joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4244a0
cmp eax, 0xffffffed
jge 0x4244b7
mov eax, 0xffffffff
jmp 0x4244ba
add eax, 0x12
push eax
call fcn.0040ca00
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x21b32740
mov dword [esp + 4], 0x5da923bf
mov dword [esp + 8], 0x59085f10
mov dword [esp + 0xc], 0x55385bc4
mov word [esp + 0x10], 0x5754
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov esi, 0xb131e6ac
mov ecx, 0x6263cd58
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 0x4ece1954]
mov ebp, ecx
and ebp, 0x20038472
mov eax, esi
xor eax, 0x168dd239
mov edx, 0xab
sub edx, ebp
sub edx, eax
add eax, ebp
add eax, 0x4ece1954
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, eax
and edx, ebx
or edx, edi
mov ebx, edx
and ebx, 0xe0
mov eax, edx
and eax, 2
mov ebp, eax
xor ebp, 2
imul ebp, ebx
or ebx, 2
imul ebx, eax
mov eax, edx
and eax, 0x62
add eax, eax
sub edx, eax
add edx, ebp
add edx, ebx
add dl, 0xe3
mov byte [esp + esi + 0x4ece1954], dl
inc esi
add ecx, 2
cmp esi, 0xb131e6c3
jne 0x424510
mov edx, dword [esp + 0x30]
movzx ecx, word [edx]
mov esi, dword [esp + 0x18]
mov eax, esi
test cx, cx
je 0x4245b1
add edx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4245a0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4245e1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4245d0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445e30
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44ccb4]
Function at 0x42a390
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
xor ebp, ebp
mov dword [esp], 0
mov eax, 0x20219
mov ecx, 1
mov dword [esp + 4], 0
jmp dword [ecx*4 + 0x44daac]
Function at 0x42b100
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b120
add esp, 4
test al, al
je 0x42b780
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x98], 0x43ac4189
mov dword [esp + 0x9c], 0x47d245d7
mov dword [esp + 0xa0], 0x4ba649a9
mov dword [esp + 0xa4], 0x4fbe4da0
mov dword [esp + 0xa8], 0x73e67191
mov dword [esp + 0xac], 0x7776759c
mov byte [esp + 0xb0], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x90
xor cl, byte [esp + eax + 0x98]
add cl, 0x30
mov byte [esp + eax + 0x98], cl
inc eax
cmp eax, 0x19
jne 0x42b7e0
mov dword [esp + 0x1c], 0xf300f114
mov dword [esp + 0x20], 0xef11ed11
mov dword [esp + 0x24], 0xeb19e911
mov dword [esp + 0x28], 0xe714e508
mov dword [esp + 0x2c], 0xe306e109
mov dword [esp + 0x30], 0x9f5f9d69
mov dword [esp + 0x34], 0x9b62995b
mov dword [esp + 0x38], 0x9760956d
mov dword [esp + 0x3c], 0x9376916d
mov dword [esp + 0x40], 0x8f798d7f
mov dword [esp + 0x44], 0x8b668976
mov dword [esp + 0x48], 0x8747856b
mov dword [esp + 0x4c], 0x837f8172
mov dword [esp + 0x50], 0xbf50bd58
mov dword [esp + 0x54], 0xbb2eb959
mov dword [esp + 0x58], 0xb72bb53a
mov dword [esp + 0x5c], 0xb341b154
mov dword [esp + 0x60], 0xaf33ad20
mov dword [esp + 0x64], 0xab3fa949
mov word [esp + 0x68], 0xa5a4
mov word [esp + 0x6e], 0
mov dword [esp + 0x6a], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
or edx, 0x6183742c
add edx, ecx
inc edx
mov esi, ecx
or esi, 0x6183742c
mov edi, edx
and edi, esi
xor esi, edx
lea edx, [esi + edi*2]
xor dl, byte [esp + ecx + 0x1c]
add dl, 0x24
mov byte [esp + ecx + 0x1c], dl
lea edx, [ecx + 1]
dec eax
mov ecx, edx
cmp edx, 0x54
jne case.default.0x42b910
lea eax, [esp + 0x98]
lea esi, [esp + 0x1c]
push eax
push esi
call fcn.0043cdc0
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x44dbcc]

Function at 0x42b120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x21aa27a9
mov dword [esp + 0x58], 0x5d4123bf
mov dword [esp + 0x5c], 0x59085fcb
mov dword [esp + 0x60], 0x55d25bc7
mov dword [esp + 0x64], 0x515657cb
mov word [esp + 0x68], 0
mov byte [esp + 0x6a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x39
xor cl, byte [esp + eax + 0x54]
add cl, 0xe3
mov byte [esp + eax + 0x54], cl
inc eax
cmp eax, 0x17
jne case.default.0x42b1b7
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.004400b0
shr eax, 0x1f
jmp dword [eax*4 + 0x44db24]

Function at 0x42b1f4
Capabilities:
Encode data using xor

Disassembly:
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44db4c]

Function at 0x42ba2c
Capabilities:
Copy file

Disassembly:
push edi
call fcn.0040ca10
add esp, 4
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x44dbdc]
Function at 0x42ba46
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x44dbdc]

Function at 0x42bb43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
call fcn.0040ca10
add esp, 4
xor eax, eax
cmp ebx, edi
sete al
jmp dword [eax*4 + 0x44dc4c]

Function at 0x42be89
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
call fcn.0040ca10
add esp, 4

Function at 0x42bf7a
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp ebx, edi
sete al
jmp dword [eax*4 + 0x44dc4c]

Function at 0x42c450
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], 0xe510ea01
mov dword [esp + 0x20], 0xef808e1
mov dword [esp + 0x24], 0xf50d1935
mov dword [esp + 0x28], 0x103f04fa
mov dword [esp + 0x2c], 0xfa0500f0
mov dword [esp + 0x30], 0x707da39
mov dword [esp + 0x34], 0xdfff806
mov dword [esp + 0x38], 0xf5f3f0dd
mov word [esp + 0x3c], 0x9bf7
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
mov eax, 0xeb
mov ecx, 0x14
nop
nop
movzx esi, byte [esp + eax - 0xcf]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x69
mov byte [esp + eax - 0xcf], dl
inc eax
dec ecx
cmp eax, 0x112
jne 0x42c4b0
mov ecx, ebx
lea eax, [esp + 0x1c]
push eax
call fcn.0042e4b0
jmp dword [0x44dc7c]
Function at 0x42f200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42f359
mov edx, dword [esp + 0x14]
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
xor ebx, eax
mov edi, ebx
shr edi, 1
mov eax, ebx
xor eax, 0xfffffffe
or ebx, 1
and ebx, eax
mov ebp, ebx
neg ebp
and ebp, 0xedb88320
dec ebx
mov eax, ebp
not eax
or eax, ebx
xor eax, ebp
and eax, edi
xor eax, ebp
mov ebx, eax
shr ebx, 1
mov edi, eax
xor edi, 0xfffffffe
or eax, 1
and eax, edi
mov ebp, eax
neg ebp
and ebp, 0xedb88320
dec eax
mov edi, ebp
not edi
or edi, eax
xor edi, ebp
and edi, ebx
xor edi, ebp
mov ebx, edi
shr ebx, 1
mov eax, edi
xor eax, 0xfffffffe
or edi, 1
and edi, eax
mov ebp, edi
neg ebp
and ebp, 0xedb88320
dec edi
mov eax, ebp
not eax
or eax, edi
xor eax, ebp
and eax, ebx
xor eax, ebp
mov ebx, eax
shr ebx, 1
mov edi, eax
xor edi, 0xfffffffe
or eax, 1
and eax, edi
mov ebp, eax
neg ebp
and ebp, 0xedb88320
dec eax
mov edi, ebp
not edi
or edi, eax
xor edi, ebp
and edi, ebx
xor edi, ebp
mov ebx, edi
shr ebx, 1
mov eax, edi
xor eax, 0xfffffffe
or edi, 1
and edi, eax
mov ebp, edi
neg ebp
and ebp, 0xedb88320
dec edi
mov eax, ebp
not eax
or eax, edi
xor eax, ebp
and eax, ebx
xor eax, ebp
mov ebx, eax
shr ebx, 1
mov edi, eax
xor edi, 0xfffffffe
or eax, 1
and eax, edi
mov ebp, eax
neg ebp
and ebp, 0xedb88320
dec eax
mov edi, ebp
not edi
or edi, eax
xor edi, ebp
and edi, ebx
xor edi, ebp
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
mov ebp, edi
neg ebp
and ebp, 0xedb88320
dec edi
mov ebx, ebp
not ebx
or ebx, edi
xor ebx, ebp
and ebx, eax
xor ebx, ebp
mov edi, ebx
shr edi, 1
mov eax, ebx
xor eax, 0xfffffffe
or ebx, 1
and ebx, eax
mov ebp, ebx
neg ebp
and ebp, 0xedb88320
dec ebx
mov eax, ebp
not eax
or eax, ebx
xor eax, ebp
and eax, edi
xor eax, ebp
inc esi
cmp ecx, esi
jne 0x42f220
not eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435de0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.0040e380
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435e19
jmp 0x435f42
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x435f3c
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x435e5f
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.0040cc20
add esp, 4
jmp 0x435e72
cmp eax, 0
setne cl
jmp 0x435e7a
jmp 0x435e7c
xor ebx, ebx
test cl, 1
jne 0x435e88
jmp 0x435f2d
mov cl, byte [edi]
mov byte [ebp - 0x10], cl
mov byte [esi], 0xd9
mov byte [esi + 1], 0xb3
mov byte [esi + 2], 0xbd
mov byte [esi + 3], 0xb1
mov byte [esi + 4], 0xc2
mov byte [esi + 5], 0xb2
mov byte [esi + 6], 0xc1
mov byte [esi + 7], 0x4f
mov byte [esi + 8], 0x40
mov byte [esi + 9], 9
mov byte [esi + 0xa], 0x52
mov byte [esi + 0xb], 0x51
mov byte [esi + 0xc], 0x54
mov byte [esi + 0xd], 0xdb
mov ecx, 0xe
mov byte [esi + ecx], 0
add ecx, 1
cmp ecx, 0x11
jne 0x435ec9
xor ecx, ecx
cmp ecx, 0x11
jae 0x435f0f
movzx edi, byte [esi + ecx]
mov edx, ecx
add edx, 0xd9c20ef9
mov ebx, edi
xor ebx, 0xffffffff
and edx, ebx
mov ebx, 6
sub ebx, ecx
and ebx, edi
or edx, ebx
mov ebx, edx
and ebx, 1
or edx, 1
add edx, 0x22
add ebx, edx
mov byte [esi + ecx], bl
add ecx, 1
jmp 0x435ed7
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040d690
mov bl, al
and bl, 1
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.00446370
add esp, 0x14
test eax, eax
js 0x43cf29
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00446760
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43ce57
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc ecx
jns 0x43ce23
mov eax, 0xffffffff
jmp 0x43ce2a
lea eax, [eax*2 + 2]
push eax
call fcn.0040ca00
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00446d40
add esp, 0x14
test eax, eax
js 0x43ce4e
mov esi, edi
jmp 0x43ce57
push edi
call fcn.0040ca10
add esp, 4
mov eax, dword [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4c4d4a4b
mov word [esp + 8], 0
mov ecx, 0x92
mov ebp, 0x188fb66d
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0x8e]
lea ebx, [ecx - 0x588fb700]
mov edi, ecx
and edi, eax
mov edx, ebp
and edx, 0x18849606
and ebx, 0x85604909
or ebx, edx
xor ebx, eax
xor ebx, 0x3a949696
or ebx, edi
lea eax, [ebx + ebx]
not eax
add eax, ebx
or eax, edi
mov dl, 0x25
sub dl, al
mov byte [esp + ecx - 0x8e], dl
inc ecx
dec ebp
cmp ecx, 0x98
jne 0x43ce80
mov ecx, dword [0x451f80]
test ecx, ecx
je 0x43cf0d
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x451f84]
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43cef0
inc edi
cmp ecx, edi
jne 0x43cee0
jmp 0x43cf0d
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43cf0d
push dword [esp + 0xc]
push 1
push dword [0x451f88]
push ecx
call fcn.00442960
add esp, 0x10
test esi, esi
jne 0x43cf2b
lea eax, [esp + 4]
push eax
call fcn.00445aa0
add esp, 4
test al, al
je 0x43cf29
cmp dword [esp + 4], 1
je 0x43cf2b
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x43d17a
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x43d0b8
mov esi, ebx
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x43d17c
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004214c0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004214c0
add esp, 4
mov bl, al
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, bh
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], al
inc esi
cmp edi, ecx
jae 0x43d0a4
movzx eax, byte [ebp + edi]
push eax
call fcn.004214c0
add esp, 4
cmp al, 0x40
je 0x43d0a0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov edx, esi
and edx, 1
mov ebx, esi
xor ebx, 1
lea ebx, [ebx + edx*2]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x43d171
mov byte [esp + 3], al
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004214c0
add esp, 4
cmp al, 0x40
je 0x43d09e
movzx ecx, byte [esp + 3]
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebx], al
inc ebx
jmp 0x43d09e
mov ecx, edx
mov esi, ebx
jmp 0x43d0a4
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ffa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0x81868774
mov byte [esp + 4], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 2
mov ebx, edx
xor ebx, 0x61
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x1b
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 5
jne 0x43ffc0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x459f9c]
add esp, 8
pop esi
pop ebx
ret

Function at 0x4400b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x484b4a4d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x93
xor cl, byte [esp + eax]
add cl, 0x21
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x4400e0
mov edi, dword [esp]
mov eax, dword [0x451f80]
test eax, eax
je 0x440146
xor ecx, ecx
mov edx, dword [0x451f84]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x440120
inc ecx
cmp eax, ecx
jne 0x440110
jmp 0x440146
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x440146
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x451f88]
push eax
call fcn.00442960
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x440245
push dword [esp + 0xc]
call fcn.0043ffa0
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x484b4a4d
mov byte [esp + 4], 0
xor edx, edx
mov ecx, edx
add cl, 0x93
xor cl, byte [esp + edx]
add cl, 0x21
mov byte [esp + edx], cl
inc edx
cmp edx, 5
jne 0x440170
mov edi, dword [esp]
mov edx, dword [0x451f80]
test edx, edx
je 0x4401dc
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x451f84]
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x4401b2
inc ebp
cmp edx, ebp
jne 0x4401a0
mov ebp, ecx
jmp 0x4401dc
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x4401dc
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x451f88]
push edx
mov esi, eax
call fcn.00442960
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x44023c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x440215
add edi, 2
cmp si, bp
je 0x440200
cmp si, bp
je 0x440227
mov esi, dword [ecx]
test esi, esi
jne 0x4401f0
mov edi, 0xc0000225
jmp 0x44023c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00440000
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x440280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x440330
xor eax, eax
cmp dword [ecx], 0
jne 0x44037b
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x484b4a4d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x93
xor bl, byte [esp + eax]
add bl, 0x21
mov byte [esp + eax], bl
inc eax
cmp eax, 5
jne 0x4402f0
mov eax, dword [esp]
mov esi, dword [0x451f80]
test esi, esi
je 0x44037b
xor edi, edi
mov ebx, dword [0x451f84]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x440384
inc edi
cmp esi, edi
jne 0x440320
jmp 0x44037b
mov dword [esp + 8], 0xa1e6e7fc
mov byte [esp + 0xc], 0
mov eax, 0xab40cf29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x54bf30df]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x33
mov byte [esp + eax + 0x54bf30df], cl
inc eax
cmp eax, 0xab40cf2e
jne 0x440350
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x44037b
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x451f88]
push esi
call fcn.00442960
add esp, 0x1c
jmp 0x44037b

Function at 0x4403c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x44044a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x484b4a4d
mov byte [esp + 4], 0
xor edx, edx
nop
nop
mov ebx, edx
add bl, 0x93
xor bl, byte [esp + edx]
add bl, 0x21
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x4403e0
mov edx, dword [0x451f80]
test edx, edx
je 0x44043e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451f84]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x440420
inc edi
cmp edx, edi
jne 0x440410
jmp 0x44043e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44043e
push eax
push 1
push dword [0x451f88]
push edx
mov esi, ecx
call fcn.00442960
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x4406d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x44075a
push 0xf8eb88df
push dword [0x451f74]
call fcn.004451d0
add esp, 8
test eax, eax
je 0x440725
mov ecx, dword [esi]
test ecx, ecx
je 0x440757
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x440733
cmp dword [esp], 0
je 0x440733
mov dword [esi + 4], 3
jmp 0x440757
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x4407b0
lea eax, [esp + 8]
push eax
call fcn.00445aa0
add esp, 4
test al, al
je 0x440757
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x440754
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x4407b0
mov dword [esp], 0x484b4a4d
mov byte [esp + 4], 0
xor eax, eax
nop
mov edx, eax
add dl, 0x93
xor dl, byte [esp + eax]
add dl, 0x21
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x440770
mov eax, dword [esp]
mov edx, dword [0x451f80]
test edx, edx
je 0x440824
xor esi, esi
mov ebx, dword [0x451f84]
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x440800
inc esi
cmp edx, esi
jne 0x4407a0
jmp 0x440824
mov dword [esp], 0x484b4a4d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
mov edx, eax
add dl, 0x93
xor dl, byte [esp + eax]
add dl, 0x21
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x4407c0
mov eax, dword [esp]
mov edx, dword [0x451f80]
test edx, edx
je 0x440824
xor esi, esi
mov ebx, dword [0x451f84]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x440800
inc esi
cmp edx, esi
jne 0x4407f0
jmp 0x440824
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440824
push dword [esp + 0x2c]
push edi
push ebp
push dword [esp + 0x2c]
push ecx
push 5
push dword [0x451f88]
push edx
call fcn.00442960
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x440b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x440b29
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x440b3a
cmp eax, 2
je 0x440bb0
jmp 0x440bda
push 0xf8eb88df
push dword [0x451f74]
call fcn.004451d0
add esp, 8
test eax, eax
je 0x440b7b
mov ecx, dword [esi]
test ecx, ecx
je 0x440ba8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x440b84
cmp dword [esp + 4], 0
je 0x440b84
mov dword [esi + 4], 3
jmp 0x440ba8
mov dword [esi + 4], 1
jmp 0x440bda
lea eax, [esp + 0xc]
push eax
call fcn.00445aa0
add esp, 4
test al, al
je 0x440ba8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x440ba5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x440bda
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x459f94]
call fcn.004451d0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x440c54
mov ecx, dword [esi]
mov dword [esp + 4], 0x484b4a4d
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x93
xor dl, byte [esp + eax + 4]
add dl, 0x21
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 5
jne 0x440bf0
mov eax, dword [esp + 4]
mov edx, dword [0x451f80]
test edx, edx
je 0x440c54
xor esi, esi
mov ebx, dword [0x451f84]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x440c30
inc esi
cmp edx, esi
jne 0x440c20
jmp 0x440c54
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440c54
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x451f88]
push edx
call fcn.00442960
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18