joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
push eax
mov dword [ebp - 0x24], esp
sub esp, 0x70
mov edi, esp
sub esp, 0x28
mov dword [ebp - 0x14], esp
sub esp, 0xc
mov dword [ebp - 0x1c], esp
sub esp, 0x40
mov dword [ebp - 0x20], esp
sub esp, 0x80
mov esi, esp
mov eax, dword [0x44ba84]
mov dword [ebp - 0xa8], 0x898a938c
mov byte [ebp - 0xa4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x63
xor dl, byte [ebp + ecx - 0xa8]
add dl, 0x11
mov byte [ebp + ecx - 0xa8], dl
inc ecx
cmp ecx, 5
jne 0x40a010
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x238], 0x63f161f7
mov dword [ebp - 0x234], 0x67c965b6
mov dword [ebp - 0x230], 0x5b88598b
mov dword [ebp - 0x22c], 0x5ffa5d82
mov dword [ebp - 0x228], 0x53ce51cc
mov word [ebp - 0x224], 0x5554
mov dword [ebp - 0x222], 0
mov byte [ebp - 0x21e], 0
xor edx, edx
mov ebx, edx
add bl, 0x18
xor bl, byte [ebp + edx - 0x238]
add bl, 0x88
mov byte [ebp + edx - 0x238], bl
inc edx
cmp edx, 0x1b
jne 0x40a080
lea edx, [ebp - 0x238]
push ecx
push 0
push edx
call eax
mov ecx, 0x44ba88
push eax
call fcn.0043d190
movzx eax, al
mov eax, dword [eax*4 + 0x4459a0]
mov ecx, 0x17d2996c
xor ecx, dword [0x4459a8]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x418a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + esi + 2], 0
lea esi, [esi + 2]
jne 0x418a50
mov edi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x418a70
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x418a90
mov eax, 0xffffffff
jmp 0x418a99
add eax, esi
lea eax, [eax*2 + 4]
push eax
call fcn.004083e0
add esp, 4
mov ebp, eax
movzx ecx, word [edi]
test cx, cx
je 0x418ad1
add edi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418ac0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebx]
test cx, cx
je 0x418b01
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418af0
mov word [eax], 0
lea edi, [esp + 0x10]
push 0x60
push 3
push 0x120089
push edi
push ebp
call fcn.00440c90
add esp, 0x14
mov ebx, eax
mov dword [esp + 8], 0x94a4bb1
mov word [esp + 0xc], 0
mov eax, 0x77f2bf13
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x77f2bf0b]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xa1
mov byte [esp + eax - 0x77f2bf0b], cl
inc eax
cmp eax, 0x77f2bf19
jne 0x418b40
xor eax, eax
cmp ebx, dword [esp + 8]
sete al
mov dword [esp + 0x14], ebp
jmp dword [eax*4 + 0x446248]
Function at 0x41d720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], 0xc3a8c1ef
mov dword [esp + 0xc], 0xc7a9c557
mov dword [esp + 0x10], 0xcbcac9a6
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov esi, eax
or esi, 0xc1eee850
lea ecx, [esi + esi]
not ecx
add ecx, eax
add ecx, 0xc1eee850
xor ecx, esi
and ecx, edx
xor ecx, esi
add cl, 0x70
mov byte [esp + eax + 8], cl
mov edx, eax
xor edx, 0xfffffffe
mov ecx, eax
or ecx, 1
and ecx, edx
mov esi, ecx
and esi, 2
mov edx, ecx
or ecx, 2
imul ecx, esi
xor esi, 2
and edx, 0xd
imul edx, esi
xor eax, 1
add eax, ecx
add eax, edx
cmp eax, 0xd
jb 0x41d760
mov dword [esp + 0x28], 0x118a1f84
mov dword [esp + 0x2c], 0x15821384
mov dword [esp + 0x30], 0x947175e
mov dword [esp + 0x34], 0xd960b59
mov dword [esp + 0x38], 0x16b0f9d
mov dword [esp + 0x3c], 0x59e0363
mov dword [esp + 0x40], 0x3997079c
mov dword [esp + 0x44], 0x3dae3bad
mov dword [esp + 0x48], 0x313e3f76
mov word [esp + 0x4c], 0
mov byte [esp + 0x4e], 0
mov eax, 0x85
mov ecx, 0x7a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x5a
mov edx, eax
and edx, 0xa5
or edx, esi
xor dl, byte [esp + eax - 0x5d]
xor dl, 0x5a
add dl, 0x67
mov byte [esp + eax - 0x5d], dl
inc eax
dec ecx
cmp eax, 0xac
jne 0x41d820
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x14c]
test cx, cx
je 0x41d871
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d860
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41d8a1
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d890
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41d8d1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d8c0
mov word [eax], 0
mov esi, dword [edi]
mov dword [esp + 0x28], 0x555858e6
mov byte [esp + 0x2c], 0xf0
mov dword [esp + 0x2d], 0
mov dword [esp + 0x30], 0
mov eax, 0x376d35d5
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x376d35ad]
xor ecx, eax
mov edx, ecx
not edx
and ecx, 0xd6
and edx, 0x29
sub ecx, edx
mov byte [esp + eax - 0x376d35ad], cl
inc eax
cmp eax, 0x376d35e1
jne 0x41d900
movzx eax, byte [esp + 0x28]
test al, al
je 0x41d94b
lea ecx, [esp + 0x29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d940
mov byte [esi], 0
lea eax, [esp + 0x134]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.0040b1f0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x446a00]
mov ecx, 0x4c1f8352
xor ecx, dword [0x446a08]
add eax, ecx
inc eax
jmp eax
Function at 0x421510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x421520
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44cda8]
mov dword [esp + 8], 0x63222103
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov ebx, ecx
or ebx, 0x8c525878
xor ebx, edx
mov edx, ebx
and edx, 0x27
xor ebx, 0x426445a7
lea edx, [ebx + edx*2]
and ebx, 1
xor edx, 1
lea edx, [edx + ebx*2]
mov byte [esp + ecx + 8], dl
add ecx, 0x8d83507
mov edx, ecx
xor edx, 0x8d83506
and ecx, 9
add ecx, ecx
sub ecx, edx
cmp ecx, 4
jb case.default.0x42159f
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446d24]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jns 0x4215b5
mov eax, 0xffffffff
jmp 0x4215b8
lea eax, [ebx + ebx]
push eax
call fcn.004083e0
add esp, 4
push esi
mov esi, eax
push ebx
push eax
push ebp
push edi
push 0
call dword [0x44cda8]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d2c]
xor ebx, ebx
jmp dword [0x446d34]
push esi
call fcn.004083f0
add esp, 4
xor ebx, ebx
jmp case.0x42159f.1
lea edi, [esp + 8]
push edi
push esi
call fcn.00440e10
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d3c]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
push eax
sub esp, 8
mov dword [ebp - 0x84], esp
sub esp, 0x20
mov eax, esp
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x48], eax
push eax
mov dword [ebp - 0x54], esp
push eax
mov dword [ebp - 0x78], esp
sub esp, 0x1c
mov dword [ebp - 0x60], esp
sub esp, 8
mov dword [ebp - 0xa8], esp
sub esp, 8
mov dword [ebp - 0x58], esp
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], eax
sub esp, 0x34
mov eax, esp
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xb4], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x38], 0x1c5072b
mov dword [ebp - 0x34], 0xdf203f0
mov dword [ebp - 0x30], 0x9ed0fc0
mov dword [ebp - 0x2c], 0x15e90bf4
mov dword [ebp - 0x28], 0x1116173b
mov eax, 0x507f1f41
mov ecx, 0xaf80e0be
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + eax - 0x507f1f79]
mov edi, eax
xor edi, edx
lea esi, [edi + edi]
not esi
add esi, edi
and esi, eax
mov ebx, esi
and ebx, 2
mov edi, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and edi, 0x507f1f7d
imul edi, ebx
add esi, edi
mov ebx, esi
not ebx
and ebx, eax
and esi, ecx
sub ebx, esi
add ebx, edx
mov edx, 1
sub edx, ebx
or edx, 0xfe
or ebx, 1
sub ebx, edx
add bl, 0xb9
mov byte [ebp + eax - 0x507f1f79], bl
inc eax
dec ecx
cmp eax, 0x507f1f55
jne 0x42a380
lea esi, [ebp - 0x116]
lea eax, [ebp - 0x38]
mov edi, esi
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x102]
lea eax, [ebp - 0x24]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [ebp - 0x8c]
push edi
push 0
push 0
push 9
push esi
push 0
call dword [0x44cda8]
mov dword [ebp - 0x38], 0x94a4b91
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x93
xor cl, byte [ebp + ebx - 0x38]
add cl, 0x21
mov byte [ebp + ebx - 0x38], cl
inc ebx
cmp ebx, 4
jne case.default.0x42a44e
xor ecx, ecx
cmp eax, dword [ebp - 0x38]
setne cl
jmp dword [ecx*4 + 0x447e70]
mov ebx, dword [ebp - 0x8c]
test ebx, ebx
jns 0x42a478
mov eax, 0xffffffff
jmp 0x42a47b
xor eax, eax
jmp dword [0x447e80]
lea eax, [ebx + ebx]
push eax
call fcn.004083e0
add esp, 4
push edi
push ebx
mov dword [ebp - 0x44], eax
push eax
push 9
push esi
push 0
call dword [0x44cda8]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447e88]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00440c90
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449290]

Function at 0x439fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.004412c0
add esp, 0x14
test eax, eax
js 0x43a133
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00441640
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43a06e
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43a03f
mov eax, 0xffffffff
jmp 0x43a041
add eax, eax
push eax
call fcn.004083e0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00441bf0
add esp, 0x14
test eax, eax
js 0x43a065
mov esi, edi
jmp 0x43a06e
push edi
call fcn.004083f0
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp], 0x282b2a25
mov ecx, 0xd1271dc7
mov edx, 0x2ed8e238
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x2ed8e239]
mov ebp, edx
and ebp, 0x20408013
mov ebx, ecx
and ebx, 0x81211c8c
or ebx, ebp
xor ebx, edi
xor ebx, 0x8fb97eac
inc ebx
mov edi, ebx
and edi, 0x64
add edi, edi
xor ebx, 0x1b
sub ebx, edi
add bl, 2
mov byte [esp + ecx + 0x2ed8e239], bl
inc ecx
dec edx
cmp ecx, 0xd1271dcb
jne 0x43a090
mov ecx, dword [0x44cdac]
test ecx, ecx
je 0x43a11a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44cdb0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43a100
inc edi
cmp ecx, edi
jne 0x43a0f0
jmp 0x43a11a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43a11a
push eax
push 4
push ecx
push dword [0x44cdb4]
call fcn.0043e5b0
add esp, 0x10
test esi, esi
jne 0x43a135
mov eax, esp
push eax
call fcn.00440ab0
add esp, 4
test al, al
je 0x43a133
cmp dword [esp], 1
je 0x43a135
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bda0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4495a4]
Function at 0x43c0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43c1a0
xor eax, eax
cmp dword [ecx], 0
jne 0x43c1e4
mov edx, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x282b2a25
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, edi
not ebp
mov ebx, esi
xor ebx, 0xd1271dc7
add ebx, eax
and ebp, 0x68
xor edi, 0x89eb3f68
or edi, ebp
xor ebx, 0x89eb3f68
mov ebp, edi
and ebp, ebx
add ebx, edi
add ebp, ebp
sub ebx, ebp
add bl, 0x1d
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 4
jne 0x43c130
mov eax, dword [esp]
mov esi, dword [0x44cdac]
test esi, esi
je 0x43c1e4
xor edi, edi
mov ebx, dword [0x44cdb0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43c1ee
inc edi
cmp esi, edi
jne 0x43c190
jmp 0x43c1e4
mov dword [esp + 4], 0x3c2c1c8
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
or cl, 0xd0
xor cl, byte [esp + eax + 4]
add cl, 0xf0
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x43c1c0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c1e4
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44cdb4]
call fcn.0043e5b0
add esp, 0x1c
jmp 0x43c1e4

Function at 0x43c220
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c2db
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0x282b2a25
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, edi
not ebp
mov ebx, esi
xor ebx, 0xd1271dc7
add ebx, edx
and ebp, 0x68
xor edi, 0x89eb3f68
or edi, ebp
xor ebx, 0x89eb3f68
mov ebp, edi
and ebp, ebx
add ebx, edi
add ebp, ebp
sub ebx, ebp
add bl, 0x1d
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 4
jne 0x43c240
mov edx, dword [0x44cdac]
test edx, edx
je 0x43c2ce
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44cdb0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43c2b0
inc edi
cmp edx, edi
jne 0x43c2a0
jmp 0x43c2ce
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c2ce
push eax
push 4
push edx
push dword [0x44cdb4]
mov esi, ecx
call fcn.0043e5b0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x282b2a25
xor eax, eax
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp]
mov edi, esi
not edi
mov edx, ebp
xor edx, 0xd1271dc7
add edx, eax
and edi, 0x68
xor esi, 0x89eb3f68
or esi, edi
xor edx, 0x89eb3f68
mov edi, esi
and edi, edx
add edx, esi
add edi, edi
sub edx, edi
add dl, 0x1d
mov byte [esp + ebp], dl
inc ebp
add eax, 2
cmp ebp, 4
jne 0x43c570
test ebx, ebx
jne 0x43c5b4
lea ebx, [esp + 4]
mov eax, dword [esp]
mov edx, dword [0x44cdac]
test edx, edx
je 0x43c608
xor esi, esi
mov ebp, dword [0x44cdb0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + esi*8], 0xe6c7f7c6
je 0x43c5e1
inc esi
cmp edx, esi
jne 0x43c5d0
jmp 0x43c608
mov edx, dword [ebp + esi*8 + 4]
cmp edx, eax
je 0x43c608
push ebx
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
push 0x14
push edx
push dword [0x44cdb4]
call fcn.0043e5b0
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e520
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x4499f8]

Function at 0x440200
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x37363908
mov byte [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov ebx, eax
and ebx, 0xc
mov esi, edx
xor esi, 0x6eb396f6
add esi, ebx
xor esi, edi
add esi, 0xd67e0d31
mov edi, esi
xor edi, 0x7e
mov ebx, esi
or ebx, 1
and ebx, edi
xor esi, 1
lea ebx, [esi + ebx*2]
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 5
jne case.default.0x440266
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a550]

Function at 0x4402e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0xf0ee7d5
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + 0xc2]
mov esi, 0x1d
sub esi, ecx
and esi, 0x1a
and edx, 0x85
or edx, esi
xor dl, byte [esp + ecx]
xor dl, 0x5a
add dl, 0x36
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb case.default.0x44033c
xor ecx, ecx
cmp dword [esp], eax
setne cl
jmp dword [ecx*4 + 0x44a570]
Function at 0x440b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440b20
mov ecx, eax
sar ecx, 1
and eax, 8
xor ecx, 4
lea edi, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x440b46
mov eax, 0xffffffff
jmp 0x440b4d
lea eax, [edi*2 + 2]
push eax
call fcn.004083e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440b91
add esi, 2
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440b80
mov word [ecx], 0
lea ecx, [edi + edi]
mov word [esp + 8], cx
and edi, 1
xor ecx, 2
lea ecx, [ecx + edi*4]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x68
xor dl, byte [esp + ecx]
add dl, 0xf8
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x440bf0
mov esi, dword [esp]
mov ecx, dword [0x44cdac]
test ecx, ecx
je 0x440c6f
xor edx, edx
mov edi, dword [0x44cdb0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440c30
inc edx
cmp ecx, edx
jne 0x440c20
jmp 0x440c6f
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x440c6f
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44cdb4]
mov edi, eax
call fcn.0043e5b0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004083f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440cb0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x440ccb
mov eax, 0xffffffff
jmp 0x440cce
add eax, 0xa
push eax
call fcn.004083e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440d11
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440d00
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor ecx, ecx
mov edx, ecx
add dl, 0x68
xor dl, byte [esp + ecx]
add dl, 0xf8
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x440d70
mov esi, dword [esp]
mov ecx, dword [0x44cdac]
test ecx, ecx
je 0x440dee
xor edx, edx
mov ebx, dword [0x44cdb0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440dba
mov ebp, edx
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
cmp edx, ecx
jb 0x440da0
jmp 0x440dee
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440dee
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44cdb4]
mov edi, eax
call fcn.0043e5b0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004083f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret