joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [eax + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420eb0
sar ebp, 1
mov ecx, esp
push ecx
push 0
push 0
push ebp
push eax
push 0
call dword [0x44dee0]
mov dword [esp + 0xc], 0xcf8e896f
mov byte [esp + 0x10], 0
mov ecx, 0xd
mov edx, 0x638167e2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x638167d6]
mov esi, edx
or esi, 0x8bba7e0
lea edi, [ecx + esi]
add edi, 0x9c7e9811
mov esi, ecx
xor esi, 0x6300400f
or esi, edi
xor esi, ebx
mov edi, esi
and edi, 0x15
mov ebx, esi
and ebx, 0x95
xor ebx, 0x7f
and esi, 0x6a
xor esi, 0xf5
and esi, ebx
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x638167d6], bl
dec ecx
inc edx
cmp ecx, 8
jne case.default.0x420f4e
xor ecx, ecx
cmp eax, dword [esp + 0xc]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447eac]
mov ebx, dword [esp]
test ebx, ebx
jns 0x420f63
mov eax, 0xffffffff
jmp 0x420f66
lea eax, [ebx + ebx]
push eax
call fcn.00408580
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push ebp
push dword [esp + 0x48]
push 0
call dword [0x44dee0]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447eb4]
xor ebx, ebx
jmp dword [0x447ebc]
push esi
call fcn.00408590
add esp, 4
xor ebx, ebx
jmp case.0x420f4e.2
lea edi, [esp + 0xc]
push edi
push esi
call fcn.004411e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447ec4]
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0xffffffef
or eax, 0x10
xor edx, edx
test eax, ecx
sete dl
mov ebp, 1
jmp dword [edx*4 + 0x447ecc]
xor ebp, ebp
jmp dword [0x447ed4]
xor ebx, ebx
jmp dword [ebp*4 + 0x447eec]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x421002
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [eax + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420eb0
sar ebp, 1
mov ecx, esp
push ecx
push 0
push 0
push ebp
push eax
push 0
call dword [0x44dee0]
mov dword [esp + 0xc], 0xcf8e896f
mov byte [esp + 0x10], 0
mov ecx, 0xd
mov edx, 0x638167e2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x638167d6]
mov esi, edx
or esi, 0x8bba7e0
lea edi, [ecx + esi]
add edi, 0x9c7e9811
mov esi, ecx
xor esi, 0x6300400f
or esi, edi
xor esi, ebx
mov edi, esi
and edi, 0x15
mov ebx, esi
and ebx, 0x95
xor ebx, 0x7f
and esi, 0x6a
xor esi, 0xf5
and esi, ebx
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x638167d6], bl
dec ecx
inc edx
cmp ecx, 8
jne case.default.0x420f4e
xor ecx, ecx
cmp eax, dword [esp + 0xc]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447eac]
mov ebx, dword [esp]
test ebx, ebx
jns 0x420f63
mov eax, 0xffffffff
jmp 0x420f66
lea eax, [ebx + ebx]
push eax
call fcn.00408580
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push ebp
push dword [esp + 0x48]
push 0
call dword [0x44dee0]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447eb4]
xor ebx, ebx
jmp dword [0x447ebc]
push esi
call fcn.00408590
add esp, 4
xor ebx, ebx
jmp case.0x420f4e.2
lea edi, [esp + 0xc]
push edi
push esi
call fcn.004411e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447ec4]
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0xffffffef
or eax, 0x10
xor edx, edx
test eax, ecx
sete dl
mov ebp, 1
jmp dword [edx*4 + 0x447ecc]
xor ebp, ebp
jmp dword [0x447ed4]
xor ebx, ebx
jmp dword [ebp*4 + 0x447eec]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x422b60
cmp eax, 0xffffffed
jge 0x422b77
mov eax, 0xffffffff
jmp 0x422b7a
add eax, 0x12
push eax
call fcn.00408580
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], 0xb927bbe8
mov dword [ebp - 0x20], 0xbd31bf23
mov dword [ebp - 0x1c], 0xb1e0b3e8
mov dword [ebp - 0x18], 0xb5d0b7d4
mov dword [ebp - 0x14], 0xabb4
mov byte [ebp - 0x10], 0
xor eax, eax
xor ecx, ecx
mov edx, ecx
xor dl, 0x1f
add dl, al
xor dl, byte [ebp + ecx - 0x24]
add dl, 0x65
mov byte [ebp + ecx - 0x24], dl
inc ecx
add al, 2
cmp ecx, 0x15
jne 0x422bb0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x422bf1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422be0
mov word [eax], 0
movzx ecx, word [ebp - 0x24]
test cx, cx
je 0x422c21
lea edx, [ebp - 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422c10
mov word [eax], 0
push ebx
push esi
call fcn.004411e0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x447f7c]
Function at 0x42bf90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42bfea
cmp edi, 1
je 0x42bfea
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42bfc1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42bfc0
cmp ecx, 0x20
je 0x42bfc0
cmp ecx, 0x2b
mov edx, edi
je 0x42bfe0
cmp ecx, 0x2d
jne 0x42bfff
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42c004
xor edi, edi
test eax, eax
je 0x42c1bd
mov dword [eax], 0x16
jmp 0x42c1bd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42c02d
cmp edx, 0x10
jne 0x42c045
cmp byte [ebx], 0x30
jne 0x42c026
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42c047
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42c047
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42c0a0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42c158
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42c0c7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42c188
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42c188
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42c080
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42c110
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42c119
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42c13d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42c16d
test bl, bl
jne 0x42c16d
mov ebx, dword [esp + 0x10]
jmp 0x42c093
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42c075
mov esi, edi
test bl, bl
jne 0x42c17b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42c075
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42c196
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42c1a4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42c1b4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42c1bd
cmp byte [esp + 3], 0
jne 0x42c1bd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.00441030
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a49c]

Function at 0x43a290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00441770
add esp, 0x14
test eax, eax
js 0x43a3c6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00441b40
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43a32a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43a2f8
mov eax, 0xffffffff
jmp 0x43a2ff
lea eax, [eax*2 + 2]
push eax
call fcn.00408580
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00442140
add esp, 0x14
test eax, eax
jns 0x43a32a
push esi
call fcn.00408590
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xc0d0a0b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 2
xor cl, byte [esp + ebx + 4]
add cl, 0xf6
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 7
jne 0x43a350
mov ecx, dword [0x44dee4]
test ecx, ecx
je 0x43a3aa
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44dee8]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43a390
inc edi
cmp ecx, edi
jne 0x43a380
jmp 0x43a3aa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43a3aa
push eax
push 4
push ecx
push dword [0x44deec]
call fcn.0043e980
add esp, 0x10
test esi, esi
jne 0x43a3c8
lea eax, [esp + 4]
push eax
call fcn.00440e20
add esp, 4
test al, al
je 0x43a3c6
cmp dword [esp + 4], 1
je 0x43a3c8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x292a2b54
mov byte [esp + 4], 0
mov ecx, 0x28d3eb87
mov edx, 0xd72c1478
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x28d3eb87]
mov esi, ecx
xor esi, ebx
or esi, edx
mov edi, esi
not edi
mov ebp, edi
and ebp, 0x8d
and esi, 2
imul esi, ebp
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
sub ebx, esi
sub ebx, edi
add ebx, ecx
mov edi, ebx
xor edi, 0xcc2399a3
mov esi, ebx
or esi, 0x33dc665c
and esi, edi
mov edi, esi
and edi, 0xfd
mov ebp, esi
and ebp, 2
or esi, 2
imul esi, ebp
xor ebp, 2
imul ebp, edi
xor ebx, 0x5c
add ebx, esi
add ebx, ebp
inc bl
mov byte [esp + ecx - 0x28d3eb87], bl
inc ecx
dec edx
cmp ecx, 0x28d3eb8c
jne 0x43bfe0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x455f08]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c070
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44a7b4]
Function at 0x43c380
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43c460
xor eax, eax
cmp dword [ecx], 0
jne 0x43c4b1
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 0x112e7a61]
mov edi, esi
and edi, 0x224105a8
xor esi, 0x236b2fe8
lea ebx, [esi + edi*2]
mov esi, ebx
not esi
and esi, 0x9f
and ebx, 0x60
sub ebx, esi
xor bl, byte [esp + eax]
add bl, 0x78
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 5
jb 0x43c3f0
mov eax, dword [esp]
mov esi, dword [0x44dee4]
test esi, esi
je 0x43c4b1
xor edi, edi
mov ebx, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43c4ba
inc edi
cmp esi, edi
jne 0x43c450
jmp 0x43c4b1
mov dword [esp + 8], 0x79babbbc
mov byte [esp + 0xc], 0
mov eax, 0xd12581f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xd125817]
xor ecx, eax
add ecx, 0x34957b01
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0x63
mov byte [esp + eax - 0xd125817], cl
inc eax
cmp eax, 0xd125824
jne 0x43c480
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c4b1
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44deec]
call fcn.0043e980
add esp, 0x1c
jmp 0x43c4b1

Function at 0x43c4f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c5aa
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor edx, edx
nop
nop
lea esi, [edx - 0x112e7a61]
mov edi, esi
and edi, 0x224105a8
xor esi, 0x236b2fe8
lea ebx, [esi + edi*2]
mov esi, ebx
not esi
and esi, 0x9f
and ebx, 0x60
sub ebx, esi
xor bl, byte [esp + edx]
add bl, 0x78
mov byte [esp + edx], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 5
jb 0x43c510
mov edx, dword [0x44dee4]
test edx, edx
je 0x43c59e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43c580
inc edi
cmp edx, edi
jne 0x43c570
jmp 0x43c59e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c59e
push eax
push 4
push edx
push dword [0x44deec]
mov esi, ecx
call fcn.0043e980
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43c5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43c650
mov edx, dword [ecx]
test edx, edx
je 0x43c650
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor eax, eax
nop
nop
lea esi, [eax - 0x112e7a61]
mov edi, esi
and edi, 0x224105a8
xor esi, 0x236b2fe8
lea ebx, [esi + edi*2]
mov esi, ebx
not esi
and esi, 0x9f
and ebx, 0x60
sub ebx, esi
xor bl, byte [esp + eax]
add bl, 0x78
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 5
jb 0x43c5e0
mov eax, dword [esp]
mov ebx, dword [0x44dee4]
test ebx, ebx
je 0x43c6bc
xor edi, edi
mov esi, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xaf0e0c2e
je 0x43c69b
inc edi
cmp ebx, edi
jne 0x43c640
jmp 0x43c6bc
mov dword [esp], 0xe92a2b2c
mov word [esp + 4], 0
xor eax, eax
mov ecx, eax
add cl, 0x87
xor cl, byte [esp + eax]
add cl, 0x5d
mov byte [esp + eax], cl
mov edx, eax
xor edx, 0x7ffffffe
mov ecx, eax
or ecx, 1
and ecx, edx
mov edx, eax
or edx, 0xfffffffe
not eax
or eax, 1
and eax, edx
not eax
lea eax, [eax + ecx*2]
cmp eax, 6
jb 0x43c660
mov eax, dword [esp]
jmp 0x43c7b2
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43c6bc
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x44deec]
mov esi, ecx
call fcn.0043e980
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43c7a5
cmp eax, 0xc000010a
jne 0x43c7a5
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 0x112e7a61]
mov edi, esi
and edi, 0x224105a8
xor esi, 0x236b2fe8
lea ebx, [esi + edi*2]
mov esi, ebx
not esi
and esi, 0x9f
and ebx, 0x60
sub ebx, esi
xor bl, byte [esp + eax]
add bl, 0x78
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 5
jb 0x43c710
mov eax, dword [esp]
mov esi, dword [0x44dee4]
test esi, esi
je 0x43c7a5
xor edi, edi
mov ebx, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4c697c35
je 0x43c780
inc edi
cmp esi, edi
jne 0x43c770
jmp 0x43c7a5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c7a5
lea eax, [esp + 8]
push eax
push 0
push edx
push 0xc
push esi
push dword [0x44deec]
mov esi, ecx
call fcn.0043e980
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43c7b2
mov esi, eax
call fcn.0043c4f0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43c7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor eax, eax
nop
lea edx, [eax - 0x112e7a61]
mov esi, edx
and esi, 0x224105a8
xor edx, 0x236b2fe8
lea edx, [edx + esi*2]
mov esi, edx
not esi
and esi, 0x9f
and edx, 0x60
sub edx, esi
xor dl, byte [esp + eax]
add dl, 0x78
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 5
jb 0x43c7e0
test ebx, ebx
jne 0x43c827
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44dee4]
test ebp, ebp
je 0x43c874
xor edx, edx
mov esi, dword [0x44dee8]
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43c850
inc edx
cmp ebp, edx
jne 0x43c840
jmp 0x43c874
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43c874
push ebx
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44deec]
call fcn.0043e980
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e8b0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44ac28]

Function at 0x43f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [esp + 0x44]
movzx eax, word [esi]
mov dword [esp], 0x999a7d4f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x5b
xor dl, byte [esp + ecx]
add dl, 0x39
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 7
jne 0x43f8a0
xor ecx, ecx
cmp dword [esp], eax
setne cl
mov eax, dword [ecx*4 + 0x44b094]
mov ecx, 0x14257af7
xor ecx, dword [0x44b09c]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax

Function at 0x440110
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x21262774
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xb9
xor cl, byte [esp + eax + 4]
add cl, 0x63
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne case.default.0x440157
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x44b5d4]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov esi, dword [edx]
xor ecx, ecx
cmp esi, edx
setne cl
mov dword [esp + 0xc], edx
jmp dword [ecx*4 + 0x44b5ec]
jmp dword [edi*4 + 0x44b604]
mov ebx, dword [esi + 0x30]
xor ecx, ecx
test ebx, ebx
setne cl
mov edi, 1
jmp dword [ecx*4 + 0x44b5f4]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
add dword [eax + eax + 0x27], eax
add al, byte [eax + eax + 1]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edi], ah
add al, byte [eax + eax + 1]
add byte [eax], al
add byte [0x97004402], ch
add dword [eax + eax - 0x80], eax
add dword [eax + eax - 0x53], eax
add dword [eax + eax - 0x80], eax
add dword [eax + eax + 0x18], eax
add al, byte [eax + eax + 0x2d]
add al, byte [eax + eax - 0x79]
add dword [eax + eax - 0x24], eax
add al, byte [eax + eax - 0x22]
add al, byte [eax + eax + 7]
add al, 0x44
add byte [eax + 3], dh
inc esp
add al, ah
add eax, dword [eax + eax - 0xe]
add eax, dword [eax + eax - 0x20]
add eax, dword [eax + eax - 0x20]
add eax, dword [eax + eax - 0x1a]
add eax, dword [eax + eax - 0x20]
add eax, dword [eax + eax + 0x5d]
add eax, dword [eax + eax + 7]
add al, 0x44
add byte [ebx + 3], ch
inc esp
add byte [ebx], bl
add al, 0x44
add byte [edi - 0x4affbbfc], dl
add al, 0x44
add byte [ebp + 0x1e004404], dh
Function at 0x440530
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x999a9bac
mov eax, 0x6d5bf89c
mov edx, 0x12a40764
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x6d5bf89c]
mov edi, esi
and edi, 0x2f
xor edi, 0x2050902f
mov ebx, esi
xor ebx, 0x2050902f
or esi, 0xd0
and esi, ebx
or esi, edi
mov edi, edx
and edi, 0x27
mov ebx, edx
or ebx, 0xdfaf6fd0
add ebx, eax
or ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0xf8
mov byte [esp + eax - 0x6d5bf89c], bl
inc eax
dec edx
cmp eax, 0x6d5bf8a0
jne 0x440550
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44b674]

Function at 0x440630
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x44]
movzx eax, word [eax]
mov dword [esp], 0xb7b6effd
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9e
xor dl, byte [esp + ecx]
add dl, 0xea
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne case.default.0x44066e
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44b694]
Function at 0x440e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x440e90
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov eax, esi
not eax
and eax, ecx
xor ecx, esi
add eax, eax
sub eax, ecx
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x440ebc
mov eax, 0xffffffff
jmp 0x440ebf
add eax, 0xa
push eax
call fcn.00408580
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [edi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [esi]
test bx, bx
je 0x440f01
add esi, 2
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [esi]
add esi, 2
test bx, bx
jne 0x440ef0
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and edi, 2
mov esi, edi
xor esi, 2
imul esi, edx
or ecx, 2
imul ecx, edi
lea edx, [ecx + esi]
mov word [esp + 8], dx
add ecx, esi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf4f5f6f7
xor ecx, ecx
nop
nop
movzx esi, byte [esp + ecx]
mov edx, ecx
or edx, 0x9cdb5cd4
xor edx, esi
mov esi, edx
not esi
add edx, 0xdb
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x440f70
mov esi, dword [esp]
mov ecx, dword [0x44dee4]
test ecx, ecx
je 0x441012
xor edx, edx
mov edi, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440fd0
inc edx
cmp ecx, edx
jne 0x440fc0
jmp 0x441012
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x441012
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44deec]
mov edi, eax
call fcn.0043e980
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408590
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret