joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439540
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x447504]

Function at 0x43ab70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43abe2
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43ad1e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43ad1e
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x67
xor cl, byte [esp + eax]
add cl, 0xfd
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43ac00
mov eax, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43ac72
xor edx, edx
mov edi, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43ac44
inc edx
cmp ecx, edx
jne 0x43ac30
mov edi, dword [esp + 0x24]
jmp 0x43ac72
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x43ac72
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x28
test eax, eax
js 0x43ad1e
push 0x732f71fd
push dword [0x452898]
call fcn.0043c370
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x67
xor bl, byte [esp + edx]
add bl, 0xfd
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43acc0
mov edx, dword [0x44a87c]
test edx, edx
je 0x43ad1e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43ad00
inc edi
cmp edx, edi
jne 0x43acf0
jmp 0x43ad1e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ad1e
push ecx
push 4
push edx
push dword [0x44a884]
mov esi, eax
call fcn.004395d0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43be30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 8], 0x333231e0
mov byte [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x4c
xor cl, byte [esp + eax + 8]
add cl, 0x84
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 5
jne case.default.0x43be77
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x30], 0
sete cl
jmp dword [ecx*4 + 0x447f3c]
mov esi, dword [eax + 0xc]
add esi, 0xc
mov eax, dword [0x447f54]
mov dword [esp + 0x14], eax
mov dword [esp], 0
mov edi, dword [case.0x43be77.3]
mov ecx, dword [esi]
xor eax, eax
cmp ecx, esi
setne al
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
jmp dword [eax*4 + 0x447f44]
mov dword [esp + 4], ecx
mov edx, dword [ecx + 0x30]
xor eax, eax
test edx, edx
setne al
mov ebp, 1
jmp dword [eax*4 + 0x447f4c]
mov ecx, dword [esp + 0x30]
mov esi, edx
jmp dword [esp + 0x14]
mov ecx, dword [esp + 4]
jmp dword [ebp*4 + 0x447f8c]
mov eax, dword [0x447f9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [eax + 8]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c2a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0xf3f2f120
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, eax
or edi, 0x2c
mov edx, 0xd3
sub edx, eax
xor edx, edi
and edx, esi
xor edx, edi
add dl, 0x24
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 4
jb case.default.0x43c2f9
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44800c]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x448034]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x448014]
xor ebx, ebx
cmp dword [edi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44801c]
mov ebx, 1
jmp dword [ebx*4 + 0x448024]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43cba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cbb0
mov ecx, eax
sar ecx, 1
and eax, 8
xor ecx, 4
lea edi, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x43cbd6
mov eax, 0xffffffff
jmp 0x43cbdd
lea eax, [edi*2 + 2]
push eax
call fcn.00408740
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43cc21
add esi, 2
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43cc10
mov word [ecx], 0
lea ecx, [edi + edi]
mov word [esp + 8], cx
lea ecx, [edi*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x808c0e63
mov edx, 0x20230498
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x7f73f19d]
lea esi, [ecx + 0x5f50ee04]
and esi, ebx
add esi, esi
mov edi, esi
sub edi, ebx
add edi, edx
not edi
and edi, 0xfc
add edi, ebx
sub ebx, esi
lea ebp, [ecx + ebx]
add ebx, ecx
add ebx, 0x5f50ee04
or ebp, ebx
and ebx, 0xa0af11fc
sub edi, ebx
sub edi, esi
add edi, ecx
and ebp, 1
xor edi, 1
lea ebx, [edi + ebp*2]
mov byte [esp + ecx + 0x7f73f19d], bl
inc ecx
dec edx
cmp ecx, 0x808c0e6a
jne 0x43cc90
mov esi, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43cd55
xor edx, edx
mov edi, dword [0x44a880]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43cd10
inc edx
cmp ecx, edx
jne 0x43cd00
jmp 0x43cd55
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43cd55
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44a884]
mov edi, eax
call fcn.004395d0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408750
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cd70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cd80
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43cd9b
mov eax, 0xffffffff
jmp 0x43cd9e
add eax, 0xa
push eax
call fcn.00408740
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43cde1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43cdd0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x808c0e63
mov edx, 0x20230498
nop
movzx ebp, byte [esp + ecx + 0x7f73f19d]
lea esi, [ecx + 0x5f50ee04]
and esi, ebp
add esi, esi
mov ebx, esi
sub ebx, ebp
add ebx, edx
not ebx
and ebx, 0xfc
add ebx, ebp
sub ebp, esi
lea edi, [ecx + ebp]
add ebp, ecx
add ebp, 0x5f50ee04
or edi, ebp
and ebp, 0xa0af11fc
sub ebx, ebp
sub ebx, esi
add ebx, ecx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
mov byte [esp + ecx + 0x7f73f19d], bl
inc ecx
dec edx
cmp ecx, 0x808c0e6a
jne 0x43ce50
mov esi, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43cf07
xor edx, edx
mov ebx, dword [0x44a880]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43ced0
inc edx
cmp ecx, edx
jne 0x43cec0
jmp 0x43cf07
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43cf07
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44a884]
mov edi, eax
call fcn.004395d0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408750
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cf20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cf40
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43cf5b
mov eax, 0xffffffff
jmp 0x43cf5e
add eax, 0xa
push eax
call fcn.00408740
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43cfa1
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43cf90
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x686b6a65
mov word [esp + 0x2c], 0
mov byte [esp + 0x2e], 0
mov ecx, 0x808c0e63
mov eax, 0x20230498
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x7f73f1c5]
lea esi, [ecx + 0x5f50ee04]
and esi, edi
add esi, esi
mov ebx, esi
sub ebx, edi
add ebx, eax
not ebx
and ebx, 0xfc
add ebx, edi
sub edi, esi
lea edx, [ecx + edi]
add edi, ecx
add edi, 0x5f50ee04
or edx, edi
and edi, 0xa0af11fc
sub ebx, edi
sub ebx, esi
add ebx, ecx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esp + ecx + 0x7f73f1c5], dl
inc ecx
dec eax
cmp ecx, 0x808c0e6a
jne 0x43d020
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43d0c5
xor edx, edx
mov edi, dword [0x44a880]
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x43d0a0
inc edx
cmp ecx, edx
jne 0x43d090
jmp 0x43d0c5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d0c5
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.00408750
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43d0de
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x808c0e63
mov edx, 0x20230498
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x7f73f19d]
lea ecx, [eax + 0x5f50ee04]
and ecx, esi
add ecx, ecx
mov ebx, ecx
sub ebx, esi
add ebx, edx
not ebx
and ebx, 0xfc
add ebx, esi
sub esi, ecx
lea edi, [eax + esi]
add esi, eax
add esi, 0x5f50ee04
or edi, esi
and esi, 0xa0af11fc
sub ebx, esi
sub ebx, ecx
add ebx, eax
and edi, 1
xor ebx, 1
lea ecx, [ebx + edi*2]
mov byte [esp + eax + 0x7f73f19d], cl
inc eax
dec edx
cmp eax, 0x808c0e6a
jne 0x43d120
mov eax, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43d1c8
xor edx, edx
mov esi, dword [0x44a880]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x7cde1e50
je 0x43d1a0
inc edx
cmp ecx, edx
jne 0x43d190
jmp 0x43d1c8
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d1c8
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43d1d5
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43d1e4
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x808c0e63
mov ebx, 0x20230498
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x7f73f19d]
lea edi, [eax + 0x5f50ee04]
and edi, esi
add edi, edi
mov ebp, edi
sub ebp, esi
add ebp, ebx
not ebp
and ebp, 0xfc
add ebp, esi
sub esi, edi
lea ecx, [eax + esi]
add esi, eax
add esi, 0x5f50ee04
or ecx, esi
and esi, 0xa0af11fc
sub ebp, esi
sub ebp, edi
add ebp, eax
and ecx, 1
xor ebp, 1
lea ecx, [ecx*2]
add ecx, ebp
mov byte [esp + eax + 0x7f73f19d], cl
inc eax
dec ebx
cmp eax, 0x808c0e6a
jne 0x43d220
mov eax, dword [esp]
mov esi, dword [0x44a87c]
test esi, esi
je 0x43d2e1
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc81e0bf6
je 0x43d2b0
inc edi
cmp esi, edi
jne 0x43d2a0
jmp 0x43d2e1
mov edi, dword [ebx + edi*8 + 4]
cmp edi, eax
je 0x43d2e1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push edi
push dword [0x44a884]
call fcn.004395d0
add esp, 0x30
cmp eax, 0x103
jne 0x43d3b9
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x808c0e63
mov ecx, 0x20230498
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x7f73f19d]
lea edx, [eax + 0x5f50ee04]
and edx, esi
add edx, edx
mov edi, edx
sub edi, esi
add edi, ecx
not edi
and edi, 0xfc
add edi, esi
mov ebx, esi
sub ebx, edx
lea esi, [eax + ebx]
add ebx, eax
add ebx, 0x5f50ee04
or esi, ebx
and ebx, 0xa0af11fc
sub edi, ebx
sub edi, edx
add edi, eax
and esi, 1
xor edi, 1
lea edx, [edi + esi*2]
mov byte [esp + eax + 0x7f73f19d], dl
inc eax
dec ecx
cmp eax, 0x808c0e6a
jne 0x43d310
mov eax, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43d3b1
xor edx, edx
mov esi, dword [0x44a880]
nop
nop
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x43d390
inc edx
cmp ecx, edx
jne 0x43d380
jmp 0x43d3b1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d3b1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x18
test eax, eax
js 0x43d3b9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43d3d0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43d3ce
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x808c0e63
mov ebx, 0x20230498
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x7f73f19d]
lea edi, [eax + 0x5f50ee04]
and edi, esi
add edi, edi
mov ebp, edi
sub ebp, esi
add ebp, ebx
not ebp
and ebp, 0xfc
add ebp, esi
sub esi, edi
lea ecx, [eax + esi]
add esi, eax
add esi, 0x5f50ee04
or ecx, esi
and esi, 0xa0af11fc
sub ebp, esi
sub ebp, edi
add ebp, eax
and ecx, 1
xor ebp, 1
lea ecx, [ecx*2]
add ecx, ebp
mov byte [esp + eax + 0x7f73f19d], cl
inc eax
dec ebx
cmp eax, 0x808c0e6a
jne 0x43d410
mov eax, dword [esp]
mov esi, dword [0x44a87c]
test esi, esi
je 0x43d4d1
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e66a1b5
je 0x43d4a0
inc edi
cmp esi, edi
jne 0x43d490
jmp 0x43d4d1
mov edi, dword [ebx + edi*8 + 4]
cmp edi, eax
je 0x43d4d1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push edi
push dword [0x44a884]
call fcn.004395d0
add esp, 0x30
cmp eax, 0x103
jne 0x43d5a9
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x808c0e63
mov ecx, 0x20230498
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x7f73f19d]
lea edx, [eax + 0x5f50ee04]
and edx, esi
add edx, edx
mov edi, edx
sub edi, esi
add edi, ecx
not edi
and edi, 0xfc
add edi, esi
mov ebx, esi
sub ebx, edx
lea esi, [eax + ebx]
add ebx, eax
add ebx, 0x5f50ee04
or esi, ebx
and ebx, 0xa0af11fc
sub edi, ebx
sub edi, edx
add edi, eax
and esi, 1
xor edi, 1
lea edx, [edi + esi*2]
mov byte [esp + eax + 0x7f73f19d], dl
inc eax
dec ecx
cmp eax, 0x808c0e6a
jne 0x43d500
mov eax, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43d5a1
xor edx, edx
mov esi, dword [0x44a880]
nop
nop
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x43d580
inc edx
cmp ecx, edx
jne 0x43d570
jmp 0x43d5a1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d5a1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x18
test eax, eax
js 0x43d5a9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43d5b7
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43d5e0
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x686b6a65
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x808c0e63
mov edi, 0x20230498
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7f73f19d]
lea ebx, [eax + 0x5f50ee04]
and ebx, ecx
add ebx, ebx
mov ebp, ebx
sub ebp, ecx
add ebp, edi
not ebp
and ebp, 0xfc
add ebp, ecx
sub ecx, ebx
lea edx, [eax + ecx]
add ecx, eax
add ecx, 0x5f50ee04
or edx, ecx
and ecx, 0xa0af11fc
sub ebp, ecx
sub ebp, ebx
add ebp, eax
and edx, 1
xor ebp, 1
lea ecx, [edx*2]
add ecx, ebp
mov byte [esp + eax + 0x7f73f19d], cl
inc eax
dec edi
cmp eax, 0x808c0e6a
jne 0x43d670
mov eax, dword [esp]
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x43d727
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x2df48de6
je 0x43d700
inc edi
cmp ecx, edi
jne 0x43d6f0
jmp 0x43d727
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, eax
je 0x43d727
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 0x10
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x2016edc
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0xa712965
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3dd15bc9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3fbe0cd1
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x1dd2be2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x47bf1db6
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219