joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov edi, dword [esp + 0x30]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43f2bc
push 0xf8eb88df
push dword [0x452158]
call fcn.00444690
add esp, 8
test eax, eax
je 0x43f281
mov ecx, dword [esi]
test ecx, ecx
je 0x43f2b9
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43f295
cmp dword [esp], 0
je 0x43f295
mov dword [esi + 4], 3
jmp 0x43f2b9
mov ecx, edi
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43f387
lea eax, [esp + 0xc]
push eax
call fcn.00444eb0
add esp, 4
test al, al
je 0x43f2b9
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43f2b6
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, edi
cmp eax, 2
jne 0x43f387
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov esi, 0x1e0e2d1
mov ebp, 0xaa1f1d2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x1e0e2d1]
mov edx, ebp
and edx, 0xaa1f0c21
mov eax, esi
and eax, 0x1c0029e
or eax, edx
xor eax, ebx
mov edx, eax
xor edx, 0xfe3fec61
mov ebx, eax
xor ebx, 0x535b8274
and ebx, edx
mov edx, ebx
and edx, 0xfd
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, edx
xor eax, 0x8b
add eax, ebx
add eax, edi
inc al
mov byte [esp + esi - 0x1e0e2d1], al
inc esi
dec ebp
cmp esi, 0x1e0e2d7
jne 0x43f2f0
mov eax, dword [esp]
mov edx, dword [0x452164]
test edx, edx
je 0x43f45a
xor esi, esi
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43f430
inc esi
cmp edx, esi
jne 0x43f370
jmp 0x43f45a
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov esi, 0x1e0e2d1
mov edx, 0xaa1f1d2e
nop
movzx edi, byte [esp + esi - 0x1e0e2d1]
mov ebx, edx
and ebx, 0xaa1f0c21
mov eax, esi
and eax, 0x1c0029e
or eax, ebx
xor eax, edi
mov edi, eax
xor edi, 0xfe3fec61
mov ebx, eax
xor ebx, 0x535b8274
and ebx, edi
mov edi, ebx
and edi, 0xfd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edi
xor eax, 0x8b
add eax, ebx
add eax, ebp
inc al
mov byte [esp + esi - 0x1e0e2d1], al
inc esi
dec edx
cmp esi, 0x1e0e2d7
jne 0x43f3a0
mov eax, dword [esp]
mov edx, dword [0x452164]
test edx, edx
je 0x43f45a
xor esi, esi
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43f430
inc esi
cmp edx, esi
jne 0x43f420
jmp 0x43f45a
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f45a
push ecx
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push dword [0x45216c]
push edx
call fcn.00442160
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43f7d9
lea edi, [esp + 0x18]
mov eax, dword [esi + 4]
test eax, eax
je 0x43f7ea
cmp eax, 2
je 0x43f860
jmp 0x43f88d
push 0xf8eb88df
push dword [0x452158]
call fcn.00444690
add esp, 8
test eax, eax
je 0x43f82b
mov ecx, dword [esi]
test ecx, ecx
je 0x43f858
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43f834
cmp dword [esp + 4], 0
je 0x43f834
mov dword [esi + 4], 3
jmp 0x43f858
mov dword [esi + 4], 1
jmp 0x43f88d
lea eax, [esp + 0x14]
push eax
call fcn.00444eb0
add esp, 4
test al, al
je 0x43f858
mov eax, dword [esp + 0x14]
mov ecx, 2
cmp eax, 3
je 0x43f855
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43f88d
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x45a180]
call fcn.00444690
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f967
mov dword [esp + 0x10], edi
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc0c7c6c5
mov word [esp + 8], 0
mov esi, 0x1e0e2d1
mov edx, 0xaa1f1d2e
movzx ecx, byte [esp + esi - 0x1e0e2cd]
mov ebx, edx
and ebx, 0xaa1f0c21
mov eax, esi
and eax, 0x1c0029e
or eax, ebx
xor eax, ecx
mov ecx, eax
xor ecx, 0xfe3fec61
mov ebx, eax
xor ebx, 0x535b8274
and ebx, ecx
mov ecx, ebx
and ecx, 0xfd
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, ecx
xor eax, 0x8b
add eax, ebx
add eax, edi
inc al
mov byte [esp + esi - 0x1e0e2cd], al
inc esi
dec edx
cmp esi, 0x1e0e2d7
jne 0x43f8b0
mov eax, dword [esp + 4]
mov edx, dword [0x452164]
test edx, edx
je 0x43f967
xor esi, esi
mov ebx, dword [0x452168]
mov ecx, dword [esp + 0x10]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43f940
inc esi
cmp edx, esi
jne 0x43f930
jmp 0x43f967
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f967
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x1c]
push 5
push dword [0x45216c]
push edx
call fcn.00442160
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4420b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x45015c]
Function at 0x4432d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x443342
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x44346e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44346e
mov dword [esp], 0xc0c7c6c5
mov dword [esp + 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd1
xor cl, byte [esp + eax]
add cl, 0xeb
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x443360
mov eax, dword [esp]
mov ecx, dword [0x452164]
test ecx, ecx
je 0x4433d2
xor edx, edx
mov edi, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x7789b0cb
je 0x4433a4
inc edx
cmp ecx, edx
jne 0x443390
mov edi, dword [esp + 0x24]
jmp 0x4433d2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x4433d2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x45216c]
push ecx
call fcn.00442160
add esp, 0x28
test eax, eax
js 0x44346e
push 0x1e03da9a
push dword [0x45a180]
call fcn.00444690
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0xc0c7c6c5
mov dword [esp + 4], 0
xor edx, edx
mov ebx, edx
add bl, 0xd1
xor bl, byte [esp + edx]
add bl, 0xeb
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x443410
mov edx, dword [0x452164]
test edx, edx
je 0x44346e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x443450
inc edi
cmp edx, edi
jne 0x443440
jmp 0x44346e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44346e
push ecx
push 1
push dword [0x45216c]
push edx
mov esi, eax
call fcn.00442160
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4440f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 4], 0x17161948
mov dword [esp + 8], 0
mov eax, 0x3b783c86
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3b783c82]
mov ecx, eax
and ecx, edx
mov edi, ecx
and edi, 2
mov ebx, ecx
or ebx, 0xfffffffd
inc ebx
mov esi, ecx
and esi, 0xffffff8d
imul esi, ebx
or ecx, 2
imul ecx, edi
add esi, edx
mov edx, esi
sub edx, ecx
add edx, eax
mov edi, edx
and edi, 0x61
mov ebx, edx
and ebx, 0x9e
xor edx, 0x61
add edx, edi
add edx, esi
sub edx, ecx
sub edx, ebx
add edx, eax
inc dl
mov byte [esp + eax - 0x3b783c82], dl
inc eax
cmp eax, 0x3b783c8e
jne 0x444110
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x450b84]

Function at 0x4445c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x18]
mov dword [esp], 0x514e4f7c
mov word [esp + 4], 0
mov eax, 0xd
mov edx, 0x72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xd]
mov ebx, ecx
xor ebx, eax
or ebx, edx
add bl, bl
add bl, cl
movzx ecx, bl
add ecx, eax
add cl, 0xc1
mov byte [esp + eax - 0xd], cl
inc eax
dec edx
cmp eax, 0x13
jne case.default.0x44461f
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor ecx, ecx
test edi, edi
sete cl
jmp dword [ecx*4 + 0x450c84]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ecx, ecx
cmp esi, edx
setne cl
jmp dword [ecx*4 + 0x450c8c]
mov eax, dword [esi + 0x28]
xor ecx, ecx
jmp dword [ecx*4 + 0x450c9c]
mov esi, dword [esi]
xor ecx, ecx
cmp esi, edx
setne cl
jmp dword [ecx*4 + 0x450c8c]
xor ecx, ecx
cmp dword [esi + 0x18], edi
sete cl
jmp dword [ecx*4 + 0x450c94]
mov ecx, 1
jmp dword [ecx*4 + 0x450c9c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
inc esi
inc esp
add byte [edi + 0x46], dh
inc esp
add byte [ebp + 0x46], bh
inc esp
add byte [esi + eax*2 + 0x44], bl
add byte [ebx + 0x46], ch
inc esp
add byte [eax + 0x46], al
inc esp
add byte [ebp + 0x46], bh
inc esp
add byte [esi + eax*2 + 0x44], cl
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ebp + 0x46], bh
inc esp
add dh, dh
Function at 0x445090
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4450b0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4450cb
mov eax, 0xffffffff
jmp 0x4450ce
add eax, 0xa
push eax
call fcn.0040cb10
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x445111
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445100
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa9
xor dl, byte [esp + ecx]
add dl, 0xb3
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x445180
mov esi, dword [esp]
mov ecx, dword [0x452164]
test ecx, ecx
je 0x4451f1
xor edx, edx
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x4451c0
inc edx
cmp ecx, edx
jne 0x4451b0
jmp 0x4451f1
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4451f1
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x45216c]
push ecx
mov edi, eax
call fcn.00442160
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cb20
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x445230
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44524b
mov eax, 0xffffffff
jmp 0x44524e
add eax, 0xa
push eax
call fcn.0040cb10
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x445291
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445280
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xe0e7e6e5
mov word [esp + 0x24], 0
xor ecx, ecx
mov edx, ecx
add dl, 0xa9
xor dl, byte [esp + ecx + 0x20]
add dl, 0xb3
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 6
jne 0x4452f0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x452164]
test ecx, ecx
je 0x445363
xor edx, edx
mov ebx, dword [0x452168]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x87573896
je 0x44533a
mov edi, edx
xor edi, 1
and edx, 1
lea edx, [edi + edx*2]
cmp edx, ecx
jb 0x445320
jmp 0x445363
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x445363
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x45216c]
push ecx
mov ebx, eax
call fcn.00442160
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040cb20
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x445379
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x445390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa9
xor cl, byte [esp + eax]
add cl, 0xb3
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x4453c0
mov eax, dword [esp]
mov edx, dword [0x452164]
test edx, edx
je 0x445428
xor ebx, ebx
mov ecx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa70a987f
je 0x445400
inc ebx
cmp edx, ebx
jne 0x4453f0
jmp 0x445428
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x445428
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x45216c]
push edx
call fcn.00442160
add esp, 0x20
test edi, edi
je 0x445432
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x44543e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xa9
xor bl, byte [esp + eax]
add bl, 0xb3
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x445480
mov eax, dword [esp]
mov ebx, dword [0x452164]
test ebx, ebx
je 0x4454ee
xor ebp, ebp
mov edi, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xd41f89d1
je 0x4454c0
inc ebp
cmp ebx, ebp
jne 0x4454b0
jmp 0x4454ee
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4454ee
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x45216c]
push ebx
call fcn.00442160
add esp, 0x30
cmp eax, 0x103
jne 0x445579
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa9
xor cl, byte [esp + eax]
add cl, 0xb3
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x445510
mov eax, dword [esp]
mov ecx, dword [0x452164]
test ecx, ecx
je 0x445571
xor edx, edx
mov edi, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x445550
inc edx
cmp ecx, edx
jne 0x445540
jmp 0x445571
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x445571
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x45216c]
push ecx
call fcn.00442160
add esp, 0x18
test eax, eax
js 0x445579
mov eax, dword [esp + 8]
test esi, esi
je 0x44558c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44558a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4456e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x445700
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa9
xor cl, byte [esp + eax]
add cl, 0xb3
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x445780
mov eax, dword [esp]
mov edi, dword [0x452164]
test edi, edi
je 0x4457e5
xor ebx, ebx
mov ebp, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x9ecf05eb
je 0x4457c1
inc ebx
cmp edi, ebx
jne 0x4457b0
jmp 0x4457e5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x4457e5
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push dword [0x45216c]
push edi
call fcn.00442160
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push eax
push ebx
push edi
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x410f32
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x410f32
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x410f49
push ebx
push str.SSLex0108e:_Resource_not_found___s
push 0x24
mov ecx, esi
call fcn.0040f720
mov eax, esi
pop edi
pop esi
pop ebx
ret 0xc
push ebx
push eax
mov ecx, esi
call fcn.00410f90
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4129e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x441a08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0040fc80
mov ecx, dword [str.SSCO]
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x5c], ecx
mov eax, dword [esi + 0xc]
xor ebx, ebx
sub eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi], 0x445328
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x14], edx
je 0x412a47
dec eax
je 0x412a47
dec eax
jne 0x412a4e
mov eax, 0x44e770
jmp 0x412a52
mov eax, 0x44e76c
jmp 0x412a52
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push eax
push edi
call fcn.004293d0
add esp, 8
cmp eax, ebx
mov dword [esi + 0x64], eax
jne 0x412a7f
mov eax, dword [0x454454]
lea ecx, [esi + 4]
push eax
push edi
push str.SSLex0101e:_Error_opening_file___s___ld
push 1
call fcn.0040f8b0
jmp 0x412ae2
cmp ebp, 0xffffffff
jne 0x412aaa
push 2
push ebx
push eax
call fcn.0042898a
mov ecx, dword [esi + 0x64]
push ecx
call fcn.00429138
mov edx, dword [esi + 0x64]
push ebx
push ebx
push edx
mov dword [esi + 0x1c], eax
call fcn.0042898a
add esp, 0x1c
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x1c]
cmp eax, ebx
jne 0x412ac3
push edi
push str.SSLex0102e:_Invalid_file_length_or_read_error___s___ld
push 2
lea ecx, [esi + 4]
call fcn.0040f720
jmp 0x412ae2
push eax
call fcn.00427cde
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x1c]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00429050
add esp, 0x14
mov dword [esi + 0x34], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x415330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x14]
push edi
xor ebx, ebx
push eax
push ecx
mov dword [esi + 4], ebx
push ebp
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], 0x445384
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x41537f
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41537f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x41539c
mov edx, dword [esp + 0x18]
lea ecx, [esi + 4]
push edx
push str.SSYacc0115e:_Resource_not_found___s
push 0x25
call fcn.0040f720
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
call fcn.00414c20
mov ecx, dword [esp + 0x20]
push edi
push ecx
push eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
call fcn.004111f0
mov edx, dword [esp + 0x28]
add esp, 0x10
mov ecx, esi
push edx
push edi
call fcn.004153f0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
call fcn.00414e20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc