joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4153b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4153d0
mov ecx, eax
sar ecx, 1
mov dword [esp + 0xa4], ecx
cmp ecx, 0xfffffff2
mov dword [esp + 0xa0], eax
jge 0x4153f9
mov eax, 0xffffffff
jmp 0x4153fc
add eax, 0x1c
push eax
call fcn.004095c0
add esp, 4
mov esi, eax
mov dword [esp + 0x128], 0xf946fba8
mov dword [esp + 0x12c], 0xfd6bff5f
mov dword [esp + 0x130], 0xf112f368
mov dword [esp + 0x134], 0xf56df75a
mov dword [esp + 0x138], 0xe97feb62
mov dword [esp + 0x13c], 0xed7fef77
mov dword [esp + 0x140], 0xe1e2e37e
mov byte [esp + 0x144], 0
mov eax, 0xff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x29]
mov edx, eax
xor edx, ecx
and edx, ebx
xor edx, ecx
mov bl, 4
sub bl, dl
mov byte [esp + eax + 0x29], bl
inc eax
dec ecx
cmp eax, 0x11c
jne 0x415470
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4154b1
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4154a0
mov word [eax], 0
movzx ecx, word [esp + 0x128]
test cx, cx
je 0x4154e1
lea edx, [esp + 0x12a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4154d0
mov word [eax], 0
lea eax, [esp + 0x2a8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043fa20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4459ec]
Function at 0x41b1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], 0xff0093b
mov dword [esp + 0x14], 0x3f10dfb
mov dword [esp + 0x18], 0x70601f2
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
add cl, 0x42
xor cl, byte [esp + eax + 0x10]
add cl, 0xb6
mov byte [esp + eax + 0x10], cl
mov ecx, eax
and ecx, 1
and eax, 0xe
mov edx, eax
xor edx, 0xe
xor eax, 0xfffffffe
or eax, edx
not eax
add eax, ecx
cmp eax, 0xc
jb 0x41b200
mov dword [esp + 0x24], 0x57aa49a0
mov dword [esp + 0x28], 0x53a255a8
mov dword [esp + 0x2c], 0x5f6d5196
mov dword [esp + 0x30], 0x5bae5d6f
mov dword [esp + 0x34], 0x678959ab
mov dword [esp + 0x38], 0x63966585
mov dword [esp + 0x3c], 0x6f9d6188
mov dword [esp + 0x40], 0x6b966d93
mov dword [esp + 0x44], 0x777669ae
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x24]
add cl, 0xba
mov byte [esp + eax + 0x24], cl
inc eax
cmp eax, 0x24
jne 0x41b280
movzx ecx, word [esp + 0x24]
lea eax, [esp + 0x154]
test cx, cx
je 0x41b2c1
lea edx, [esp + 0x26]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b2b0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41b2f1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b2e0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41b321
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b310
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov dword [esp + 0x24], 0x1b141cf6
mov byte [esp + 0x28], 0xfc
mov dword [esp + 0x29], 0
mov byte [esp + 0x2d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x24]
lea edx, [eax - 0x4daf9456]
mov edi, 0x55
sub edi, eax
xor edi, edx
and edi, ecx
xor edi, edx
mov ecx, edi
and ecx, 0x2d
xor edi, 0xad
lea ecx, [edi + ecx*2]
inc cl
mov byte [esp + eax + 0x24], cl
lea ecx, [eax + eax]
and ecx, 2
mov edx, ecx
and edx, eax
or ecx, eax
xor ecx, 1
add ecx, edx
mov eax, ecx
cmp ecx, 0xa
jb 0x41b350
movzx eax, byte [esp + 0x24]
test al, al
je 0x41b3bb
lea ecx, [esp + 0x25]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b3b0
mov byte [ebx], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x20]
lea edi, [esp + 0x154]
push eax
push ecx
push edx
push edi
call fcn.0040c480
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x445d4c]
mov ecx, 0xf05d78f0
xor ecx, dword [0x445d54]
add eax, ecx
inc eax
jmp eax
Function at 0x41f510
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp], 0x7372719a
mov byte [esp + 4], 0
mov ecx, 0x8321f414
mov edx, 0xeb
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x7cde0bec]
mov edi, ecx
or edi, esi
not esi
or esi, edx
and esi, edi
mov ebx, esi
and ebx, 0x9b
and esi, 0x64
xor esi, 0x65
sub ebx, esi
inc bl
mov byte [esp + ecx + 0x7cde0bec], bl
inc ecx
dec edx
cmp ecx, 0x8321f419
jne 0x41f550
lea ecx, [esp + 8]
mov edx, esp
push ecx
push 0x421400
push edx
push dword [eax + 8]
call fcn.004218f0
add esp, 0x28
pop esi
pop edi
pop ebx
ret
Function at 0x426ad0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
lea ecx, [esp + 0x30]
push 0x410
call fcn.0043ad10
not eax
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x446dbc]

Function at 0x426be0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
add ebp, 4
xor eax, eax
cmp ebp, dword [esp + 0x48]
setne al
jmp dword [eax*4 + 0x446dcc]

Function at 0x426d9e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esi, dword [esp + 0x14]
shl esi, cl
mov eax, esi
and eax, 3
mov edi, esi
or edi, 3
imul edi, eax
xor eax, 3
mov edx, esi
and edx, 0xfffffffc
imul edx, eax
add edi, edx
shr edi, 2
movzx eax, byte [ecx + esi - 1]
cmp eax, 0x3d
mov dword [esp], esi
je 0x426dd3
cmp eax, 0x2e
jne 0x426dda
mov eax, edi
not eax
lea edi, [eax + edi*2]
movzx eax, byte [ecx + esi - 2]
cmp eax, 0x3d
je 0x426de9
cmp eax, 0x2e
jne 0x426dea
dec edi
mov dword [esp + 0x1c], edi
push 0
call fcn.004095c0
add esp, 4
mov dword [esp + 0xc], eax
cmp dword [esp], 0
mov esi, dword [esp + 8]
je 0x426f10
xor edi, edi
mov ebp, 2
jmp 0x426e3a
mov esi, dword [esp + 4]
lea eax, [ebp + 4]
add ebp, 2
mov edi, esi
cmp ebp, edx
mov ebp, eax
mov esi, dword [esp + 8]
jae 0x426f10
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.0041d520
add esp, 4
mov ebx, eax
movzx eax, byte [esi + ebp - 1]
push eax
call fcn.0041d520
mov edx, dword [esp + 4]
add esp, 4
shl bl, 2
mov ecx, eax
shr cl, 4
and cl, 3
or cl, bl
lea ebx, [edi + 1]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0xc]
mov byte [ebx + edi], cl
cmp ebp, edx
jae 0x426e20
mov byte [esp + 0x10], al
movzx eax, byte [esi + ebp]
push eax
call fcn.0041d520
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
mov esi, dword [esp + 4]
je 0x426e24
movzx ecx, byte [esp + 0x10]
shl cl, 4
mov edx, eax
shr dl, 2
and dl, 0xf
or dl, cl
lea esi, [edi + 2]
mov ecx, dword [esp + 0xc]
mov byte [ecx + edi + 1], dl
mov edx, dword [esp]
lea ecx, [ebp + 1]
cmp ecx, edx
jae 0x426e24
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 8], al
call fcn.0041d520
mov edx, dword [esp + 4]
add esp, 4
movzx ecx, byte [esp + 4]
cmp al, 0x40
je 0x426e24
shl cl, 6
add al, cl
mov ecx, dword [esp + 0xc]
mov byte [ecx + edi + 2], al
add edi, 3
mov esi, edi
jmp 0x426e24
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov byte [ecx + eax], 0
push ecx
call fcn.00401000
mov ecx, dword [esp + 0xc]
add esp, 4
Function at 0x4273d2
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x4273e0
sub eax, edi
cmp eax, 0xffffffd9
jge 0x4273f9
mov eax, 0xffffffff
jmp 0x4273fc
add eax, 0x26
push eax
call fcn.004095c0
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0x59bf5ba8
mov dword [esp + 0x2c], 0x5dac5fa9
mov dword [esp + 0x30], 0x51ad53a6
mov dword [esp + 0x34], 0x55ba57a9
mov dword [esp + 0x38], 0x699b6bb1
mov dword [esp + 0x3c], 0x6d946f9a
mov dword [esp + 0x40], 0x619b6393
mov dword [esp + 0x44], 0x65ec6752
mov dword [esp + 0x48], 0x79807b80
mov dword [esp + 0x4c], 0x7f78
xor eax, eax
xor ecx, ecx
nop
nop
nop
movzx edx, byte [esp + ecx + 0x28]
mov esi, eax
and esi, 0x1e
mov ebx, ecx
xor ebx, 0x16c7168f
add ebx, esi
mov esi, edx
and esi, ebx
add esi, esi
sub ebx, esi
add bl, dl
add bl, 0x35
mov byte [esp + ecx + 0x28], bl
inc ecx
add eax, 2
cmp ecx, 0x28
jne 0x427460
movzx ecx, word [edi]
mov ebx, dword [esp + 0x1c]
mov eax, ebx
test cx, cx
je 0x4274c1
mov edx, edi
add edx, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4274b0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x4274f1
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4274e0
mov word [eax], 0
jmp dword [0x446e54]

Function at 0x4274fc
Capabilities:
Copy file

Disassembly:
push edi
call fcn.004095d0
add esp, 4
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x446e5c]

Function at 0x4275da
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x446e5c]
Function at 0x4282c8
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x18]
call fcn.004095d0
add esp, 4

Function at 0x428362
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ebx, ebp
sete al
jmp dword [eax*4 + 0x446eec]
Function at 0x43a9d0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0xf10e0fdc
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx]
mov edx, ecx
and edx, 3
xor edx, 0x68ce6203
mov esi, ecx
and esi, 4
sub esi, edx
mov edx, esi
and edx, edi
add edx, edx
add esi, edi
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
add dl, 0xf
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne 0x43a9f0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x45402c]
add esp, 8
pop esi
pop edi
ret

Function at 0x43aa40
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448844]
Function at 0x43aab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp], 0x3c3d3a3b
mov edx, 0x4a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x4a]
mov ebx, eax
mov esi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x4d
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x8e
mov byte [esp + edx - 0x4a], al
inc edx
cmp edx, 0x4e
jne 0x43aae0
mov ebx, dword [esp]
mov eax, dword [0x44c008]
test eax, eax
je 0x43ab76
xor ecx, ecx
mov edx, dword [0x44c00c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43ab50
inc ecx
cmp eax, ecx
jne 0x43ab40
jmp 0x43ab76
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x43ab76
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44c010]
call fcn.0043d3e0
add esp, 0x1c
mov ebx, eax
mov dword [esp], 0xf332314c
xor eax, eax
nop
mov ecx, eax
or cl, 0x8c
xor cl, byte [esp + eax]
add cl, 0x44
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43ab80
cmp ebx, dword [esp]
jne 0x43ace4
mov esi, edi
push dword [esp + 0x10]
call fcn.0043a9d0
add esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], 0x3c3d3a3b
mov ebx, 0x4a
nop
nop
nop
movzx edi, byte [esp + ebx - 0x4a]
mov edx, edi
and edx, ebx
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0x4d
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0x8e
mov byte [esp + ebx - 0x4a], al
inc ebx
cmp ebx, 0x4e
jne 0x43abd0
mov ebx, dword [esp]
mov eax, dword [0x44c008]
test eax, eax
je 0x43ac57
xor ecx, ecx
mov edx, dword [0x44c00c]
cmp dword [edx + ecx*8], 0x61813e67
je 0x43ac30
inc ecx
cmp eax, ecx
jne 0x43ac20
jmp 0x43ac57
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x43ac57
push 0
push dword [esp + 0xc]
push dword [esp + 0x14]
push 5
push 0x10
push eax
push dword [0x44c010]
call fcn.0043d3e0
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x43acd8
mov dword [esp + 8], esi
mov dword [esp], 0x3372739d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x14
xor cl, byte [esp + eax]
add cl, 0x9c
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x43ac70
mov ebx, dword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + edx + 0x3c]
add eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [ecx + edx]
movzx edi, word [ebp + edx]
test si, si
je 0x43acb6
add edx, 2
cmp si, di
je 0x43aca0
cmp si, di
je 0x43acc3
mov edx, dword [eax]
test edx, edx
jne 0x43ac90
jmp 0x43acd8
mov ecx, dword [eax + 0x44]
mov edx, dword [esp + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xdc]
mov dword [edx + 0xc], eax
xor ebx, ebx
push dword [esp + 0xc]
call fcn.0043aa40
add esp, 4
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43ad10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov edx, dword [ecx + 8]
test edx, edx
je 0x43ade0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ae2c
mov esi, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x3c3d3a3b
mov edi, 0x4a
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi - 0x4a]
mov ebx, ecx
and ebx, edi
mov eax, ebx
or al, 0xfd
inc al
mov edx, ebx
and dl, 0x4d
mul dl
mov edx, eax
add dl, cl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub dl, al
movzx eax, dl
add eax, edi
add al, 0x8e
mov byte [esp + edi - 0x4a], al
inc edi
cmp edi, 0x4e
jne 0x43ad80
mov eax, dword [esp]
mov ecx, dword [0x44c008]
test ecx, ecx
je 0x43ae2c
xor edx, edx
mov edi, dword [0x44c00c]
nop
cmp dword [edi + edx*8], 0x32f24c0b
je 0x43ae36
inc edx
cmp ecx, edx
jne 0x43add0
jmp 0x43ae2c
mov dword [esp + 4], 0xa96a6b6c
mov word [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe7
xor cl, byte [esp + eax + 4]
add cl, 0x7d
mov byte [esp + eax + 4], cl
mov ecx, eax
xor ecx, 0x7c339c71
and eax, 1
lea eax, [ecx + eax*2]
add eax, 0x83cc6390
cmp eax, 6
jb 0x43ae00
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [edi + edx*8 + 4]
cmp edx, eax
je 0x43ae2c
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
push esi
push ebp
push 0x10
push edx
push dword [0x44c010]
call fcn.0043d3e0
add esp, 0x1c
jmp 0x43ae2c
Function at 0x43af20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43afd3
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43afd3
mov dword [esp + 0xc], eax
mov dword [esp], 0x3c3d3a3b
mov ebx, 0x4a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx - 0x4a]
mov edx, edi
and edx, ebx
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0x4d
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0x8e
mov byte [esp + ebx - 0x4a], al
inc ebx
cmp ebx, 0x4e
jne 0x43af60
mov eax, dword [esp]
mov ecx, dword [0x44c008]
test ecx, ecx
je 0x43b063
xor edx, edx
mov ebx, dword [0x44c00c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xaf0e0c2e
je 0x43b043
inc edx
cmp ecx, edx
jne 0x43afc0
jmp 0x43b063
mov dword [esp], 0xf93a3b34
mov word [esp + 4], 0
mov eax, 0x49e6ac0b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x49e6ac0b]
xor ecx, eax
lea esi, [ecx + 0xe7ea3c8]
mov edi, 0x71815c37
sub edi, ecx
and ecx, 1
mov edx, edi
not edx
and edi, 0x5828f41
and esi, 0x182410be
or esi, edi
and edx, 1
or edx, esi
mov esi, edx
and esi, ecx
or edx, ecx
xor edx, 0x40
add edx, esi
mov byte [esp + eax - 0x49e6ac0b], dl
inc eax
cmp eax, 0x49e6ac11
jne 0x43aff0
mov eax, dword [esp]
jmp 0x43b13f
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43b063
push dword [ebp + 8]
push dword [esp + 0x10]
push 8
push ecx
push dword [0x44c010]
call fcn.0043d3e0
add esp, 0x14
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x43b130
cmp eax, 0xc000010a
jne 0x43b130
mov ecx, 0xffffd8f0
mov eax, edi
mul ecx
sub edx, edi
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3c3d3a3b
mov ebx, 0x4a
nop
nop
movzx edi, byte [esp + ebx - 0x3a]
mov ecx, edi
and ecx, ebx
mov eax, ecx
or al, 0xfd
inc al
mov edx, ecx
and dl, 0x4d
mul dl
mov edx, eax
mov eax, edi
add dl, al
mov eax, ecx
shr al, 1
and al, 1
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, ebx
add al, 0x8e
mov byte [esp + ebx - 0x3a], al
inc ebx
cmp ebx, 0x4e
jne 0x43b0a0
xor edx, edx
cmp dword [ebp + 0xc], 0xffffffff
je 0x43b0e6
mov edx, esp
mov eax, dword [esp + 0x10]
mov ecx, dword [0x44c008]
test ecx, ecx
je 0x43b130
xor ebx, ebx
mov edi, dword [0x44c00c]
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x4c697c35
je 0x43b110
inc ebx
cmp ecx, ebx
jne 0x43b100
jmp 0x43b130
mov ecx, dword [edi + ebx*8 + 4]
cmp ecx, eax
je 0x43b130
push edx
push 0
push dword [esp + 0x14]
push 0xc
push ecx
push dword [0x44c010]
call fcn.0043d3e0
add esp, 0x18
test eax, eax
js 0x43b13f
mov ecx, esi
mov esi, eax
call fcn.0043ae60
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43bf40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 0x24], 0xc946cb5e
mov dword [esp + 0x28], 0xc552c754
mov dword [esp + 0x2c], 0xc190c350
mov dword [esp + 0x30], 0xfd6aff5c
mov dword [esp + 0x34], 0xf9fafb68
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x53
xor cl, byte [esp + eax + 0x24]
add cl, 0x61
mov byte [esp + eax + 0x24], cl
inc eax
cmp eax, 0x14
jne 0x43bf80
lea eax, [esp + 0x24]
push eax
call fcn.0043ea50
add esp, 4
mov dword [0x454024], eax
mov dword [esp + 0x20], 0x39cdf3b8
test eax, eax
je 0x43bfbc
mov dword [esp + 0x20], 0x15409312
mov ecx, 0xe6fb1672
xor eax, eax
cmp ecx, 0x22c905a0
setl al
mov eax, dword [eax*4 + 0x44885c]
mov edx, 0xbbfa0bc5
xor edx, dword [0x448864]
add eax, edx
inc eax
jmp eax

Function at 0x43d2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x448d38]
Function at 0x43ed40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0xd7d6c938
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
lea esi, [eax + 0x3560e02e]
and esi, edx
add edx, eax
add edx, 0x3560e02e
add esi, esi
sub edx, esi
add dl, 0x1a
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 4
jb case.default.0x43ed9b
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x449718]
Function at 0x43ef60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp], 0x8382dbcd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov ecx, 0x57126edf
sub ecx, edx
or ecx, esi
mov edi, 0xdf
sub edi, edx
and edi, esi
not ecx
or ecx, edi
mov esi, ecx
and esi, 0x5d
mov edi, ecx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor ecx, 0x5f
add ecx, ebx
add ecx, esi
inc cl
mov byte [esp + edx], cl
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
cmp edx, 7
jb case.default.0x43efe8
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4497c8]
Function at 0x43f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f890
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43f8ab
mov eax, 0xffffffff
jmp 0x43f8ae
add eax, 0xa
push eax
call fcn.004095c0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f8f1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f8e0
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
mov ecx, 0x58ffcc68
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x58ffcc68]
xor edx, ecx
lea esi, [edx + 0x430101f7]
mov edi, esi
and edi, 1
and edx, 1
and esi, 0xfe
or esi, edx
lea edx, [esi + edi*2]
mov byte [esp + ecx - 0x58ffcc68], dl
inc ecx
cmp ecx, 0x58ffcc6d
jne 0x43f960
mov esi, dword [esp]
mov ecx, dword [0x44c008]
test ecx, ecx
je 0x43f9ff
xor edx, edx
mov edi, dword [0x44c00c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43f9c0
inc edx
cmp ecx, edx
jne 0x43f9b0
jmp 0x43f9ff
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43f9ff
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44c010]
mov edi, eax
call fcn.0043d3e0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004095d0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret