24
inc edi
cmp esi, edi
jne 0x43bae0
jmp 0x43bb1a
mov dword [esp + 4], 0x97d6c9c0
mov byte [esp + 8], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0xae
xor cl, byte [esp + eax + 4]
add cl, 0x9a
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 5
jne 0x43bb00
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43bb1a
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push ebp
push ecx
push 0x10
push esi
push dword [0x44cd28]
call fcn.0043e090
add esp, 0x1c
jmp 0x43bb1a

Function at 0x43bb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [ecx]
test ebp, ebp
je 0x43bbe4
mov dword [esp], 0x34353637
mov edx, esp
mov esi, 0xb3
nop
nop
nop
lea edi, [esi - 0xa0]
and edi, 0x12
mov ebx, esi
and ebx, 0xa1
or ebx, edi
xor bl, byte [edx]
mov al, 0x83
sub al, bl
mov byte [edx], al
inc edx
dec esi
cmp esi, 0xaf
jne 0x43bb70
mov edx, dword [0x44cd20]
test edx, edx
je 0x43bbde
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43bbc0
inc edi
cmp edx, edi
jne 0x43bbb0
jmp 0x43bbde
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43bbde
push ebp
push 4
push edx
push dword [0x44cd28]
mov esi, ecx
call fcn.0043e090
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43be80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov edi, dword [ecx]
mov dword [esp], 0x34353637
mov eax, esp
mov ebp, 0xb3
nop
nop
nop
nop
nop
lea esi, [ebp - 0xa0]
and esi, 0x12
mov edx, ebp
and edx, 0xa1
or edx, esi
xor dl, byte [eax]
mov cl, 0x83
sub cl, dl
mov byte [eax], cl
inc eax
dec ebp
cmp ebp, 0xaf
jne 0x43bea0
test ebx, ebx
jne 0x43becd
lea ebx, [esp + 4]
mov eax, dword [esp]
mov ebp, dword [0x44cd20]
test ebp, ebp
je 0x43bf27
xor edx, edx
mov esi, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43bf00
inc edx
cmp ebp, edx
jne 0x43bef0
jmp 0x43bf27
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43bf27
push ebx
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push edi
push 0x14
push ebp
push dword [0x44cd28]
call fcn.0043e090
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e010
Capabilities:
Encode data using xor

Disassembly:
push ebx
push eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x449bc0]

Function at 0x43fa60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xc1c6c714
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor edx, edx
nop
nop
movzx ecx, byte [esp + edx]
mov esi, eax
and esi, 2
mov edi, edx
xor edi, 0x59600b1
add edi, esi
xor edi, ecx
mov ecx, edi
not ecx
or ecx, 0x9bee0375
lea esi, [edi + ecx]
add ecx, edi
add ecx, 0xe411fc8b
and edi, 0x8a
lea ebx, [edi + esi]
add ebx, 0xe411fc8b
and ecx, 1
or ebx, 1
add ebx, ecx
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 7
jne case.default.0x43fadd
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x1c], 0
sete cl
jmp dword [ecx*4 + 0x44a490]
cli
inc ebx
add byte [ecx - 5], bl
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add ah, ah
cli
inc ebx
add byte [edi - 5], bl
inc ebx
add byte [eax], dl
sti
inc ebx
add byte [ebx + edi*8], dh
inc ebx
add byte [eax], ch
sti
inc ebx
add byte [eax], dh
sti
inc ebx
add byte [eax], dh
sti
inc ebx
add byte [eax], dh
sti
inc ebx
add byte [ebx + edi*8], dh
inc ebx
add byte [eax - 5], al
inc ebx
add byte [eax - 5], al
inc ebx
add byte [eax - 5], al
inc ebx
add byte [edx - 5], al
inc ebx
add byte [edi - 5], bl
inc ebx
add byte [ecx - 5], cl
inc ebx
add byte [eax], dl
cld
inc ebx
add byte [eax], dl
cld
inc ebx
add byte [eax], dl
cld
inc ebx
add byte [edx], dl
cld
inc ebx
add byte [edx], ah
cld
inc ebx
add bh, cl
inc byte [ebx]
jge 0x44a4f6
inc ebx
add byte [ebp - 4], bh
inc ebx
add bh, cl
inc byte [ebx]
lahf
cld
inc ebx
add bh, cl
inc byte [ebx]
ret 0x43fe

Function at 0x43fb70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx eax, word [eax]
mov dword [esp], 0x717ed5a3
mov dword [esp + 4], 0
mov edx, 0x30398795
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x30398795]
mov edi, edx
or edi, esi
lea ecx, [edx - 0x30398700]
and ecx, esi
xor ecx, edi
mov edi, ecx
xor edi, 0xf11fa5e9
mov esi, ecx
or esi, 0x200216
and esi, edi
mov edi, esi
and edi, 0xfffffffd
mov ebx, ecx
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edi
mov edi, ecx
xor edi, 0x16
add edi, ebx
add edi, esi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
mov byte [esp + edx - 0x30398795], cl
inc edx
cmp edx, 0x3039879d
jne 0x43fba0
mov ecx, dword [esp]
mov edx, dword [case.0x43f9dc.30]
nop
nop
nop
nop
nop
nop
nop
Function at 0x4403b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4403d0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x4403eb
mov eax, 0xffffffff
jmp 0x4403ee
add eax, 0xa
push eax
call fcn.00408300
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440431
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440420
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
xor ecx, ecx
mov edx, ecx
add dl, 0x84
xor dl, byte [esp + ecx]
add dl, 0x6c
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x440490
mov esi, dword [esp]
mov ecx, dword [0x44cd20]
test ecx, ecx
je 0x44050f
xor edx, edx
mov edi, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x4404d0
inc edx
cmp ecx, edx
jne 0x4404c0
jmp 0x44050f
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x44050f
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44cd28]
mov edi, eax
call fcn.0043e090
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408310
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x440550
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44056b
mov eax, 0xffffffff
jmp 0x44056e
add eax, 0xa
push eax
call fcn.00408300
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x4405b1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x4405a0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x84
xor dl, byte [esp + ecx]
add dl, 0x6c
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x440630
mov esi, dword [esp]
mov ecx, dword [0x44cd20]
test ecx, ecx
je 0x4406a4
xor edx, edx
mov ebx, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440670
inc edx
cmp ecx, edx
jne 0x440660
jmp 0x4406a4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4406a4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44cd28]
mov edi, eax
call fcn.0043e090
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408310
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4406c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4406e0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4406fb
mov eax, 0xffffffff
jmp 0x4406fe
add eax, 0xa
push eax
call fcn.00408300
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440741
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440730
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x14151617
mov byte [esp + 0x24], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x84
xor dl, byte [esp + ecx + 0x20]
add dl, 0x6c
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 5
jne 0x4407a0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44cd20]
test ecx, ecx
je 0x440809
xor edx, edx
mov ebx, dword [0x44cd24]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x4407e0
inc edx
cmp ecx, edx
jne 0x4407d0
jmp 0x440809
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440809
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44cd28]
mov ebx, eax
call fcn.0043e090
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.00408310
add esp, 4
test edi, edi
je 0x44081c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x440830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
xor eax, eax
mov ecx, eax
add cl, 0x84
xor cl, byte [esp + eax]
add cl, 0x6c
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x440850
mov eax, dword [esp]
mov edx, dword [0x44cd20]
test edx, edx
je 0x4408b8
xor ebx, ebx
mov ecx, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x440890
inc ebx
cmp edx, ebx
jne 0x440880
jmp 0x4408b8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x4408b8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44cd28]
call fcn.0043e090
add esp, 0x20
test edi, edi
je 0x4408c2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x4408ce
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4408e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x84
xor bl, byte [esp + eax]
add bl, 0x6c
mov byte [esp + eax], bl
inc eax
cmp eax, 5
jne 0x440910
mov eax, dword [esp]
mov ebx, dword [0x44cd20]
test ebx, ebx
je 0x44097e
xor ebp, ebp
mov edi, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x440950
inc ebp
cmp ebx, ebp
jne 0x440940
jmp 0x44097e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44097e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44cd28]
call fcn.0043e090
add esp, 0x30
cmp eax, 0x103
jne 0x440a09
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x84
xor cl, byte [esp + eax]
add cl, 0x6c
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x4409a0
mov eax, dword [esp]
mov ecx, dword [0x44cd20]
test ecx, ecx
je 0x440a01
xor edx, edx
mov edi, dword [0x44cd24]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x4409e0
inc edx
cmp ecx, edx
jne 0x4409d0
jmp 0x440a01
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x440a01
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44cd28]
call fcn.0043e090
add esp, 0x18
test eax, eax
js 0x440a09
mov eax, dword [esp + 8]
test esi, esi
je 0x440a1c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x440a1a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret