joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424a50
cmp eax, 0xffffffed
jge 0x424a67
mov eax, 0xffffffff
jmp 0x424a6a
add eax, 0x12
push eax
call fcn.004088e0
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp], 0x73d971d4
mov dword [esp + 4], 0x7fc77dd1
mov dword [esp + 8], 0x7b8c7984
mov dword [esp + 0xc], 0x47e445e8
mov dword [esp + 0x10], 0x4140
mov eax, 0x13822c14
mov ecx, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x13822c14]
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov ebp, ecx
and ebp, edx
not edx
or edx, ebx
and edx, eax
or edx, ebp
mov ebx, edx
and ebx, 0x99
mov esi, edx
and esi, 2
mov ebp, esi
xor ebp, 2
imul ebp, ebx
or ebx, 2
imul ebx, esi
xor edx, 0x9b
add edx, ebp
add edx, ebx
inc dl
mov byte [esp + eax - 0x13822c14], dl
inc eax
dec ecx
cmp eax, 0x13822c28
jne 0x424ab0
movzx ecx, word [edi]
mov esi, dword [esp + 0x14]
mov eax, esi
test cx, cx
je 0x424b31
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424b20
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424b61
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424b50
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00443de0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44b230]
Function at 0x42a8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx edi, word [edx]
test di, di
je 0x42aa48
mov esi, dword [esp + 0x1c]
dec esi
je 0x42aa48
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [edx + 2]
cmp bx, 0x7f
ja 0x42a930
lea ebp, [eax + 1]
mov byte [eax], bl
jmp 0x42a9f0
cmp ebx, 0x7ff
ja 0x42a960
cmp esi, 2
jb 0x42a960
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 2]
mov byte [eax + 1], bl
jmp 0x42a9f0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x42aa0a
cmp esi, 4
jb 0x42aa0a
movzx edi, word [edx + 2]
add edx, 4
mov dword [esp], edx
mov ecx, ebx
xor ecx, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, ecx
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea edx, [ebx + edi]
add edx, 0x2400
mov ebx, edx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, 0x3f
sub ecx, edi
not ecx
or ecx, edi
and cl, 0x3f
or cl, 0x80
lea ebp, [eax + 4]
mov byte [eax + 3], cl
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
add esi, eax
sub esi, ebp
mov edx, edi
mov eax, ebp
movzx edi, word [edx]
test di, di
je 0x42aa48
test esi, esi
jne 0x42a910
jmp 0x42aa48
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x42aa19
mov edx, edi
jmp 0x42a9f8
cmp esi, 3
jb 0x42aa44
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], bl
jmp 0x42a9f0
mov ebp, eax
jmp 0x42a9f0
mov byte [eax], 0
sub eax, dword [esp + 0x18]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42de68
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov dword [esp + 0x6c], ebx
not eax
shr eax, 0x1f
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x7c]
jmp dword [eax*4 + 0x44c2f0]

Function at 0x42e07d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], 0x700f0e0d
lea ecx, [esp + 0x28]
mov byte [ecx + 2], 0
mov word [ecx], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x3d
xor dl, byte [esp + ecx + 0x24]
add dl, 0xcf
mov byte [esp + ecx + 0x24], dl
inc ecx
cmp ecx, 7
jne 0x42e0a0
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x42e0f7
mov edx, dword [esp + 0x24]
xor esi, esi
mov ebp, dword [0x4510e8]
cmp dword [ebp + esi*8], 0x1b6183f2
je 0x42e0dd
inc esi
cmp ecx, esi
jne 0x42e0cc
jmp 0x42e0f7
mov ecx, dword [ebp + esi*8 + 4]
cmp ecx, edx
je 0x42e0f7
push eax
push 4
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x10
mov eax, dword [case.0x42a757.277]
nop
nop
nop
nop

Function at 0x42e151
Capabilities:
Encode data using xor

Disassembly:
push edi
call fcn.004088f0
add esp, 4
jmp case.0x42a757.230
Function at 0x43c810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00443c00
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d668]

Function at 0x43cab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00444430
add esp, 0x14
test eax, eax
js 0x43cbe6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004448e0
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43cb4a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43cb18
mov eax, 0xffffffff
jmp 0x43cb1f
lea eax, [eax*2 + 2]
push eax
call fcn.004088e0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00444fd0
add esp, 0x14
test eax, eax
jns 0x43cb4a
push esi
call fcn.004088f0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x700f0e0d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x3d
xor cl, byte [esp + ebx + 4]
add cl, 0xcf
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 7
jne 0x43cb70
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x43cbca
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43cbb0
inc edi
cmp ecx, edi
jne 0x43cba0
jmp 0x43cbca
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43cbca
push eax
push 4
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x10
test esi, esi
jne 0x43cbe8
lea eax, [esp + 4]
push eax
call fcn.004439c0
add esp, 4
test al, al
je 0x43cbe6
cmp dword [esp + 4], 1
je 0x43cbe8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e7a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0x292a2bf4
mov word [esp + 4], 0
mov ecx, 0x77
mov edx, 0x88
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x8b
mov ebx, ecx
and ebx, 0x44
or ebx, esi
xor bl, byte [esp + ecx - 0x77]
xor bl, 0xbb
add bl, 0xad
mov byte [esp + ecx - 0x77], bl
inc ecx
dec edx
cmp ecx, 0x7d
jne 0x43e7d0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x459108]
add esp, 8
pop esi
pop ebx
ret
Function at 0x43e890
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebp, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3d
xor cl, byte [esp + eax]
add cl, 0xcf
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43e8c0
mov ebx, dword [esp]
mov eax, dword [0x4510e4]
test eax, eax
je 0x43e926
xor ecx, ecx
mov edx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43e900
inc ecx
cmp eax, ecx
jne 0x43e8f0
jmp 0x43e926
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x43e926
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x1c
mov ebx, eax
mov dword [esp], 0xf332314c
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x8c
xor cl, byte [esp + eax]
add cl, 0x44
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43e940
cmp ebx, dword [esp]
jne 0x43ead5
push dword [esp + 0xc]
call fcn.0043e7a0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x3d
xor bl, byte [esp + edx]
add bl, 0xcf
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43e990
mov ebx, dword [esp]
mov edx, dword [0x4510e4]
test edx, edx
je 0x43ea10
mov dword [esp + 8], ecx
mov ecx, edi
mov edi, ebx
xor ebx, ebx
mov esi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x61813e67
je 0x43e9e4
inc ebx
cmp edx, ebx
jne 0x43e9d0
mov ebx, edi
mov edi, ecx
jmp 0x43ea10
mov edx, dword [esi + ebx*8 + 4]
mov ebx, edi
cmp edx, edi
mov edi, ecx
je 0x43ea10
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x4510ec]
mov esi, eax
call fcn.004414e0
add esp, 0x1c
mov ebx, eax
mov eax, esi
test ebx, ebx
js 0x43eacc
mov dword [esp + 8], edi
mov dword [esp], 0x19daddff
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, esp
mov edx, 0xb0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
lea ebx, [edx - 0x2629f900]
or ebx, esi
and esi, edx
not ebx
or ebx, esi
mov esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0x74
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xa9
jne 0x43ea40
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebx]
movzx edi, word [ebp + ebx]
test si, si
je 0x43eaa6
add ebx, 2
cmp si, di
je 0x43ea90
cmp si, di
je 0x43eab7
mov esi, dword [ecx]
test esi, esi
jne 0x43ea80
mov ebx, dword [esp + 0x10]
jmp 0x43eacc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebx, ebx
push eax
call fcn.0043e810
add esp, 4
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43eb10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43ebc0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ebea
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov ebx, eax
add bl, 0x3d
xor bl, byte [esp + eax]
add bl, 0xcf
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x43eb80
mov eax, dword [esp]
mov esi, dword [0x4510e4]
test esi, esi
je 0x43ebea
xor edi, edi
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43ebf3
inc edi
cmp esi, edi
jne 0x43ebb0
jmp 0x43ebea
mov dword [esp + 8], 0x97564940
mov byte [esp + 0xc], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0x6e
xor cl, byte [esp + eax + 8]
add cl, 0xda
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 5
jne 0x43ebd0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ebea
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x1c
jmp 0x43ebea

Function at 0x43ec20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43ecba
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x3d
xor bl, byte [esp + edx]
add bl, 0xcf
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43ec50
mov edx, dword [0x4510e4]
test edx, edx
je 0x43ecae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43ec90
inc edi
cmp edx, edi
jne 0x43ec80
jmp 0x43ecae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ecae
push eax
push 4
push edx
push dword [0x4510ec]
mov esi, ecx
call fcn.004414e0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43ef80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x3d
xor dl, byte [esp + eax]
add dl, 0xcf
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43efb0
test ebx, ebx
jne 0x43efcc
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x4510e4]
test ebp, ebp
je 0x43f024
xor edx, edx
mov esi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43f000
inc edx
cmp ebp, edx
jne 0x43eff0
jmp 0x43f024
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43f024
push ebx
push dword [esp + 0x2c]
push edi
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x441440
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44df44]

Function at 0x442200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
movzx eax, word [edi]
mov dword [esp + 8], 0x33329b85
mov word [esp + 0xc], 0
mov ecx, 0x8c
mov edx, 0x73
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x84]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x44
mov byte [esp + ecx - 0x84], bl
inc ecx
dec edx
cmp ecx, 0x92
jne 0x442230
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x44e300]
mov ecx, 0xb4edce77
xor ecx, dword [0x44e308]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax

Function at 0x4430f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x8f8e89f8
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
movzx esi, byte [esp + eax]
lea edx, [eax + 0xce91822]
xor edx, esi
mov esi, 0x3c
sub esi, edx
add edx, 0x83
and esi, 0x2d
and edx, 0xd2
sub edx, esi
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 7
jb case.default.0x443154
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44e8c8]
Function at 0x443a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443a30
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x443a4b
mov eax, 0xffffffff
jmp 0x443a4e
add eax, 0xa
push eax
call fcn.004088e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp], eax
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x443a91
add edi, 2
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x443a80
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 0xc], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xe], cx
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0x7c7d7e7f
mov word [esp + 8], 0
mov ecx, 0xaa5d26ff
mov esi, 0x5568b640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x55a2d905]
mov ebx, esi
xor ebx, eax
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, esi
mov ebp, edi
and ebp, 0x5568b645
mov edx, edi
and edx, 2
mov ebx, edi
or ebx, 0xfffffffd
inc ebx
imul ebx, ebp
or edi, 2
imul edi, edx
add ebx, eax
sub ebx, edi
add ebx, ecx
mov eax, ebx
and eax, 1
xor ebx, 1
lea eax, [ebx + eax*2]
mov byte [esp + ecx + 0x55a2d905], al
inc ecx
inc esi
cmp ecx, 0xaa5d2705
jne 0x443b20
mov esi, dword [esp + 4]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x443be3
xor edx, edx
mov edi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x443ba0
inc edx
cmp ecx, edx
jne 0x443b90
jmp 0x443be3
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x443be3
lea esi, [esp + 4]
lea edx, [esp + 0x14]
push 0
push 0
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x6c]
push 0
push esi
push edx
push dword [esp + 0x6c]
push dword [esp + 0x6c]
push 0x2c
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x38
mov esi, eax
push dword [esp]
call fcn.004088f0
add esp, 4
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x443c10
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x443c2b
mov eax, 0xffffffff
jmp 0x443c2e
add eax, 0xa
push eax
call fcn.004088e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp], eax
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x443c71
add ebx, 2
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x443c60
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 0xc], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xe], cx
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0x7c7d7e7f
mov word [esp + 8], 0
mov ecx, 0xaa5d26ff
mov esi, 0x5568b640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x55a2d905]
mov ebp, esi
xor ebp, eax
lea ebx, [ebp*2]
not ebx
add ebx, ebp
and ebx, esi
mov edi, ebx
and edi, 0x5568b645
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
or ebx, 2
imul ebx, edx
add ebp, eax
sub ebp, ebx
add ebp, ecx
mov eax, ebp
and eax, 1
xor ebp, 1
lea eax, [eax*2]
add eax, ebp
mov byte [esp + ecx + 0x55a2d905], al
inc ecx
inc esi
cmp ecx, 0xaa5d2705
jne 0x443d00
mov esi, dword [esp + 4]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x443dc5
xor edx, edx
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x443d90
inc edx
cmp ecx, edx
jne 0x443d80
jmp 0x443dc5
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443dc5
lea eax, [esp + 4]
lea edx, [esp + 0x14]
push dword [esp + 0x50]
push dword [esp + 0x50]
push eax
push edx
push dword [esp + 0x58]
push dword [esp + 0x58]
push 0x18
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x24
mov esi, eax
push dword [esp]
call fcn.004088f0
add esp, 4
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443e00
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x443e1b
mov eax, 0xffffffff
jmp 0x443e1e
add eax, 0xa
push eax
call fcn.004088e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443e61
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443e50
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x7c7d7e7f
mov word [esp + 0x2c], 0
mov ecx, 0xaa5d26ff
mov esi, 0x5568b640
nop
movzx eax, byte [esp + ecx + 0x55a2d929]
mov ebx, esi
xor ebx, eax
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, esi
mov edx, edi
and edx, 0x5568b645
mov ebx, edi
or ebx, 0xfffffffd
inc ebx
imul ebx, edx
mov edx, edi
and edx, 2
or edi, 2
imul edi, edx
add ebx, eax
sub ebx, edi
add ebx, ecx
mov eax, ebx
and eax, 1
xor ebx, 1
lea eax, [ebx + eax*2]
mov byte [esp + ecx + 0x55a2d929], al
inc ecx
inc esi
cmp ecx, 0xaa5d2705
jne 0x443ed0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x443f75
xor edx, edx
mov edi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x443f50
inc edx
cmp ecx, edx
jne 0x443f40
jmp 0x443f75
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x443f75
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.004088f0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x443f8e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x7c7d7e7f
mov word [esp + 4], 0
mov eax, 0xaa5d26ff
mov edx, 0x5568b640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x55a2d901]
mov ecx, edx
xor ecx, ebx
lea esi, [ecx + ecx]
not esi
add esi, ecx
and esi, edx
mov edi, esi
and edi, 0x5568b645
mov ecx, esi
or ecx, 0xfffffffd
inc ecx
imul ecx, edi
mov edi, esi
and edi, 2
or esi, 2
imul esi, edi
add ecx, ebx
sub ecx, esi
add ecx, eax
mov esi, ecx
and esi, 1
xor ecx, 1
lea ecx, [ecx + esi*2]
mov byte [esp + eax + 0x55a2d901], cl
inc eax
inc edx
cmp eax, 0xaa5d2705
jne 0x443fd0
mov eax, dword [esp]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x444078
xor edx, edx
mov esi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9c142cda
je 0x444050
inc edx
cmp ecx, edx
jne 0x444040
jmp 0x444078
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x444078
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x444085
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x444094
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret