joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x17d719c5
mov dword [esp + 8], 0x13821584
mov dword [esp + 0xc], 0xfef11ec
mov dword [esp + 0x10], 0xbeb0d80
mov dword [esp + 0x14], 0x7e209d5
mov dword [esp + 0x18], 0x39a05e8
mov dword [esp + 0x1c], 0x3fac018d
mov dword [esp + 0x20], 0x3ba73da0
mov dword [esp + 0x24], 0x37a839b6
mov dword [esp + 0x28], 0x33bc35ad
mov dword [esp + 0x2c], 0x2fca31ac
mov dword [esp + 0x30], 0x2ba42ddc
mov dword [esp + 0x34], 0x27bc29bb
mov dword [esp + 0x38], 0x23b625bd
mov dword [esp + 0x3c], 0xdf5121bd
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0xdddc
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 4]
mov esi, edx
xor esi, 0x501f15d3
mov ebx, ecx
and ebx, 0x26
add esi, ebx
add esi, 0xfac0d2f3
xor esi, edi
mov edi, esi
and edi, 0x425f8bdf
xor edi, 0x765f8bdf
and esi, 0x8806420
sub esi, edi
lea ebx, [esi + esi]
and ebx, 2
mov edi, ebx
and edi, esi
or ebx, esi
xor ebx, 1
add ebx, edi
mov byte [esp + edx + 4], bl
inc edx
add ecx, 2
cmp edx, 0x40
jne 0x4235e0
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov ecx, 0xf
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44d2fc]
mov dword [esp + 0x44], eax
mov dword [esp + 4], 0x17d6c9e7
mov dword [esp + 8], 0
xor edi, edi
xor ebp, ebp
movzx eax, byte [esp + ebp + 4]
mov esi, edi
and esi, 0xc
mov edx, ebp
xor edx, 0x6a4a134e
add edx, esi
mov ebx, edx
and ebx, eax
mov ecx, ebx
and ecx, 0x5d
mov esi, ebx
or esi, 0xfffffffd
inc esi
imul esi, ecx
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
sub esi, ebx
add edx, eax
lea eax, [esi + edx]
add eax, 0xec8d9f79
mov edx, eax
xor edx, 0xfe
or eax, 1
and edx, eax
add edx, eax
mov byte [esp + ebp + 4], dl
inc ebp
add edi, 2
cmp ebp, 8
jne case.default.0x4236e8
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 0x44], eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44790c]
Function at 0x4237d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x21f0
call fcn.00409690
push eax
sub esp, 0x10
mov ebx, esp
sub esp, 0x28
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x1dfc], 0x116c1f70
mov dword [ebp - 0x1df8], 0x156b1357
mov dword [ebp - 0x1df4], 0x963176f
mov dword [ebp - 0x1df0], 0xd780b7c
mov dword [ebp - 0x1dec], 0x1620f67
mov dword [ebp - 0x1de8], 0x5770377
mov dword [ebp - 0x1de4], 0x39740743
mov word [ebp - 0x1de0], 0x3b38
mov dword [ebp - 0x1dde], 0
mov word [ebp - 0x1dda], 0
mov eax, 0xe8279d85
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax + 0x17d8447f]
xor ecx, eax
mov esi, ecx
xor esi, 0x88c61399
mov edx, ecx
or edx, 0x60218c66
and edx, esi
mov edi, ecx
and edi, 2
mov esi, edx
or edx, 2
imul edx, edi
xor edi, 2
and esi, 0xfd
imul esi, edi
xor ecx, 0x66
add ecx, esi
add ecx, edx
inc cl
mov byte [ebp + eax + 0x17d8447f], cl
inc eax
cmp eax, 0xe8279da9
jne 0x423860
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x1dfc]
push 0
push 0
push 0x20019
push eax
mov dword [ebp - 0x10], ecx
push ecx
call fcn.00440450
add esp, 0x14
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x447924]
Function at 0x425140
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
mov dword [esp + 4], 0
mov dword [esp], 0
mov edi, 0x20219
mov ecx, 1
xor ebp, ebp
jmp dword [ecx*4 + 0x447f10]
Function at 0x427f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov dword [esp], 0x9f5f99bd
mov dword [esp + 4], 0xa3529d6c
mov dword [esp + 8], 0xa747a164
mov dword [esp + 0xc], 0xab4ba550
mov dword [esp + 0x10], 0xafaea98d
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
mov ecx, 0x2931325a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x2931325a]
xor edx, ecx
add edx, 0x320a043d
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx - 0x2931325a], dl
inc ecx
cmp ecx, 0x29313272
jne 0x427fa0
lea esi, [esp + 0xe4]
mov edx, esp
mov edi, esi
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xf8]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x54]
push edi
push 0
push 0
push 9
push esi
push 0
call dword [0x44d2fc]
mov dword [esp], 0x692a2b01
mov esi, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ebx]
mov edx, ebx
xor edx, 0x8d968f7
mov ecx, esi
sub ecx, edx
mov edx, ecx
or edx, ebp
and ecx, ebp
not edx
or edx, ecx
add dl, 0x2d
mov byte [esp + ebx], dl
inc ebx
add esi, 0xfffffffe
cmp ebx, 4
jne case.default.0x428053
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448200]
lea ebp, [esp + 0xe4]
jmp dword [0x448208]
mov ebx, dword [esp + 0x54]
test ebx, ebx
jns 0x428076
mov eax, 0xffffffff
jmp 0x428079
lea eax, [ebx + ebx]
push eax
call fcn.004097b0
add esp, 4
push edi
push ebx
push eax
push 9
push ebp
push 0
call dword [0x44d2fc]
jmp case.0x428053.1
mov eax, 0xffffffff
push eax
call fcn.004097b0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 9
push ebp
push 0
call dword [0x44d2fc]
jmp dword [0x448214]
mov ebx, dword [esp + 0x54]
test ebx, ebx
js 0x4280a0
lea eax, [ebx + ebx]
jmp 0x4280a5
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x428fe0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x18], 0x3373311d
mov dword [esp + 0x1c], 0x3f4e3d4c
mov dword [esp + 0x20], 0x3b5b3974
mov dword [esp + 0x24], 0x47274538
mov dword [esp + 0x28], 0x4326416d
mov dword [esp + 0x2c], 0x4f394d1a
mov dword [esp + 0x30], 0x4b274934
mov dword [esp + 0x34], 0x57375524
mov dword [esp + 0x38], 0x5379513c
mov dword [esp + 0x3c], 0x5f3a5d77
mov dword [esp + 0x40], 0x5b37592b
mov dword [esp + 0x44], 0x67156517
mov dword [esp + 0x48], 0x63156109
mov dword [esp + 0x4c], 0x6f586d1a
mov dword [esp + 0x50], 0x6b1f6910
mov dword [esp + 0x54], 0x77767500
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb4
xor dl, byte [esp + ecx + 0x18]
add dl, 0x7c
mov byte [esp + ecx + 0x18], dl
inc ecx
cmp ecx, 0x44
jne 0x429080
lea ebp, [esp + 0x78]
lea edx, [esp + 0x18]
mov edi, ebp
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb8]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0x1f
push ebp
push 0
call dword [0x44d2fc]
mov dword [esp + 0x18], 0xd7161947
mov ecx, 0xb31c2b87
mov edx, 0x79
nop
movzx edi, byte [esp + ecx + 0x4ce3d491]
lea ebx, [edi + edi]
not ebx
add ebx, edi
mov esi, edi
and esi, 0x22
and ebx, 0xdd
or ebx, esi
xor ebx, edi
xor ebx, 0xdd
mov esi, edx
and esi, edi
not edi
or edi, edx
or edi, ebx
add edi, ecx
or edi, esi
mov esi, edi
and esi, 0x61
xor edi, 0x61
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + ecx + 0x4ce3d491], bl
inc ecx
dec edx
cmp ecx, 0xb31c2b8b
jne 0x4290e0
xor ecx, ecx
cmp eax, dword [esp + 0x18]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448318]
Function at 0x433370
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00414d10
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4333a9
jmp 0x433522
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4333e5
jmp 0x43351a
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042dd40
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x43350b
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.004097b0
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00424d10
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x7f
mov byte [edi + 1], 0x95
mov byte [edi + 2], 0x97
mov byte [edi + 3], 0xaf
mov byte [edi + 4], 0x9a
mov byte [edi + 5], 0xae
mov byte [edi + 6], 0x83
mov byte [edi + 7], 0xb5
mov byte [edi + 8], 0x84
mov byte [edi + 9], 0x73
mov byte [edi + 0xa], 0xb2
mov byte [edi + 0xb], 0xbf
mov byte [edi + 0xc], 0xb0
mov byte [edi + 0xd], 0x25
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x433482
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x10
jae 0x4334dd
movzx edx, byte [edi + eax]
mov esi, eax
add esi, 0xb319cb8a
mov ebx, 0x4ce63475
sub ebx, eax
and ebx, 0xb63a10e2
xor esi, 0xb63a10e2
or ebx, esi
xor ebx, edx
mov edx, ebx
xor edx, 0x1d
mov esi, 0x4c
sub esi, edx
or esi, 1
and ebx, 1
xor ebx, 1
add ebx, esi
mov ecx, dword [ebp + 8]
mov byte [edi + eax], bl
add eax, 1
jmp 0x433493
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x18]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.0040a550
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.004097c0
add esp, 4
jmp 0x43350b
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x433522
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043fdd0
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x449838]

Function at 0x439060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00440450
add esp, 0x14
test eax, eax
js 0x4391c6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004407f0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x4390fa
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4390c8
mov eax, 0xffffffff
jmp 0x4390cf
lea eax, [eax*2 + 2]
push eax
call fcn.004097b0
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00440da0
add esp, 0x14
test eax, eax
jns 0x4390fa
push esi
call fcn.004097c0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x4c4d4a4b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 4]
lea ecx, [edi + 0x27e6f8f2]
mov ebx, edx
not ebx
and ebx, ecx
mov ebp, ecx
xor ebp, edx
add ebp, edi
add ebp, 0x27e6f8f2
sub ebp, ebx
and ecx, edx
mov edx, ebp
xor edx, ecx
not ecx
and ecx, ebp
add ecx, ecx
sub ecx, edx
add cl, 0x46
mov byte [esp + edi + 4], cl
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, 7
jb 0x439120
mov ecx, dword [0x44d300]
test ecx, ecx
je 0x4391aa
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44d304]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439190
inc edi
cmp ecx, edi
jne 0x439180
jmp 0x4391aa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4391aa
push eax
push 4
push ecx
push dword [0x44d308]
call fcn.0043d770
add esp, 0x10
test esi, esi
jne 0x4391c8
lea eax, [esp + 4]
push eax
call fcn.0043fbb0
add esp, 4
test al, al
je 0x4391c6
cmp dword [esp + 4], 1
je 0x4391c8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ae30
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449b70]
Function at 0x43b1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43b2f0
xor eax, eax
cmp dword [ecx], 0
jne 0x43b35a
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
lea edi, [eax + 0x27e6f8f2]
mov ebp, 0xd
sub ebp, eax
mov ebx, ebp
or ebx, esi
and ebp, 0xd
and edi, 2
or edi, ebp
xor edi, 2
lea ebp, [eax*2 + 0x4fcdf1e4]
neg ebp
add ebp, eax
add ebp, 0xf1
or ebp, edi
and ebp, esi
not ebx
or ebx, ebp
add bl, 0x46
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 7
jb 0x43b270
mov eax, dword [esp]
mov esi, dword [0x44d300]
test esi, esi
je 0x43b35a
xor edi, edi
mov ebx, dword [0x44d304]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43b364
inc edi
cmp esi, edi
jne 0x43b2e0
jmp 0x43b35a
mov dword [esp + 8], 0xf4e4970
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 6
xor edx, 0x6e
mov ecx, eax
and ecx, 1
sub ecx, edx
xor cl, byte [esp + eax + 8]
add cl, 0x26
mov byte [esp + eax + 8], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
inc ecx
mov esi, ecx
and esi, 2
mov edx, ecx
or ecx, 2
imul ecx, esi
xor esi, 2
and edx, 0xfffffffd
imul edx, esi
xor eax, 1
add eax, ecx
add eax, edx
cmp eax, 8
jb 0x43b310
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b35a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44d308]
call fcn.0043d770
add esp, 0x1c
jmp 0x43b35a

Function at 0x43b390
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b46b
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
lea edi, [edx + 0x27e6f8f2]
mov ebp, 0xd
sub ebp, edx
mov ebx, ebp
or ebx, esi
and ebp, 0xd
and edi, 2
or edi, ebp
xor edi, 2
lea ebp, [edx*2 + 0x4fcdf1e4]
neg ebp
add ebp, edx
add ebp, 0xf1
or ebp, edi
and ebp, esi
not ebx
or ebx, ebp
add bl, 0x46
mov byte [esp + edx], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 7
jb 0x43b3c0
mov edx, dword [0x44d300]
test edx, edx
je 0x43b45e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44d304]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b440
inc edi
cmp edx, edi
jne 0x43b430
jmp 0x43b45e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b45e
push eax
push 4
push edx
push dword [0x44d308]
mov esi, ecx
call fcn.0043d770
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43b530
mov eax, dword [ecx]
test eax, eax
je 0x43b530
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4c4d4a4b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 4]
lea esi, [eax + 0x27e6f8f2]
mov ebx, 0xd
sub ebx, eax
mov edx, ebx
or edx, edi
and ebx, 0xd
and esi, 2
or esi, ebx
xor esi, 2
lea ebx, [eax*2 + 0x4fcdf1e4]
neg ebx
add ebx, eax
add ebx, 0xf1
or ebx, esi
and ebx, edi
not edx
or edx, ebx
add dl, 0x46
mov byte [esp + eax + 4], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 7
jb 0x43b4b0
mov eax, dword [esp + 4]
mov esi, dword [0x44d300]
test esi, esi
je 0x43b5ae
xor edi, edi
mov ebx, dword [0x44d304]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xaf0e0c2e
je 0x43b58a
inc edi
cmp esi, edi
jne 0x43b520
jmp 0x43b5ae
mov dword [esp + 4], 0xf9babbbc
mov dword [esp + 8], 0
mov eax, 0xd21727df
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2de8d825]
xor ecx, eax
mov edx, 1
sub edx, ecx
add ecx, 0xae
and edx, 9
and ecx, 0xf6
sub ecx, edx
mov byte [esp + eax + 0x2de8d825], cl
inc eax
cmp eax, 0xd21727e7
jne 0x43b550
mov eax, dword [esp + 4]
jmp 0x43b6c5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b5ae
push dword [ebp + 8]
push dword [esp + 0x10]
push 8
push esi
push dword [0x44d308]
mov esi, ecx
call fcn.0043d770
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43b6b8
cmp eax, 0xc000010a
jne 0x43b6b8
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4c4d4a4b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 4]
lea edi, [eax + 0x27e6f8f2]
mov ebx, 0xd
sub ebx, eax
mov edx, ebx
or edx, esi
and ebx, 0xd
and edi, 2
or edi, ebx
xor edi, 2
lea ebx, [eax*2 + 0x4fcdf1e4]
neg ebx
add ebx, eax
add ebx, 0xf1
or ebx, edi
and ebx, esi
not edx
or edx, ebx
add dl, 0x46
mov byte [esp + eax + 4], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 7
jb 0x43b610
mov eax, dword [esp + 4]
mov esi, dword [0x44d300]
test esi, esi
je 0x43b6b8
xor edi, edi
mov ebx, dword [0x44d304]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4c697c35
je 0x43b690
inc edi
cmp esi, edi
jne 0x43b680
jmp 0x43b6b8
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b6b8
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 0xc
push esi
push dword [0x44d308]
mov esi, ecx
call fcn.0043d770
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43b6c5
mov esi, eax
call fcn.0043b390
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43b6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
lea edi, [eax + 0x27e6f8f2]
mov edx, 0xd
sub edx, eax
mov ebx, edx
or ebx, esi
and edx, 0xd
and edi, 2
or edi, edx
xor edi, 2
lea edx, [eax*2 + 0x4fcdf1e4]
neg edx
add edx, eax
add edx, 0xf1
or edx, edi
and edx, esi
not ebx
or ebx, edx
add bl, 0x46
mov byte [esp + eax], bl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 7
jb 0x43b700
mov eax, dword [esp]
mov edx, dword [0x44d300]
test edx, edx
je 0x43b788
xor esi, esi
mov edi, dword [0x44d304]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xc18bc4ba
je 0x43b780
inc esi
cmp edx, esi
jne 0x43b770
jmp 0x43b788
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43b792
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push ebp
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x18
push edx
push dword [0x44d308]
call fcn.0043d770
add esp, 0x2c
jmp 0x43b78b

Function at 0x43b7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [ecx]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax]
lea esi, [eax + 0x27e6f8f2]
mov edx, 0xd
sub edx, eax
mov ecx, edx
or ecx, ebp
and edx, 0xd
and esi, 2
or esi, edx
xor esi, 2
lea edx, [eax*2 + 0x4fcdf1e4]
neg edx
add edx, eax
add edx, 0xf1
or edx, esi
and edx, ebp
not ecx
or ecx, edx
add cl, 0x46
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x43b7f0
test ebx, ebx
jne 0x43b847
lea ebx, [esp + 8]
mov eax, dword [esp]
mov edx, dword [0x44d300]
test edx, edx
je 0x43b898
xor esi, esi
mov ebp, dword [0x44d304]
nop
nop
nop
nop
cmp dword [ebp + esi*8], 0xe6c7f7c6
je 0x43b871
inc esi
cmp edx, esi
jne 0x43b860
jmp 0x43b898
mov edx, dword [ebp + esi*8 + 4]
cmp edx, eax
je 0x43b898
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0x14
push edx
push dword [0x44d308]
call fcn.0043d770
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0xe16ae712
mov dword [esp + 0x34], 0xfd16e31c
mov dword [esp + 0x38], 0xf9c8ff08
mov dword [esp + 0x3c], 0xf50efb04
mov dword [esp + 0x40], 0xf1f6f700
mov word [esp + 0x44], 0
mov byte [esp + 0x46], 0
xor eax, eax
nop
nop
nop
lea ecx, [eax + 0x29]
mov edx, 6
sub edx, eax
and edx, 0xc
and ecx, 0x73
or ecx, edx
xor cl, byte [esp + eax + 0x30]
xor cl, 0xc
add cl, 0x33
mov byte [esp + eax + 0x30], cl
mov ecx, eax
xor ecx, 0x7ffffffe
mov edx, eax
or edx, 1
and edx, ecx
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 0x17
jb 0x43c490
lea eax, [esp + 0x30]
push eax
call fcn.0043edf0
add esp, 4
mov dword [0x45531c], eax
mov dword [esp + 0x2c], 0xd1881358
test eax, eax
je 0x43c4f0
mov dword [esp + 0x2c], 0xa6b5718b
mov ebp, 0x4745d7f2
xor eax, eax
cmp ebp, 0xfe4f3f19
setl al
mov eax, dword [eax*4 + 0x449b88]
mov ecx, 0xdb02da85
xor ecx, dword [0x449b90]
add eax, ecx
inc eax
jmp eax

Function at 0x43d6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x449fa4]

Function at 0x43edf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x33323100
mov byte [esp + 8], 0
mov eax, 0x16d78e34
mov ecx, 0x2871cb
nop
nop
movzx esi, byte [esp + eax - 0x16d78e30]
mov edi, ecx
and edi, 0x28504a
mov edx, eax
and edx, 0x10c38c35
or edx, edi
xor edx, 0xb5
or edx, esi
lea edi, [ecx - 0x287100]
and edi, esi
not edx
or edx, edi
add dl, 0xfc
mov byte [esp + eax - 0x16d78e30], dl
inc eax
dec ecx
cmp eax, 0x16d78e39
jne 0x43ee10
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x44a9b4]
Function at 0x43f2d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [esp + 0x44]
movzx eax, word [ebx]
mov dword [esp], 0x4342fb0d
mov dword [esp + 4], 0
mov ecx, 0xae5392f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x51ac6d10]
xor esi, ecx
lea edx, [esi*2 + 0x30bc429e]
add esi, 0x985e214f
and edx, 2
mov edi, edx
and edi, esi
or edx, esi
xor edx, 1
add edx, edi
mov byte [esp + ecx + 0x51ac6d10], dl
inc ecx
cmp ecx, 0xae5392f8
jne 0x43f300
mov ecx, dword [esp]
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44aaa4]