joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41be60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x73d87187
mov dword [esp + 0x14], 0x7fc97dcf
mov dword [esp + 0x18], 0x7b7a79ce
mov dword [esp + 0x1c], 0
mov eax, 0x7a018814
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7a018804]
xor ecx, eax
mov edx, 0x6207a864
sub edx, ecx
or edx, 1
add edx, ecx
add edx, 0x9df8579c
mov ebx, edx
and ebx, 2
mov edi, edx
or edx, 2
imul edx, ebx
xor ebx, 2
and edi, 0xfd
imul edi, ebx
add ecx, 0x9b
xor ecx, 1
add ecx, edx
add ecx, edi
mov byte [esp + eax - 0x7a018804], cl
inc eax
cmp eax, 0x7a018824
jne 0x41bea0
mov dword [esp + 0x24], 0x4fda49d0
mov dword [esp + 0x28], 0x43d24dd8
mov dword [esp + 0x2c], 0x4715410e
mov dword [esp + 0x30], 0xbb264517
mov dword [esp + 0x34], 0xbf19b92b
mov dword [esp + 0x38], 0xb32ebd1d
mov dword [esp + 0x3c], 0xb725b128
mov dword [esp + 0x40], 0xab3eb523
mov dword [esp + 0x44], 0xafaea9e6
mov dword [esp + 0x48], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x24]
mov ebx, eax
and ebx, 0x64
mov edi, ecx
xor edi, 0x72
add edi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, 0xcb
and edx, 0x34
or edx, ebx
xor edx, edi
xor dl, 0xcb
add dl, 0xc6
mov byte [esp + ecx + 0x24], dl
inc ecx
add eax, 2
cmp ecx, 0x28
jne 0x41bf50
movzx ecx, word [esp + 0x24]
lea eax, [esp + 0x154]
test cx, cx
je 0x41bfb1
lea edx, [esp + 0x26]
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bfa0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41bfe1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bfd0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41c011
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c000
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x24], 0xcdc0c06a
mov byte [esp + 0x28], 0x68
mov dword [esp + 0x29], 0
mov dword [esp + 0x2c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x24]
mov ebx, eax
and ebx, 0xe
mov edx, ecx
xor edx, 0x9871a317
add edx, ebx
xor edx, edi
mov edi, 0x73
sub edi, edx
and edx, 1
and edi, 0xfe
or edi, edx
not edi
lea edx, [edi + edx*2]
mov byte [esp + ecx + 0x24], dl
inc ecx
add eax, 2
cmp ecx, 0xc
jne 0x41c040
movzx eax, byte [esp + 0x24]
test al, al
je 0x41c09d
lea ecx, [esp + 0x25]
mov ebx, esi
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41c090
jmp 0x41c09f
mov ebx, esi
mov byte [ebx], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x20]
lea edi, [esp + 0x154]
push eax
push ecx
push edx
push edi
call fcn.0040c8f0
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x446c84]
mov ecx, 0xb709812c
xor ecx, dword [0x446c8c]
add eax, ecx
inc eax
mov esi, dword [ebp + 0x10]
jmp eax
Function at 0x41ff80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp], 0xb9babb5a
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x1a4025de
mov edx, 0xe5bfda20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x1a4025de]
lea esi, [ecx - 0x7fffffff]
mov ebx, edx
and ebx, 0x610b98f4
and esi, 0x9240050b
or esi, ebx
xor esi, edi
xor esi, 0x690bb8f4
add esi, 0x13960abd
mov edi, esi
and edi, 0x24
xor esi, 0xa4
lea ebx, [esi + edi*2]
add bl, 0x44
mov byte [esp + ecx - 0x1a4025de], bl
inc ecx
dec edx
cmp ecx, 0x1a4025e5
jne 0x41ffd0
lea ecx, [esp + 8]
mov edx, esp
push ecx
push 0x421c90
push edx
push dword [eax + 8]
call fcn.00422090
add esp, 0x28
pop esi
pop edi
pop ebx
ret
Function at 0x421db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x421dc0
cmp eax, 0xffffffed
jge 0x421dd7
mov eax, 0xffffffff
jmp 0x421dda
add eax, 0x12
push eax
call fcn.004095a0
add esp, 4
mov esi, eax
mov dword [esp], 0x1fb119c4
mov dword [esp + 4], 0xe35b1db9
mov dword [esp + 8], 0xe714e114
mov dword [esp + 0xc], 0xeb4ce540
mov dword [esp + 0x10], 0xe9e8
mov eax, 0x379d557a
mov ecx, 0x62aa85
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x379d557a]
mov ebp, ecx
and ebp, 0x42aa32
mov edx, eax
and edx, 0x240800cd
or edx, ebp
xor edx, ebx
mov ebx, edx
xor ebx, 0x51
add edx, edx
and edx, 0x38
xor edx, 0x20
sub edx, ebx
inc dl
mov byte [esp + eax - 0x379d557a], dl
inc eax
dec ecx
cmp eax, 0x379d558e
jne 0x421e20
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x421e81
add edi, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x421e70
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x421eb1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421ea0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440600
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446fdc]
Function at 0x4272e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x447cdc]
Function at 0x428cb7
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 0x44]
test ebx, ebx
jns 0x428cd8
mov eax, 0xffffffff
jmp 0x428cdb
lea eax, [ebx + ebx]
lea ebp, [esp + 0x44]
push eax
call fcn.004095a0
add esp, 4
mov edi, eax
push ebp
push ebx
push eax
push 9
push esi
push 0
call dword [0x44d394]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447f24]

Function at 0x428f86
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x78], ecx
mov esi, dword [esp + ecx + 0x90]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edi + 2], 0
lea edi, [edi + 2]
jne 0x428fa0
mov edx, edi
sar edx, 1
mov eax, dword [esp + 0x44]
lea ecx, [edx + eax]
mov dword [esp + 0x4c], edx
add edx, eax
add edx, 0xd
lea eax, [ecx*2 + 0x1a]
test edx, edx
jns 0x428fcf
mov eax, 0xffffffff
push eax
call fcn.004095a0
add esp, 4
mov edx, eax
mov eax, dword [esp + 0x48]
movzx ecx, word [eax]
mov dword [esp + 0x40], edx
mov eax, edx
test cx, cx
je 0x429011
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x429000
mov word [eax], 0x5c
mov dword [esp], 0x61d267c0
mov dword [esp + 4], 0x5dff63f1
mov dword [esp + 8], 0x59ca5fff
mov dword [esp + 0xc], 0x55f75bb8
mov dword [esp + 0x10], 0x51f557d8
mov dword [esp + 0x14], 0x4dcd53dc
mov dword [esp + 0x18], 0x4f4c
mov ecx, 0x93ff7b19
mov edx, 0xe6
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x6c0084e7]
mov ebp, edx
xor ebp, ecx
and ebp, ebx
xor ebp, ecx
mov ebx, ebp
and ebx, 2
xor ebp, 0x82
lea ebx, [ebx*2]
add ebx, ebp
inc bl
mov byte [esp + ecx + 0x6c0084e7], bl
inc ecx
dec edx
cmp ecx, 0x93ff7b35
jne 0x429060
add eax, 2
movzx ecx, word [esi]
test cx, cx
je 0x4290c1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4290b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4290f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4290e0
mov word [eax], 0
lea eax, [esp + 0x60]
push 0x60
push 3
push 0x120089
push eax
push dword [esp + 0x50]
call fcn.00440400
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447f54]

Function at 0x429161
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov ebx, dword [esp + 0x7c]
mov eax, ebx
and eax, 1
mov ecx, ebx
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call fcn.004095a0
add esp, 4
mov ebp, eax
push 0
push ebx
push eax
push dword [esp + 0x6c]
call fcn.004408e0
add esp, 0x10
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x447f64]
Function at 0x4298f5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xffffffff
cmp dword [esp + 0x4c], 0xfffffff8
jl 0x429903
mov eax, ebp
push eax
call fcn.004095a0
add esp, 4
mov dword [esp], 0x93ee91a7
mov dword [esp + 4], 0xaf98addc
mov dword [esp + 8], 0xab22a924
mov dword [esp + 0xc], 0xa7a6a528
mov word [esp + 0x10], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + 0x1c]
mov ebx, 3
sub ebx, ecx
and ebx, 0x19
and edx, 0x26
or edx, ebx
xor dl, byte [esp + ecx]
xor dl, 0x19
add dl, 0x74
mov byte [esp + ecx], dl
add ecx, 0x43d5f587
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov edx, ecx
xor edx, 0x43d5f587
and ecx, 0x78
add ecx, ecx
sub ecx, edx
cmp ecx, 0x12
jb 0x429940
movzx edx, word [esi]
mov ecx, eax
test dx, dx
je 0x4299b1
lea ebx, [esi + 2]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x4299a0
mov word [ecx], 0
movzx edx, word [esp]
test dx, dx
je 0x4299e1
lea ebx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x4299d0
mov word [ecx], 0
mov ecx, dword [esp + 0x108]
push dword [esp + 0x58]
push dword [esp + 0x60]
push eax
call fcn.0040a3f0
jmp case.0x428f41.18
Function at 0x438840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x14]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.00440400
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44955c]

Function at 0x438b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00440ce0
add esp, 0x14
test eax, eax
js 0x438c40
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00441170
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x438baa
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x438b78
mov eax, 0xffffffff
jmp 0x438b7f
lea eax, [eax*2 + 2]
push eax
call fcn.004095a0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.004418a0
add esp, 0x14
test eax, eax
jns 0x438baa
push esi
call fcn.004095b0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xb4b58a8b
mov byte [esp + 8], 0
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x1e
xor cl, byte [esp + ebx + 4]
add cl, 0x6a
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 5
jne 0x438bc0
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x438c24
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44d39c]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x438c0a
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, ecx
jb 0x438bf0
jmp 0x438c24
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x438c24
push eax
push 4
push ecx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x10
test esi, esi
jne 0x438c42
lea eax, [esp + 4]
push eax
call fcn.004401a0
add esp, 4
test al, al
je 0x438c40
cmp dword [esp + 4], 1
je 0x438c42
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x797a7b54
mov word [esp + 4], 0
mov ecx, esp
xor edx, edx
xor esi, esi
nop
movzx ebx, byte [ecx]
mov ebp, edx
and ebp, 0xc444d782
mov edi, esi
xor edi, 0x9ddd943e
sub edi, ebp
inc edi
xor edi, ebx
add edi, 0xeaac1ac4
mov ebx, edi
and ebx, 0x3f
xor edi, 0x99061a3f
lea ebx, [edi + ebx*2]
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
add bl, 0xc1
mov byte [ecx], bl
inc ecx
dec esi
add edx, 0xfffffffe
cmp esi, 0xfffffffa
jne 0x43a8d0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4553bc]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ace0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43adb0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ae02
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xb4b58a8b
mov byte [esp + 4], 0
mov edi, 0x1e
mov esi, 0x17a346e1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x1e]
mov eax, edi
xor eax, esi
and eax, ebx
xor eax, esi
xor eax, 0x40
and eax, edi
add al, al
sub bl, al
movzx eax, bl
add eax, edi
add al, 0x6a
mov byte [esp + edi - 0x1e], al
inc edi
dec esi
cmp edi, 0x23
jne 0x43ad60
mov eax, dword [esp]
mov esi, dword [0x44d398]
test esi, esi
je 0x43ae02
xor edi, edi
mov ebx, dword [0x44d39c]
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43ae0b
inc edi
cmp esi, edi
jne 0x43ada0
jmp 0x43ae02
mov dword [esp + 8], 0x23626198
mov word [esp + 0xc], 0
mov eax, 0x8624b718
mov ecx, 0x79db48e7
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x79db48f0]
lea esi, [edx + edx]
not esi
add esi, edx
mov edi, eax
or edi, edx
not edx
and edx, esi
or edx, ecx
and edx, edi
add dl, 0x88
mov byte [esp + eax + 0x79db48f0], dl
inc eax
dec ecx
cmp eax, 0x8624b71e
jne 0x43add0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ae02
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x1c
jmp 0x43ae02

Function at 0x43ae40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43aeea
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xb4b58a8b
mov byte [esp + 4], 0
mov edi, 0x1e
mov esi, 0x17a346e1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x1e]
mov edx, edi
xor edx, esi
and edx, ebx
xor edx, esi
xor edx, 0x40
and edx, edi
add dl, dl
sub bl, dl
movzx edx, bl
add edx, edi
add dl, 0x6a
mov byte [esp + edi - 0x1e], dl
inc edi
dec esi
cmp edi, 0x23
jne 0x43ae70
mov edx, dword [0x44d398]
test edx, edx
je 0x43aede
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44d39c]
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43aec0
inc edi
cmp edx, edi
jne 0x43aeb0
jmp 0x43aede
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43aede
push eax
push 4
push edx
push dword [0x44d3a0]
mov esi, ecx
call fcn.0043dc10
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43aef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43af80
mov edi, dword [ecx]
test edi, edi
je 0x43af80
mov dword [esp], 0xb4b58a8b
mov byte [esp + 4], 0
mov esi, 0x1e
mov ebx, 0x17a346e1
nop
nop
movzx edx, byte [esp + esi - 0x1e]
mov eax, esi
xor eax, ebx
and eax, edx
xor eax, ebx
xor eax, 0x40
and eax, esi
add al, al
sub dl, al
movzx eax, dl
add eax, esi
add al, 0x6a
mov byte [esp + esi - 0x1e], al
inc esi
dec ebx
cmp esi, 0x23
jne 0x43af20
mov eax, dword [esp]
mov edx, dword [0x44d398]
test edx, edx
je 0x43aff0
xor esi, esi
mov ebx, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xaf0e0c2e
je 0x43afcf
inc esi
cmp edx, esi
jne 0x43af70
jmp 0x43aff0
mov dword [esp], 0x8f4e4930
mov dword [esp + 4], 0
mov eax, 0xd23994f2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2dc66b0e]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x46
mov byte [esp + eax + 0x2dc66b0e], cl
inc eax
cmp eax, 0xd23994fa
jne 0x43afa0
mov eax, dword [esp]
jmp 0x43b0de
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43aff0
push dword [ebp + 8]
push edi
push 8
push edx
push dword [0x44d3a0]
mov esi, ecx
call fcn.0043dc10
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43b0d1
cmp eax, 0xc000010a
jne 0x43b0d1
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp], 0xb4b58a8b
mov byte [esp + 4], 0
mov eax, 0x1e
mov edi, 0x17a346e1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x1e]
mov edx, eax
xor edx, edi
and edx, ebx
xor edx, edi
xor edx, 0x40
and edx, eax
add dl, dl
sub bl, dl
movzx edx, bl
add edx, eax
add dl, 0x6a
mov byte [esp + eax - 0x1e], dl
inc eax
dec edi
cmp eax, 0x23
jne 0x43b040
xor edx, edx
cmp esi, 0xffffffff
je 0x43b074
lea edx, [esp + 0x10]
mov eax, dword [esp]
mov esi, dword [0x44d398]
test esi, esi
je 0x43b0d1
mov dword [esp + 8], edx
xor ebx, ebx
mov edx, dword [0x44d39c]
nop
nop
nop
cmp dword [edx + ebx*8], 0x4c697c35
je 0x43b0aa
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
cmp ebx, esi
jb 0x43b090
jmp 0x43b0d1
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0x43b0d1
push dword [esp + 8]
push 0
push dword [esp + 0x14]
push 0xc
push edx
push dword [0x44d3a0]
mov esi, ecx
call fcn.0043dc10
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43b0de
mov esi, eax
call fcn.0043ae40
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43b0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0xb4b58a8b
mov byte [esp + 4], 0
mov edi, 0x1e
mov edx, 0x17a346e1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x1e]
mov eax, edi
xor eax, edx
and eax, ebx
xor eax, edx
xor eax, 0x40
and eax, edi
add al, al
sub bl, al
movzx eax, bl
add eax, edi
add al, 0x6a
mov byte [esp + edi - 0x1e], al
inc edi
dec edx
cmp edi, 0x23
jne 0x43b120
mov eax, dword [esp]
mov edx, dword [0x44d398]
test edx, edx
je 0x43b182
xor ebx, ebx
mov edi, dword [0x44d39c]
nop
nop
nop
cmp dword [edi + ebx*8], 0xc18bc4ba
je 0x43b17a
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
cmp ebx, edx
jb 0x43b160
jmp 0x43b182
mov edx, dword [edi + ebx*8 + 4]
cmp edx, eax
jne 0x43b18c
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push ebp
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x18
push edx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x2c
jmp 0x43b185

Function at 0x43b1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0xb4b58a8b
mov byte [esp + 4], 0
mov esi, 0x1e
mov ebp, 0x17a346e1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x1e]
mov eax, esi
xor eax, ebp
and eax, edx
xor eax, ebp
xor eax, 0x40
and eax, esi
add al, al
sub dl, al
movzx eax, dl
add eax, esi
add al, 0x6a
mov byte [esp + esi - 0x1e], al
inc esi
dec ebp
cmp esi, 0x23
jne 0x43b1f0
test ebx, ebx
jne 0x43b220
lea ebx, [esp + 8]
mov eax, dword [esp]
mov edx, dword [0x44d398]
test edx, edx
je 0x43b275
xor esi, esi
mov ebp, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + esi*8], 0xe6c7f7c6
je 0x43b251
inc esi
cmp edx, esi
jne 0x43b240
jmp 0x43b275
mov ebp, dword [ebp + esi*8 + 4]
cmp ebp, eax
je 0x43b275
push ebx
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
movzx eax, word [edi]
mov dword [esp], 0x90aeddf
mov word [esp + 4], 0
mov ecx, 0x58cc7dc3
mov edx, 0x3c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x58cc7dc3]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
mov esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0x30
mov byte [esp + ecx - 0x58cc7dc3], bl
inc ecx
dec edx
cmp ecx, 0x58cc7dc9
jne 0x43f9b0
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44ab3c]
Function at 0x440200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440220
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44023b
mov eax, 0xffffffff
jmp 0x44023e
add eax, 0xa
push eax
call fcn.004095a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x440281
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x440270
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0xbb3487aa
mov edx, 0x17855
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x44cb7856]
mov ebx, edx
and ebx, 0x10818
mov esi, ecx
and esi, 0x83140727
or esi, ebx
mov ebx, esi
and esi, 0x80050a3f
xor esi, 0x3b79bd98
or esi, edi
xor edi, 0xb82482bf
xor ebx, 0x80040267
or ebx, edi
and esi, ebx
add esi, 0xd5e01514
mov edi, esi
and edi, 0x19
xor esi, 0x99
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + ecx + 0x44cb7856], bl
inc ecx
dec edx
cmp ecx, 0xbb3487b1
jne 0x440310
mov esi, dword [esp]
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x4403e2
xor edx, edx
mov edi, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x4403a0
inc edx
cmp ecx, edx
jne 0x440390
jmp 0x4403e2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4403e2
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44d3a0]
mov edi, eax
call fcn.0043dc10
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004095b0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret