joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.004434d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cd58]

Function at 0x43b830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00443c30
add esp, 0x14
test eax, eax
js 0x43b963
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00444020
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43b8c9
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x43b895
mov eax, 0xffffffff
jmp 0x43b89c
lea eax, [eax*2 + 2]
push eax
call fcn.0040c720
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00444670
add esp, 0x14
test eax, eax
js 0x43b8c0
mov esi, edi
jmp 0x43b8c9
push edi
call fcn.0040c730
add esp, 4
mov ebp, dword [esp + 4]
mov dword [esp], 0x1c1d1a1b
mov ecx, 0x7a
mov edx, 0x85
nop
nop
movzx edi, byte [esp + ecx - 0x7a]
mov ebx, ecx
xor ebx, edx
and ebx, edi
xor ebx, edx
mov al, 0x9d
sub al, bl
mov byte [esp + ecx - 0x7a], al
inc ecx
dec edx
cmp ecx, 0x7e
jne 0x43b8e0
mov ecx, dword [0x44f228]
test ecx, ecx
je 0x43b94a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44f22c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43b930
inc edi
cmp ecx, edi
jne 0x43b920
jmp 0x43b94a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43b94a
push ebp
push 1
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x10
test esi, esi
jne 0x43b965
mov eax, esp
push eax
call fcn.004432c0
add esp, 4
test al, al
je 0x43b963
cmp dword [esp], 1
je 0x43b965
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d5c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0xc1c6c714
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb1
xor dl, byte [esp + ecx]
add dl, 0x8b
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x43d5e0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x45724c]
add esp, 8
ret
Function at 0x43d700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x1c1d1a1b
mov eax, esp
mov ecx, 0x2f66985
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
mov ebp, ecx
or ebp, edx
lea edi, [ecx - 0x2f66900]
and edi, edx
lea edx, [ebp*2]
not edx
add edx, ebp
and ebp, 0xa8
and edx, 0x57
or edx, ebp
xor edx, edi
xor dl, 0xa8
add dl, 0x9e
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x2f66981
jne 0x43d730
mov edi, dword [esp]
mov eax, dword [0x44f228]
test eax, eax
je 0x43d7b6
xor ecx, ecx
mov edx, dword [0x44f22c]
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43d790
inc ecx
cmp eax, ecx
jne 0x43d780
jmp 0x43d7b6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d7b6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f230]
push eax
call fcn.004400f0
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xd7161924
mov word [esp + 4], 0
mov ebp, 0x9d57ea86
mov ecx, 0x62a81579
nop
nop
movzx edx, byte [esp + ebp + 0x62a8157a]
mov eax, edx
and eax, 0x74
mov esi, eax
xor esi, 0x74
xor eax, 0x60b60274
or eax, esi
mov esi, edx
xor esi, 0x60b60274
or edx, 0x8b
and edx, esi
or edx, eax
mov esi, ecx
and esi, 0x60a00074
mov eax, ebp
and eax, 0x9d41e88b
or eax, esi
xor eax, edx
mov edx, eax
not edx
and edx, 0x9f
and eax, 0x60
sub eax, edx
inc al
mov byte [esp + ebp + 0x62a8157a], al
inc ebp
dec ecx
cmp ebp, 0x9d57ea8c
jne 0x43d7d0
cmp edi, dword [esp]
jne 0x43d945
push dword [esp + 8]
call fcn.0043d5c0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x1c1d1a1b
mov edx, esp
mov ebp, 0x2f66985
nop
nop
nop
nop
nop
movzx ecx, byte [edx]
mov edi, ebp
or edi, ecx
lea esi, [ebp - 0x2f66900]
and esi, ecx
lea ecx, [edi + edi]
not ecx
add ecx, edi
and edi, 0xa8
and ecx, 0x57
or ecx, edi
xor ecx, esi
xor cl, 0xa8
add cl, 0x9e
mov byte [edx], cl
inc edx
dec ebp
cmp ebp, 0x2f66981
jne 0x43d860
mov edi, dword [esp]
mov ecx, dword [0x44f228]
test ecx, ecx
je 0x43d8e8
xor edx, edx
mov esi, dword [0x44f22c]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x43d8c0
inc edx
cmp ecx, edx
jne 0x43d8b0
jmp 0x43d8e8
mov edx, dword [esi + edx*8 + 4]
cmp edx, edi
je 0x43d8e8
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x44f230]
push edx
mov esi, eax
call fcn.004400f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43d93c
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43d915
add edi, 2
cmp si, bp
je 0x43d900
cmp si, bp
je 0x43d927
mov esi, dword [ecx]
test esi, esi
jne 0x43d8f0
mov edi, 0xc0000225
jmp 0x43d93c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043d610
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43d990
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43da70
xor eax, eax
cmp dword [ecx], 0
jne 0x43dad6
mov edx, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x1c1d1a1b
mov eax, esp
mov esi, 0x2f66985
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
mov ebp, esi
or ebp, ebx
lea edi, [esi - 0x2f66900]
and edi, ebx
lea ebx, [ebp*2]
not ebx
add ebx, ebp
and ebp, 0xa8
and ebx, 0x57
or ebx, ebp
xor ebx, edi
xor bl, 0xa8
add bl, 0x9e
mov byte [eax], bl
inc eax
dec esi
cmp esi, 0x2f66981
jne 0x43da00
mov eax, dword [esp]
mov esi, dword [0x44f228]
test esi, esi
je 0x43dad6
xor edi, edi
mov ebx, dword [0x44f22c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43dae0
inc edi
cmp esi, edi
jne 0x43da60
jmp 0x43dad6
mov dword [esp + 4], 0xd19e9f64
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0xe1a1c04c
mov ecx, 0x1a
nop
nop
movzx edx, byte [esp + eax + 0x1e5e3fb8]
lea esi, [eax - 0x36e6b467]
mov edi, ecx
xor edi, esi
and edi, edx
xor edi, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
and ebx, esi
add ebx, ebx
sub edx, ebx
add edx, eax
mov esi, edx
and esi, 0x1f
xor edx, 0x1f
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0x1e5e3fb8], dl
inc eax
dec ecx
cmp eax, 0xe1a1c053
jne 0x43da90
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43dad6
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f230]
push esi
call fcn.004400f0
add esp, 0x1c
jmp 0x43dad6

Function at 0x43db20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43dbcb
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0x1c1d1a1b
mov edx, esp
mov esi, 0x2f66985
nop
nop
nop
movzx ebx, byte [edx]
mov ebp, esi
or ebp, ebx
lea edi, [esi - 0x2f66900]
and edi, ebx
lea ebx, [ebp*2]
not ebx
add ebx, ebp
and ebp, 0xa8
and ebx, 0x57
or ebx, ebp
xor ebx, edi
xor bl, 0xa8
add bl, 0x9e
mov byte [edx], bl
inc edx
dec esi
cmp esi, 0x2f66981
jne 0x43db40
mov edx, dword [0x44f228]
test edx, edx
je 0x43dbbe
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f22c]
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43dba0
inc edi
cmp edx, edi
jne 0x43db90
jmp 0x43dbbe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43dbbe
push eax
push 1
push dword [0x44f230]
push edx
mov esi, ecx
call fcn.004400f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 0xc], ecx
cmp dword [ecx + 8], 0
je 0x43dc70
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x43dc70
mov dword [esp + 8], eax
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0x1c1d1a1b
mov eax, esp
mov ecx, 0x2f66985
nop
nop
nop
movzx edx, byte [eax]
mov edi, ecx
or edi, edx
lea esi, [ecx - 0x2f66900]
and esi, edx
lea edx, [edi + edi]
not edx
add edx, edi
and edi, 0xa8
and edx, 0x57
or edx, edi
xor edx, esi
xor dl, 0xa8
add dl, 0x9e
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x2f66981
jne 0x43dc10
mov eax, dword [esp]
mov edx, dword [0x44f228]
test edx, edx
je 0x43dceb
xor ecx, ecx
mov esi, dword [0x44f22c]
nop
nop
cmp dword [esi + ecx*8], 0x2dedf0b8
je 0x43dccb
inc ecx
cmp edx, ecx
jne 0x43dc60
jmp 0x43dceb
mov dword [esp], 0x4106070c
mov byte [esp + 4], 0
xor eax, eax
mov ecx, 0xb5bba4be
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
lea edi, [ecx + 0x4a445c00]
and edi, 0xbe
mov edx, eax
and edx, 1
or edx, edi
mov edi, ecx
or edi, esi
and edx, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
or ebx, edx
add bl, 0xbb
mov byte [esp + eax], bl
inc eax
dec ecx
cmp eax, 5
jne 0x43dc90
mov eax, dword [esp]
jmp 0x43de00
mov ecx, dword [esi + ecx*8 + 4]
cmp ecx, eax
je 0x43dceb
push dword [ebp + 8]
push dword [esp + 0xc]
push 2
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x14
cmp ebx, 1
mov ecx, dword [ebp + 0x10]
sbb ecx, 0
jl 0x43ddef
cmp eax, 0xc000010a
jne 0x43ddef
mov esi, ebx
and esi, 0xffffd8f0
mov eax, esi
xor eax, 0xffffd8f0
mov ecx, ebx
and ecx, 0x270f
mul ecx
mov dword [esp + 8], eax
mov edi, edx
mov eax, ebx
mov ebx, dword [ebp + 0x10]
mov edx, ebx
not edx
imul edx, ecx
add edi, edx
or eax, 0xffffd8f0
imul ebx, eax
mul esi
add edx, ebx
sub edx, esi
add eax, dword [esp + 8]
adc edx, edi
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov dword [esp + 0x10], 0x1c1d1a1b
lea eax, [esp + 0x10]
mov esi, 0x2f66985
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
mov edi, esi
or edi, ebx
lea ecx, [esi - 0x2f66900]
and ecx, ebx
lea ebx, [edi + edi]
not ebx
add ebx, edi
and edi, 0xa8
and ebx, 0x57
or ebx, edi
xor ebx, ecx
xor bl, 0xa8
add bl, 0x9e
mov byte [eax], bl
inc eax
dec esi
cmp esi, 0x2f66981
jne 0x43dd70
mov eax, dword [esp + 0x10]
mov esi, dword [0x44f228]
test esi, esi
je 0x43ddef
xor ecx, ecx
mov edi, dword [0x44f22c]
nop
nop
nop
nop
nop
cmp dword [edi + ecx*8], 0x4e66b5a3
je 0x43ddd0
inc ecx
cmp esi, ecx
jne 0x43ddc0
jmp 0x43ddef
mov ecx, dword [edi + ecx*8 + 4]
cmp ecx, eax
je 0x43ddef
mov eax, esp
push eax
push 0
push edx
push 3
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x18
test eax, eax
js 0x43de00
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.0043db20
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43de10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43dea0
push 0xbbf966b4
push dword [0x44f21c]
call fcn.00442a00
add esp, 8
test eax, eax
je 0x43de65
mov ecx, dword [esi]
test ecx, ecx
je 0x43de9d
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43de79
cmp dword [esp], 0
je 0x43de79
mov dword [esi + 4], 3
jmp 0x43de9d
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jmp 0x43df27
lea eax, [esp + 8]
push eax
call fcn.004432c0
add esp, 4
test al, al
je 0x43de9d
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43de9a
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 4], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43df27
mov dword [esp], 0x1c1d1a1b
mov eax, esp
mov ebp, 0x2f66985
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
mov edx, ebp
or edx, ebx
lea esi, [ebp - 0x2f66900]
and esi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
and edx, 0xa8
and ebx, 0x57
or ebx, edx
xor ebx, esi
xor bl, 0xa8
add bl, 0x9e
mov byte [eax], bl
inc eax
dec ebp
cmp ebp, 0x2f66981
jne 0x43dec0
mov eax, dword [esp]
mov edx, dword [0x44f228]
test edx, edx
je 0x43dfc7
xor esi, esi
mov ebx, dword [0x44f22c]
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43dfa0
inc esi
cmp edx, esi
jne 0x43df10
jmp 0x43dfc7
mov dword [esp], 0x1c1d1a1b
mov eax, esp
mov edx, 0x2f66985
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
mov ebp, edx
or ebp, ebx
lea esi, [edx - 0x2f66900]
and esi, ebx
lea ebx, [ebp*2]
not ebx
add ebx, ebp
and ebp, 0xa8
and ebx, 0x57
or ebx, ebp
xor ebx, esi
xor bl, 0xa8
add bl, 0x9e
mov byte [eax], bl
inc eax
dec edx
cmp edx, 0x2f66981
jne 0x43df40
mov eax, dword [esp]
mov edx, dword [0x44f228]
test edx, edx
je 0x43dfc7
xor esi, esi
mov ebx, dword [0x44f22c]
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43dfa0
inc esi
cmp edx, esi
jne 0x43df90
jmp 0x43dfc7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43dfc7
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push edi
push dword [esp + 0x14]
push 5
push dword [0x44f230]
push edx
call fcn.004400f0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43e329
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43e33a
cmp eax, 2
je 0x43e3b0
jmp 0x43e3dd
push 0xbbf966b4
push dword [0x44f21c]
call fcn.00442a00
add esp, 8
test eax, eax
je 0x43e37b
mov ecx, dword [esi]
test ecx, ecx
je 0x43e3a8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43e384
cmp dword [esp + 4], 0
je 0x43e384
mov dword [esi + 4], 3
jmp 0x43e3a8
mov dword [esi + 4], 1
jmp 0x43e3dd
lea eax, [esp + 0xc]
push eax
call fcn.004432c0
add esp, 4
test al, al
je 0x43e3a8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e3a5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43e3dd
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x457244]
call fcn.00442a00
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43e487
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1c1d1a1b
lea eax, [esp + 4]
mov ecx, 0x2f66985
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
mov edx, ecx
or edx, ebx
lea esi, [ecx - 0x2f66900]
and esi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
and edx, 0xa8
and ebx, 0x57
or ebx, edx
xor ebx, esi
xor bl, 0xa8
add bl, 0x9e
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x2f66981
jne 0x43e400
mov eax, dword [esp + 4]
mov edx, dword [0x44f228]
test edx, edx
je 0x43e487
xor ecx, ecx
mov esi, dword [0x44f22c]
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xfd743ac4
je 0x43e460
inc ecx
cmp edx, ecx
jne 0x43e450
jmp 0x43e487
mov ecx, dword [esi + ecx*8 + 4]
cmp ecx, eax
je 0x43e487
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x4413f2
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44157e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44157e
mov dword [esp], 0x787b7a05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ebp, 0x6ce591bf
mov ecx, 0x40
nop
movzx edx, byte [esp + ebp - 0x6ce591bf]
mov edi, ecx
and edi, 0x6e
mov eax, ebp
xor eax, 0xafaef46e
or eax, edi
xor eax, edx
mov edx, eax
and edx, 1
xor eax, 0x6f
lea eax, [eax + edx*2]
add al, 0x44
mov byte [esp + ebp - 0x6ce591bf], al
inc ebp
dec ecx
cmp ebp, 0x6ce591c6
jne 0x441410
mov eax, dword [esp]
mov ecx, dword [0x44f228]
test ecx, ecx
je 0x441470
xor edx, edx
mov edi, dword [0x44f22c]
mov ebp, dword [esp + 0x20]
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x441476
inc edx
cmp ecx, edx
jne 0x441460
jmp 0x4414a0
mov ebp, dword [esp + 0x20]
jmp 0x4414a0
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4414a0
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x44157e
push 0x732f71fd
push dword [0x457244]
call fcn.00442a00
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x787b7a05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x6ce591bf
mov esi, 0x40
nop
nop
movzx edi, byte [esp + edx - 0x6ce591bf]
mov ebx, esi
and ebx, 0x6e
mov ebp, edx
xor ebp, 0xafaef46e
or ebp, ebx
xor ebp, edi
mov edi, ebp
and edi, 1
xor ebp, 0x6f
lea ebx, [edi*2]
add ebx, ebp
add bl, 0x44
mov byte [esp + edx - 0x6ce591bf], bl
inc edx
dec esi
cmp edx, 0x6ce591c6
jne 0x4414f0
mov edx, dword [0x44f228]
test edx, edx
je 0x44157e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f22c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x441560
inc edi
cmp edx, edi
jne 0x441550
jmp 0x44157e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44157e
push ecx
push 1
push dword [0x44f230]
push edx
mov esi, eax
call fcn.004400f0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442a00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
movzx eax, word [edi]
mov dword [esp], 0x1312bbc5
mov dword [esp + 4], 0
mov ecx, 0x7c
mov edx, 0x83
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x7c]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x94
mov byte [esp + ecx - 0x7c], bl
inc ecx
dec edx
cmp ecx, 0x84
jne case.default.0x442a58
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44dd78]
sub al, byte [eax + eax - 0x6e]
sub eax, 0x2aec0044
inc esp
add byte [eax + 0x6200442a], al
sub eax, dword [eax + eax - 0x80]
sub al, byte [eax + eax + 0x79]
sub eax, dword [eax + eax - 0x6e]
sub eax, 0x10044
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
jns 0x44ddd1
inc esp
add byte [eax - 0x6dffbbd5], dh
sub eax, 0x2bb00044
inc esp
add byte [eax - 0x49ffbbd5], dh
sub eax, dword [eax + eax - 0x50]
sub eax, dword [eax + eax - 0x7b]
sub eax, 0x2c000044
inc esp
add byte [eax + 0x2d], dl
inc esp
add byte [edi], dh
sub eax, 0x2a730044
inc esp
add byte [ebp + 0x2d], dh
inc esp
add byte [ebx + 0x2a], dh
sub al, byte [eax + eax + 0x75]
sub eax, 0x2a730044
inc esp
add byte [ebp - 0x6dffbbd3], al
sub eax, 0x2d900044
inc esp
add byte [ecx], dl
inc esp
add byte [edx], dl
xor byte [eax + eax + 0x55], al

Function at 0x442ff2
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 8], 4
mov esi, dword [esp + 0x10]
add esi, 4
mov ecx, 1
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0xc]
jmp dword [ecx*4 + 0x44de38]
Function at 0x4434d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4434f0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44350b
mov eax, 0xffffffff
jmp 0x44350e
add eax, 0xa
push eax
call fcn.0040c720
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443551
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443540
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x787b7a05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ebp, 0x6ce591bf
xor edx, edx
nop
nop
nop
nop
movzx ebx, byte [esp + ebp - 0x6ce591bf]
mov esi, edx
and esi, 7
mov ecx, ebp
and ecx, 0x78
or ecx, esi
xor ecx, 0x78
lea esi, [edx + 0x40]
and esi, ecx
mov ecx, ebp
or ecx, ebx
not ebx
or ebx, esi
and ebx, ecx
add bl, 0x45
mov byte [esp + ebp - 0x6ce591bf], bl
inc ebp
dec edx
cmp ebp, 0x6ce591c6
jne 0x4435c0
mov esi, dword [esp]
mov ecx, dword [0x44f228]
test ecx, ecx
je 0x443654
xor edx, edx
mov ebx, dword [0x44f22c]
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x443620
inc edx
cmp ecx, edx
jne 0x443610
jmp 0x443654
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443654
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x44f230]
push ecx
mov edi, eax
call fcn.004400f0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c730
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret