joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425900
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x31fd3f1b
mov dword [esp + 8], 0x35c233c0
mov dword [esp + 0xc], 0xc9d537f0
mov dword [esp + 0x10], 0xcd29cb3c
mov dword [esp + 0x14], 0xc122cfeb
mov dword [esp + 0x18], 0xc53ac314
mov dword [esp + 0x1c], 0xd938c733
mov dword [esp + 0x20], 0xdd3ddb3c
mov dword [esp + 0x24], 0xd13cdf2e
mov dword [esp + 0x28], 0xd520d32b
mov dword [esp + 0x2c], 0xe93ad730
mov dword [esp + 0x30], 0xed18eb38
mov dword [esp + 0x34], 0xe108ef1d
mov dword [esp + 0x38], 0xe51ee31b
mov dword [esp + 0x3c], 0xf913e703
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xfbf8
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
xor ecx, ecx
nop
nop
nop
nop
lea edx, [ecx + ecx]
mov esi, edx
and esi, 0xea
mov ebx, ecx
xor ebx, 0xf5
add ebx, esi
xor bl, byte [esp + ecx + 4]
add bl, 0x37
mov byte [esp + ecx + 4], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 0x43
jb 0x4259a0
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ebp, esp
push ebp
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44de28]
mov dword [esp + 4], 0x793a3bd1
mov ecx, 0x5202434b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x52024347]
lea edi, [ecx - 0x52024300]
and edi, edx
add edi, edi
sub edx, edi
add edx, ecx
mov edi, edx
xor edi, 0x78
and edx, 7
add edx, edx
sub edx, edi
inc dl
mov byte [esp + ecx - 0x52024347], dl
inc ecx
cmp ecx, 0x5202434f
jne 0x425a20
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x448650]
Function at 0x4295dc
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00428f40
add esp, 4
test al, al
je 0x4295d0
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd0
push eax
mov dword [ebp - 0x2c], esp
push eax
mov ebx, esp
sub esp, 0x24
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x44], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], eax
push eax
mov dword [ebp - 0x18], esp
sub esp, 8
mov edi, esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov esi, esp
sub esp, 0x28
mov dword [ebp - 0xb8], esp
sub esp, 8
mov dword [ebp - 0xb0], esp
sub esp, 8
mov dword [ebp - 0xbc], esp
sub esp, 8
mov dword [ebp - 0x34], esp
sub esp, 0x24
mov dword [ebp - 0xc0], esp
mov dword [ebp - 0xdc], 0xf364f109
mov dword [ebp - 0xd8], 0xef62ed7f
mov dword [ebp - 0xd4], 0xeb7ee909
mov dword [ebp - 0xd0], 0xe716e570
mov dword [ebp - 0xcc], 0xe36ee101
mov dword [ebp - 0xc8], 0x9f9e9d04
mov dword [ebp - 0xc4], 0
mov eax, 0x37e8b2ac
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x37e8b388]
xor ecx, eax
mov edx, ecx
and edx, 0x23
xor ecx, 0xe87482a3
lea edx, [ecx + edx*2]
and ecx, 1
or edx, 1
add edx, ecx
mov byte [ebp + eax - 0x37e8b388], dl
inc eax
cmp eax, 0x37e8b2c8
jne 0x429690
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0xa4], 0x39843b98
mov dword [ebp - 0xa0], 0x25ef27f3
mov dword [ebp - 0x9c], 0x219f2393
mov dword [ebp - 0x98], 0x2d902f9c
mov dword [ebp - 0x94], 0x298e2b8b
mov dword [ebp - 0x90], 0x15d9179b
mov dword [ebp - 0x8c], 0x11da13d9
mov dword [ebp - 0x88], 0x1dac1fa7
mov dword [ebp - 0x84], 0x19be1bd7
mov dword [ebp - 0x80], 0x5b707a5
mov dword [ebp - 0x7c], 0x1be03ce
mov dword [ebp - 0x78], 0xdc10fb9
mov dword [ebp - 0x74], 0x9c10bb2
mov dword [ebp - 0x70], 0xf54cf7ac
mov dword [ebp - 0x6c], 0xf166f35b
mov dword [ebp - 0x68], 0xfd55ff6a
mov dword [ebp - 0x64], 0xf947fb58
mov dword [ebp - 0x60], 0xe54de764
mov dword [ebp - 0x5c], 0xe171e34b
mov word [ebp - 0x58], 0xefe0
mov dword [ebp - 0x56], 0
lea eax, [ebp - 0xa4]
mov ecx, 0xa97c6734
movzx esi, byte [eax]
mov edx, ecx
or edx, esi
lea edi, [ecx + 0x56839900]
and edi, esi
not edx
or edx, edi
mov esi, edx
and esi, 8
xor edx, 8
lea edx, [edx + esi*2]
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xa97c66e2
jne 0x429780
lea eax, [ebp - 0xdc]
lea ebx, [ebp - 0xa4]
push eax
push ebx
call fcn.0043aef0
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x448e4c]
Function at 0x42bbd5
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xfc
mov dword [esp + 4], 0x23632145
mov dword [esp + 8], 0x27962594
mov dword [esp + 0xc], 0x3b9b397c
mov dword [esp + 0x10], 0x3f9f3d88
mov dword [esp + 0x14], 0x33323155
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
or edx, 8
add edx, ecx
mov esi, ecx
xor esi, 8
lea edx, [esi + edx*2]
add dl, 2
xor dl, byte [esp + ecx + 4]
add dl, 0xd8
mov byte [esp + ecx + 4], dl
lea edx, [ecx + 1]
dec eax
mov ecx, edx
cmp edx, 0x14
jne 0x42aa00
lea ebp, [esp + 0xb6]
lea eax, [esp + 4]
mov edi, ebp
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xca]
lea eax, [esp + 0x18]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 9
push ebp
push 0
call dword [0x44de28]
mov dword [esp + 4], 0xd19e9f79
nop
nop
movzx ecx, byte [esp + ebx + 4]
lea edx, [ebx - 0x22b55e1b]
xor edx, ecx
mov ecx, edx
and ecx, 6
xor edx, 0x86
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + ebx + 4], cl
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
cmp ebx, 4
jb case.default.0x42aaac
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44904c]
mov ebx, dword [esp + 0x38]
jmp dword [0x449058]
mov edi, ebp
mov ebp, ebx
jmp 0x42bd57
mov dword [esp + 0x4c], esi
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449064]
add esp, 0xfc
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebx + ebx]
test ebx, ebx
jns 0x42bd63
mov eax, 0xffffffff
push eax
call fcn.004087e0
add esp, 4
mov esi, eax
lea eax, [esp + 0x38]
push eax
push ebp
push esi
push 9
mov ebp, edi
push edi
push 0
call dword [0x44de28]
jmp dword [0x44905c]
lea eax, [ebx + ebx]
test ebx, ebx
jns 0x42bd94
mov eax, 0xffffffff
push eax
call fcn.004087e0
add esp, 4
lea ecx, [esp + 0x38]
push ecx
push dword [esp + 0x3c]
push eax
push 9
mov edi, ebp
push ebp
push 0
call dword [0x44de28]
mov ebp, dword [esp + 0x38]
jmp 0x42bd57
Function at 0x435700
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
call fcn.00418650
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x435730
xor ebx, ebx
test al, 1
jne 0x43573b
jmp 0x4358c4
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x4358be
mov dword [ebp - 0x1c], esi
sub esp, 4
mov dword [ebp - 0x28], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00430d30
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4357a4
jmp 0x4358ad
mov dword [ebp - 0x24], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.004087e0
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00427bc0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x18], al
mov byte [edi], 0xc9
mov byte [edi + 1], 0xe3
mov byte [edi + 2], 0xe5
mov byte [edi + 3], 0x21
mov byte [edi + 4], 0xd2
mov byte [edi + 5], 0x22
mov byte [edi + 6], 0xd1
mov byte [edi + 7], 0x27
mov byte [edi + 8], 0xd0
mov byte [edi + 9], 0x99
mov byte [edi + 0xa], 0x22
mov byte [edi + 0xb], 0x21
mov byte [edi + 0xc], 0x2c
mov byte [edi + 0xd], 0xbb
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x435814
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x10
jae 0x43587d
mov cl, byte [edi + eax]
mov byte [ebp - 0xd], cl
movzx ebx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0x6a556b1d
mov esi, eax
and esi, ebx
mov ebx, esi
and ebx, 2
xor ebx, 2
mov edx, esi
and edx, 0xfd
imul edx, ebx
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
add esi, edx
xor esi, 0xffffffff
add eax, esi
mov ecx, dword [ebp + 8]
add al, byte [ebp - 0xd]
add al, 0x70
mov edx, dword [ebp - 0x14]
mov byte [edi + edx], al
mov eax, dword [ebp - 0x14]
add eax, 1
jmp 0x435825
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x20]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
call fcn.004095a0
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.004087f0
add esp, 4
jmp 0x4358ab
jmp 0x4358ad
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4358be
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ac30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.00441680
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a59c]

Function at 0x43aef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.00441d20
add esp, 0x14
test eax, eax
js 0x43b069
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00442100
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43af87
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc ecx
jns 0x43af53
mov eax, 0xffffffff
jmp 0x43af5a
lea eax, [eax*2 + 2]
push eax
call fcn.004087e0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.004426c0
add esp, 0x14
test eax, eax
js 0x43af7e
mov esi, edi
jmp 0x43af87
push edi
call fcn.004087f0
add esp, 4
mov eax, dword [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x504f4e4d
mov dword [esp + 8], 0
mov ecx, 0xd
mov edx, 0xed1bf672
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ecx - 9]
mov edi, edx
or edi, ebp
not edi
lea eax, [edx + 0x12e409c0]
and eax, 0x25
mov ebx, ecx
and ebx, 0x1a
or ebx, eax
xor ebx, 0x5a
and ebx, ebp
or ebx, edi
lea ebp, [ebx + ebx]
mov eax, ebp
and eax, 0x7c
mov edi, ebx
xor edi, 0xa18bd03e
add eax, edi
and ebp, 2
and eax, 0xfe
and ebx, 1
or ebx, eax
and edi, ebp
or ebx, ebp
xor ebx, 1
add ebx, edi
mov byte [esp + ecx - 9], bl
inc ecx
dec edx
cmp ecx, 0x15
jne 0x43afb0
mov ecx, dword [0x44de2c]
test ecx, ecx
je 0x43b04d
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44de30]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b030
inc edi
cmp ecx, edi
jne 0x43b020
jmp 0x43b04d
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43b04d
push dword [esp + 0xc]
push 4
push ecx
push dword [0x44de34]
call fcn.0043f290
add esp, 0x10
test esi, esi
jne 0x43b06b
lea eax, [esp + 4]
push eax
call fcn.00441480
add esp, 4
test al, al
je 0x43b069
cmp dword [esp + 4], 1
je 0x43b06b
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cca0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0x393a3b6c
mov byte [esp + 4], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 6
mov ebx, edx
xor ebx, 0x8b
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x49
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 5
jne 0x43ccc0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x455e50]
mov ecx, dword [0x44a88c]
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x43cd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0xc0d0a0b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x42
xor cl, byte [esp + eax]
add cl, 0xb6
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x43cdc0
mov ebp, dword [esp]
mov eax, dword [0x44de2c]
test eax, eax
je 0x43ce26
xor ecx, ecx
mov edx, dword [0x44de30]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43ce00
inc ecx
cmp eax, ecx
jne 0x43cdf0
jmp 0x43ce26
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x43ce26
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44de34]
call fcn.0043f290
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0x519e9f98
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
xor esi, 0xdb
mov edx, eax
and edx, 8
sub edx, esi
xor dl, byte [esp + ecx]
add dl, 0x47
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x43ce40
cmp ebp, dword [esp]
jne 0x43cfc4
mov dword [esp + 0x10], edi
push dword [esp + 8]
call fcn.0043cca0
add esp, 4
mov edi, dword [esp + 8]
mov dword [esp], 0xc0d0a0b
mov dword [esp + 4], 0
xor edx, edx
nop
mov ecx, edx
add cl, 0x42
xor cl, byte [esp + edx]
add cl, 0xb6
mov byte [esp + edx], cl
inc edx
cmp edx, 8
jne 0x43ce90
mov ebp, dword [esp]
mov edx, dword [0x44de2c]
test edx, edx
je 0x43cef9
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44de30]
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x61813e67
je 0x43ced2
inc ebp
cmp edx, ebp
jne 0x43cec0
mov ebp, ecx
jmp 0x43cef9
mov edx, dword [esi + ebp*8 + 4]
mov ebp, ecx
cmp edx, ecx
je 0x43cef9
push 0
push edi
push eax
push 5
push 0x10
push edx
push dword [0x44de34]
mov esi, eax
call fcn.0043f290
add esp, 0x1c
mov ebp, eax
mov eax, esi
test ebp, ebp
js 0x43cfbb
mov dword [esp], 0xd392937d
mov ecx, 0x609c7d64
nop
nop
nop
movzx edx, byte [esp + ecx - 0x609c7d64]
xor edx, ecx
mov edi, edx
and edi, 0x900d09
mov esi, edx
and esi, 2
mov ebp, esi
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, esi
add edi, ebp
xor edx, 0x1cf18d0b
mov esi, edi
and esi, edx
xor edx, edi
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x609c7d64], dl
inc ecx
cmp ecx, 0x609c7d68
jne 0x43cf10
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x43cf95
add ebp, 2
cmp si, di
je 0x43cf80
cmp si, di
je 0x43cfa6
mov esi, dword [ecx]
test esi, esi
jne 0x43cf70
mov ebp, dword [esp + 0xc]
jmp 0x43cfbb
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.0043cd10
add esp, 4
mov eax, ebp
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43cff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43d0a0
xor eax, eax
cmp dword [ecx], 0
jne 0x43d0ee
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xc0d0a0b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
mov ebx, eax
add bl, 0x42
xor bl, byte [esp + eax]
add bl, 0xb6
mov byte [esp + eax], bl
inc eax
cmp eax, 8
jne 0x43d060
mov eax, dword [esp]
mov esi, dword [0x44de2c]
test esi, esi
je 0x43d0ee
xor edi, edi
mov ebx, dword [0x44de30]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43d0f7
inc edi
cmp esi, edi
jne 0x43d090
jmp 0x43d0ee
mov dword [esp + 8], 0xa9eaebec
mov word [esp + 0xc], 0
mov eax, 0x49541327
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x4954131f]
mov ecx, eax
or ecx, edx
lea esi, [eax - 0x49541300]
or esi, eax
and esi, edx
sub ecx, esi
add cl, 0x3d
mov byte [esp + eax - 0x4954131f], cl
inc eax
cmp eax, 0x4954132d
jne 0x43d0c0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d0ee
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44de34]
call fcn.0043f290
add esp, 0x1c
jmp 0x43d0ee

Function at 0x43d120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43d1ba
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xc0d0a0b
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x42
xor bl, byte [esp + edx]
add bl, 0xb6
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x43d150
mov edx, dword [0x44de2c]
test edx, edx
je 0x43d1ae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44de30]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43d190
inc edi
cmp edx, edi
jne 0x43d180
jmp 0x43d1ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d1ae
push eax
push 4
push edx
push dword [0x44de34]
mov esi, ecx
call fcn.0043f290
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43d440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [esp], 0xc0d0a0b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x42
xor dl, byte [esp + eax]
add dl, 0xb6
mov byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x43d470
test ebx, ebx
jne 0x43d48c
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44de2c]
test ebp, ebp
je 0x43d4e4
xor edx, edx
mov esi, dword [0x44de30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43d4c0
inc edx
cmp ebp, edx
jne 0x43d4b0
jmp 0x43d4e4
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43d4e4
push ebx
push dword [esp + 0x2c]
push edi
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44de34]
call fcn.0043f290
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f1e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44acb8]

Function at 0x440c60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0xe9eaebd4
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x27
xor dl, byte [esp + eax]
add dl, 0x3d
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne 0x440c80
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edx, dword [case.0x440bc8.14]

Function at 0x440d30
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp], 0x999a7d4f
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
xor edi, 0xd5c78fdb
add edi, ecx
xor edi, esi
mov esi, edi
and esi, 0x38
xor edi, 0xb8
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 4
jne case.default.0x440d86
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44b610]
or eax, 0xfe40044
inc esp
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add ah, ch
cmove eax, dword [eax]
sbb ecx, dword [esi]
inc esp
add ah, ah
cmove eax, dword [eax]
cmp eax, 0xe400440e
cmove eax, dword [eax]
xlatb
cmove eax, dword [eax]
nop
push cs
inc esp
add byte [ebp - 0x7fffbbf1], dl
cmove eax, dword [eax]
retf 0x440f
Function at 0x4414d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4414f0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44150b
mov eax, 0xffffffff
jmp 0x44150e
add eax, 0xa
push eax
call fcn.004087e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x441551
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x441540
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x989b9a9d
mov ecx, 0x4247dbdb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x4247dbdb]
xor edx, ecx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0xb8
mov byte [esp + ecx - 0x4247dbdb], dl
inc ecx
cmp ecx, 0x4247dbdf
jne 0x4415d0
mov esi, dword [esp]
mov ecx, dword [0x44de2c]
test ecx, ecx
je 0x441662
xor edx, edx
mov edi, dword [0x44de30]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x441620
inc edx
cmp ecx, edx
jne 0x441610
jmp 0x441662
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x441662
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44de34]
mov edi, eax
call fcn.0043f290
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004087f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret