joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d690
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov edx, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x10], eax
mov word [esp], 0x1d1f
mov byte [esp + 2], 0xa
mov dword [esp + 3], 0
mov byte [esp + 7], 0
mov ebx, 0xad23f543
mov ebp, 0xbc
nop
nop
nop
nop
movzx edi, byte [esp + ebx + 0x52dc0abd]
mov eax, ebp
xor eax, ebx
and eax, edi
xor eax, ebx
mov edi, eax
xor edi, 0x50
and eax, 0x2f
add eax, eax
sub eax, edi
inc al
mov byte [esp + ebx + 0x52dc0abd], al
inc ebx
dec ebp
cmp ebx, 0xad23f54b
jne 0x40d6d0
mov dword [esp + 8], 0xa0408e2
mov dword [esp + 0xc], 0xff06
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
dec al
xor al, byte [esp + ebx + 8]
add al, 5
mov byte [esp + ebx + 8], al
inc ebx
cmp ebx, 8
jne 0x40d720
mov dword [esp + 0x18], 0x3e304445
mov dword [esp + 0x1c], 0x32324044
mov dword [esp + 0x20], 0x370a3045
mov dword [esp + 0x24], 0x2a2f2613
mov dword [esp + 0x28], 0x522f1312
mov dword [esp + 0x2c], 0x184d8779
mov dword [esp + 0x30], 0x1d27151e
mov dword [esp + 0x34], 0xdebaa0e8
mov dword [esp + 0x38], 0xe0e5e1e3
mov dword [esp + 0x3c], 0xe8d7e1d5
mov dword [esp + 0x40], 0xd59aa3ee
mov dword [esp + 0x44], 0xb2f3f7f3
mov dword [esp + 0x48], 0xc2fec0cc
mov dword [esp + 0x4c], 0xcef88db7
mov dword [esp + 0x50], 0x89afc4fd
mov byte [esp + 0x54], 0x54
mov word [esp + 0x55], 0
mov byte [esp + 0x57], 0
mov ebx, 0xd7d0a564
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebx + 0x282f5ab4]
mov eax, ecx
and eax, ebx
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0xc
mov byte [esp + ebx + 0x282f5ab4], al
inc ebx
cmp ebx, 0xd7d0a5a4
jne 0x40d7d0
mov eax, dword [esp + 0x6c]
add eax, dword [esp + 0x10]
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
je 0x40d81c
lea ebp, [esp + 0x19]
mov edi, eax
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d810
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d83b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d830
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d85b
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d850
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d87b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d870
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d89b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d890
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40f670
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, esp
mov eax, dword [ebp + 8]
push eax
sub esp, 0xe0
mov dword [esi + 8], esp
sub esp, 8
mov dword [esi + 0x18], esp
sub esp, 0xc
mov dword [esi + 0x1c], esp
push eax
mov dword [esi + 0x14], esp
push eax
mov ebx, esp
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44f310]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f73e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449b7c]
jmp dword [0x449b90]
Function at 0x40ff90
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [esp + 0x3c], 0x81378753
mov dword [esp + 0x40], 0x8d29833a
mov dword [esp + 0x44], 0x893a8f38
mov dword [esp + 0x48], 0x957b8b2b
mov dword [esp + 0x4c], 0x9160976b
mov dword [esp + 0x50], 0x9d729360
mov dword [esp + 0x54], 0x99479f74
mov dword [esp + 0x58], 0x652c9b33
mov dword [esp + 0x5c], 0x61d767c8
mov dword [esp + 0x60], 0x6ddf63d9
mov dword [esp + 0x64], 0x69b86f8c
mov dword [esp + 0x68], 0x758a6bb4
mov dword [esp + 0x6c], 0x71867787
mov dword [esp + 0x70], 0x7d827386
mov dword [esp + 0x74], 0x799e7fb9
mov dword [esp + 0x78], 0x45d17ba1
mov dword [esp + 0x7c], 0x41b847f2
mov dword [esp + 0x80], 0x4d8743bc
mov dword [esp + 0x84], 0x49f64fac
mov dword [esp + 0x88], 0x55b64bb6
mov dword [esp + 0x8c], 0x51b657bf
mov dword [esp + 0x90], 0x5de25393
mov dword [esp + 0x94], 0x59ea5fec
mov dword [esp + 0x98], 0x25835bf7
mov dword [esp + 0x9c], 0x2184278b
mov dword [esp + 0xa0], 0x2d8923f5
mov dword [esp + 0xa4], 0x29df2f90
mov dword [esp + 0xa8], 0x35d72bd7
mov dword [esp + 0xac], 0x31c037cd
mov dword [esp + 0xb0], 0x3dcc33cd
mov dword [esp + 0xb4], 0x39d63fdc
mov dword [esp + 0xb8], 0x5f23bed
mov dword [esp + 0xbc], 0x1d107d8
mov dword [esp + 0xc0], 0xdf603d4
mov dword [esp + 0xc4], 0x9ba0fec
mov dword [esp + 0xc8], 0x15bf0ba3
mov dword [esp + 0xcc], 0x11f617bb
mov dword [esp + 0xd0], 0x1dbd13d9
mov dword [esp + 0xd4], 0x19ab1fb1
mov dword [esp + 0xd8], 0xe5f11ba9
mov dword [esp + 0xdc], 0xe12be704
mov dword [esp + 0xe0], 0xed50e348
mov dword [esp + 0xe4], 0xe959ef5d
mov dword [esp + 0xe8], 0xf51beb47
mov dword [esp + 0xec], 0xf105f707
mov dword [esp + 0xf0], 0xfd04f30b
mov dword [esp + 0xf4], 0xf908ff0c
mov dword [esp + 0xf8], 0xc50cfb08
mov dword [esp + 0xfc], 0xc126c734
mov dword [esp + 0x100], 0xcd61c31d
mov dword [esp + 0x104], 0xc96dcf62
mov dword [esp + 0x108], 0xd561cb7a
mov dword [esp + 0x10c], 0xd129d725
mov dword [esp + 0x110], 0xdd2bd32d
mov dword [esp + 0x114], 0xd923df2a
mov dword [esp + 0x118], 0xa5dadb26
mov byte [esp + 0x11c], 0
mov eax, dword [0x44f304]
lea ecx, [esp + 0x3c]
mov edx, 0x370b249e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
lea edi, [edx - 0x370b2400]
and edi, esi
or esi, edx
not esi
or esi, edi
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x1a
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x370b23bd
jne 0x4101f0
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449c2c]
Function at 0x410dc0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44a3a4]

Function at 0x41c7ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x10], esp
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41c810
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41c830
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x41c850
mov eax, 0xffffffff
jmp 0x41c859
add eax, esi
lea eax, [eax*2 + 4]
push eax
call fcn.0040c8d0
add esp, 4
mov ebx, eax
movzx ecx, word [edi]
test cx, cx
je 0x41c891
add edi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41c880
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x41c8c3
add edx, 2
mov edi, dword [ebp - 0x10]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c8b0
jmp 0x41c8c6
mov edi, dword [ebp - 0x10]
mov word [eax], 0
lea eax, [ebp - 0x14]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00444b90
add esp, 0x14
mov dword [ebp - 0x24], ebx
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44afac]
Function at 0x41cb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1118
call fcn.0040c830
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cb60
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x450648]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cb94
mov eax, 0xffffffff
jmp 0x41cb97
lea eax, [ebx + ebx]
push eax
call fcn.0040c8d0
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x450648]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41cbcc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c8d0
add esp, 4
mov edi, eax
mov dword [esp + 0x114], 0x23fe218c
mov dword [esp + 0x118], 0x27952585
mov dword [esp + 0x11c], 0x3bda398c
mov dword [esp + 0x120], 0x3f9b3dea
mov dword [esp + 0x124], 0x33813182
mov dword [esp + 0x128], 0x3789358d
mov dword [esp + 0x12c], 0xb0a09b6
mov byte [esp + 0x130], 0
mov eax, 0xe26e81c8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x1d917f4c]
xor edx, eax
mov ecx, edx
xor ecx, 0xe8
or edx, 0x17
and ecx, edx
add ecx, edx
inc cl
mov byte [esp + eax + 0x1d917f4c], cl
inc eax
cmp eax, 0xe26e81e5
jne 0x41cc40
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41cca1
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cc90
mov word [eax], 0
movzx ecx, word [esp + 0x114]
test cx, cx
je 0x41ccd1
lea edx, [esp + 0x116]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ccc0
mov word [eax], 0
lea eax, [esp + 0xa8]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00444b90
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b364]
Function at 0x4234d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4234e0
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x450648]
mov edi, dword [esp + 4]
test edi, edi
jns 0x42350f
mov eax, 0xffffffff
jmp 0x423512
lea eax, [edi + edi]
push eax
call fcn.0040c8d0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x450648]
lea ebx, [esp + 8]
push ebx
push esi
call fcn.00444d20
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b7c8]
Function at 0x42ac90
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042acb0
add esp, 4
test al, al
je 0x42b360
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xdc
mov dword [esp + 0x9c], 0xf140ffa7
mov dword [esp + 0xa0], 0xf546f345
mov dword [esp + 0xa4], 0xc94af757
mov dword [esp + 0xa8], 0xcd9acb74
mov dword [esp + 0xac], 0xc17acf6f
mov dword [esp + 0xb0], 0xc5c2c378
mov dword [esp + 0xb4], 0
mov eax, 0x15
mov ecx, 0x2a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x87]
lea edx, [eax - 0x50698540]
mov edi, ecx
and edi, 0x36
mov ebx, eax
and ebx, 0x36
xor ebx, 0x40480536
and edx, 0x87800889
or edx, edi
or edx, ebx
xor edx, esi
mov ebx, edx
xor ebx, 0x76
and edx, 1
add ebx, 0xd6
or ebx, 1
add ebx, edx
mov byte [esp + eax + 0x87], bl
inc eax
dec ecx
cmp eax, 0x31
jne 0x42b3d0
mov dword [esp + 0x14], 0x29fc2bf8
mov dword [esp + 0x18], 0x2de72fe3
mov dword [esp + 0x1c], 0x31e733e3
mov dword [esp + 0x20], 0x35e037e4
mov dword [esp + 0x24], 0x39e63beb
mov dword [esp + 0x28], 0x3df93feb
mov dword [esp + 0x2c], 0x1ca03f9
mov dword [esp + 0x30], 0x5d407cf
mov dword [esp + 0x34], 0x9d60bcf
mov dword [esp + 0x38], 0xddf0fdd
mov dword [esp + 0x3c], 0x11c613c6
mov dword [esp + 0x40], 0x15d117c9
mov dword [esp + 0x44], 0x19d11bc2
mov dword [esp + 0x48], 0x1dc41fc4
mov dword [esp + 0x4c], 0xe14ee3bb
mov dword [esp + 0x50], 0xe54de75a
mov dword [esp + 0x54], 0xe93feb38
mov dword [esp + 0x58], 0xed45ef5c
mov dword [esp + 0x5c], 0xf141f34b
mov dword [esp + 0x60], 0xf7f0
mov eax, 0x10a3dbc7
mov ecx, 0x38
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x10a3dbb3]
lea esi, [eax - 0x10a3db00]
and esi, edx
mov edi, ecx
and edi, edx
mov ebx, eax
xor ebx, edx
sub ebx, edx
add ebx, esi
or ebx, edi
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
add dl, 0x1c
mov byte [esp + eax - 0x10a3dbb3], dl
inc eax
dec ecx
cmp eax, 0x10a3dc17
jne 0x42b4d0
lea eax, [esp + 0x9c]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0043bbb0
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x44c7d8]
Function at 0x436380
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436506
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x4363d2
cmp edi, 0
setne al
jmp 0x4363da
xor ebx, ebx
test al, 1
jne 0x4363e5
jmp 0x436500
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00431ea0
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x43640d
jmp 0x4364f4
mov dword [esp + 0x28], eax
mov ebx, eax
sub ebx, 0xffffffff
mov dword [esp], ebx
call fcn.0040c8d0
mov esi, eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00431f10
jmp 0x436432
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0xb5
mov byte [esp + 0x16], 0xb7
mov byte [esp + 0x17], 0xaf
mov byte [esp + 0x18], 0xba
mov byte [esp + 0x19], 0xae
mov byte [esp + 0x1a], 0xc3
mov byte [esp + 0x1b], 0xd5
mov byte [esp + 0x1c], 0xc4
mov byte [esp + 0x1d], 0x13
mov byte [esp + 0x1e], 0xd2
mov byte [esp + 0x1f], 0xdf
mov byte [esp + 0x20], 0xd0
mov byte [esp + 0x21], 0x65
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x11
jne 0x436485
jmp 0x436494
jmp 0x436496
xor eax, eax
jmp 0x43649a
cmp eax, 0x11
jae 0x4364c6
movzx edx, byte [esp + eax + 0x14]
mov ebx, eax
add ebx, 0xba
mov ecx, eax
add ecx, 0xba
and ecx, edx
or ebx, edx
xor ecx, ebx
add cl, 0x5e
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x43649a
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call fcn.0040d610
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], esi
call fcn.0040c8e0
jmp 0x4364f4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b250
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x450648]
mov dword [esp], eax
mov dword [esp + 4], 0x43f14125
mov dword [esp + 8], 0x47d545dd
mov dword [esp + 0xc], 0x4bef49dc
mov dword [esp + 0x10], 0x4f0a4de1
mov dword [esp + 0x14], 0xb31bb122
mov dword [esp + 0x18], 0xb713b522
mov dword [esp + 0x1c], 0xbbbab9dd
mov byte [esp + 0x20], 0
mov ecx, 0x81008570
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x7eff7a94]
mov esi, ecx
and esi, edi
mov eax, esi
and eax, 0xfffffffd
mov edx, esi
or edx, 0xfffffffd
inc edx
imul edx, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
add edx, edi
sub edx, esi
add edx, ecx
mov eax, edx
and eax, 0x7afd64cf
and edx, 0x85029b30
xor edx, 0x85029b31
sub eax, edx
mov edx, eax
and edx, 1
or eax, 1
add eax, edx
mov byte [esp + ecx + 0x7eff7a94], al
inc ecx
cmp ecx, 0x8100858d
jne 0x43b2b0
lea eax, [esp + 0x58]
lea esi, [esp + 0x84]
lea edi, [esp + 4]
push eax
push 8
push esi
push 0xd
push edi
push 0
call dword [esp + 0x18]
shr eax, 0x1f
jmp dword [eax*4 + 0x44dcf8]
Function at 0x43e820
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44e280]
Function at 0x43ebc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43ecd0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ed0b
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xdcdddedf
mov dword [esp + 4], 0
xor eax, eax
mov esi, 0x31588af
nop
nop
movzx edx, byte [esp + eax]
mov ebx, esi
and ebx, 0x314880d
mov ebp, eax
and ebp, 2
mov edi, edx
and edi, 0x5d
or edi, 0x90454822
and edx, 0xffffffa2
add ebx, ebp
add ebx, 0x28480100
xor ebx, edx
xor ebx, edi
mov ebp, ebx
xor ebp, 0xb767e2ef
mov edi, ebx
and edi, 0x100090
xor edi, 0xf7aab7f
and edi, ebp
mov edx, edi
and edx, 0xfd
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, edx
xor ebx, 0x10
add ebx, edi
add ebx, ebp
inc bl
mov byte [esp + eax], bl
inc eax
dec esi
cmp eax, 8
jne 0x43ec30
mov eax, dword [esp]
mov esi, dword [0x45064c]
test esi, esi
je 0x43ed0b
xor edi, edi
mov ebx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43ed15
inc edi
cmp esi, edi
jne 0x43ecc0
jmp 0x43ed0b
mov dword [esp + 8], 0x692a2b2c
mov eax, 0x6c2c1147
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6c2c113f]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x9d
mov byte [esp + eax - 0x6c2c113f], cl
inc eax
cmp eax, 0x6c2c114b
jne 0x43ece0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ed0b
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push dword [esp + 0x44]
push ecx
push 4
push dword [0x450654]
push esi
call fcn.00441b40
add esp, 0x1c
jmp 0x43ed0b
Function at 0x43ed50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43ee4e
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0xdcdddedf
mov dword [esp + 4], 0
xor edx, edx
mov esi, 0x31588af
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx]
mov ebx, esi
and ebx, 0x314880d
mov ebp, edx
and ebp, 2
mov edi, eax
and edi, 0x5d
or edi, 0x90454822
and eax, 0xffffffa2
add ebx, ebp
add ebx, 0x28480100
xor ebx, eax
xor ebx, edi
mov ebp, ebx
xor ebp, 0xb767e2ef
mov edi, ebx
and edi, 0x100090
xor edi, 0xf7aab7f
and edi, ebp
mov eax, edi
and eax, 0xfd
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, eax
xor ebx, 0x10
add ebx, edi
add ebx, ebp
inc bl
mov byte [esp + edx], bl
inc edx
dec esi
cmp edx, 8
jne 0x43ed80
mov edx, dword [0x45064c]
test edx, edx
je 0x43ee41
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43ee20
inc edi
cmp edx, edi
jne 0x43ee10
jmp 0x43ee41
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ee41
push dword [esp + 8]
push 1
push dword [0x450654]
push edx
mov esi, ecx
call fcn.00441b40
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov edi, dword [esp + 0x30]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43f16c
push 0xbbf966b4
push dword [0x450640]
call fcn.00444150
add esp, 8
test eax, eax
je 0x43f131
mov ecx, dword [esi]
test ecx, ecx
je 0x43f169
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43f145
cmp dword [esp], 0
je 0x43f145
mov dword [esi + 4], 3
jmp 0x43f169
mov ecx, edi
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43f247
lea eax, [esp + 0xc]
push eax
call fcn.00444990
add esp, 4
test al, al
je 0x43f169
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43f166
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, edi
cmp eax, 2
jne 0x43f247
mov dword [esp], 0xdcdddedf
mov dword [esp + 4], 0
xor eax, eax
mov edx, 0x31588af
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
mov ebx, edx
and ebx, 0x314880d
mov ebp, eax
and ebp, 2
mov esi, edi
and esi, 0x5d
or esi, 0x90454822
and edi, 0xffffffa2
add ebx, ebp
add ebx, 0x28480100
xor ebx, edi
xor ebx, esi
mov ebp, ebx
xor ebp, 0xb767e2ef
mov esi, ebx
and esi, 0x100090
xor esi, 0xf7aab7f
and esi, ebp
mov edi, esi
and edi, 0xfd
and ebp, 2
or esi, 2
imul esi, ebp
xor ebp, 2
imul ebp, edi
xor ebx, 0x10
add ebx, esi
add ebx, ebp
inc bl
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 8
jne 0x43f1a0
mov eax, dword [esp]
mov edx, dword [0x45064c]
test edx, edx
je 0x43f32a
xor esi, esi
mov ebx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43f300
inc esi
cmp edx, esi
jne 0x43f230
jmp 0x43f32a
mov dword [esp], 0xdcdddedf
mov dword [esp + 4], 0
xor eax, eax
mov edx, 0x31588af
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, edx
and edi, 0x314880d
mov ebx, eax
and ebx, 2
mov ebp, esi
and ebp, 0x5d
or ebp, 0x90454822
and esi, 0xffffffa2
add ebx, edi
add ebx, 0x28480100
xor ebx, esi
xor ebx, ebp
mov ebp, ebx
xor ebp, 0xb767e2ef
mov esi, ebx
and esi, 0x100090
xor esi, 0xf7aab7f
and esi, ebp
mov edi, esi
and edi, 0xfd
and ebp, 2
or esi, 2
imul esi, ebp
xor ebp, 2
imul ebp, edi
xor ebx, 0x10
add ebx, esi
add ebx, ebp
inc bl
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 8
jne 0x43f260
mov eax, dword [esp]
mov edx, dword [0x45064c]
test edx, edx
je 0x43f32a
xor esi, esi
mov ebx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43f300
inc esi
cmp edx, esi
jne 0x43f2f0
jmp 0x43f32a
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f32a
push ecx
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push dword [0x450654]
push edx
call fcn.00441b40
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10