joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428c0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb4
mov dword [esp + 0x1c], 0x29ed2b0f
mov dword [esp + 0x20], 0x2dbe2fb8
mov dword [esp + 0x24], 0xd135d3e8
mov dword [esp + 0x28], 0xd531d744
mov dword [esp + 0x2c], 0xd926dbff
mov dword [esp + 0x30], 0xdd4fdf2a
mov dword [esp + 0x34], 0xc129c348
mov dword [esp + 0x38], 0xc521c750
mov dword [esp + 0x3c], 0xc9e7cb20
mov dword [esp + 0x40], 0xcd32cfe5
mov dword [esp + 0x44], 0xf119f359
mov dword [esp + 0x48], 0xf563f765
mov dword [esp + 0x4c], 0xf96bfb1b
mov dword [esp + 0x50], 0xfd2cff6a
mov dword [esp + 0x54], 0xe171e364
mov dword [esp + 0x58], 0xe5e6e70c
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x77
xor dl, byte [esp + ecx + 0x1c]
add dl, 0xad
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 0x44
jne 0x428b50
lea ebx, [esp + 0x74]
lea edx, [esp + 0x1c]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb4]
xor ebp, ebp
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x70]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x44aeec]
mov dword [esp + 0x1c], 0x571619c7
mov byte [esp + 0x20], 0
nop
nop
nop
nop
movzx edx, byte [esp + ebp + 0x1c]
mov ecx, ebp
and ecx, 6
mov edi, ebp
xor edi, 0x30c84c6
lea ecx, [edi + ecx*2]
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
add cl, 0x22
mov byte [esp + ebp + 0x1c], cl
add ebp, 0x5dd89f45
mov ecx, ebp
and ecx, 1
xor ebp, 1
lea ebp, [ebp + ecx*2]
mov ecx, ebp
and ecx, 0x1b
or ebp, 0xa22760bb
add ebp, ecx
cmp ebp, 5
jb case.default.0x428c03
xor ecx, ecx
cmp eax, dword [esp + 0x1c]
setne cl
jmp dword [ecx*4 + 0x4460d4]
mov ebp, dword [esp + 0x70]
test ebp, ebp
jns 0x428c28
mov eax, 0xffffffff
jmp 0x428c2f
xor eax, eax
jmp dword [0x4460e4]
lea eax, [ebp*2]
push eax
call fcn.00409730
add esp, 4
mov edi, eax
push esi
push ebp
push eax
push 0x1f
push ebx
push 0
call dword [0x44aeec]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4460ec]
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x42a53b
mov edx, dword [esp + 0x10]
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [edx + esi]
xor edi, eax
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
sub edi, ebx
mov eax, edi
shr eax, 1
not edi
mov ebx, edi
or ebx, 1
sub edi, ebx
and edi, 0xedb88320
mov ebx, edi
and ebx, eax
add edi, eax
add ebx, ebx
mov eax, edi
sub eax, ebx
inc esi
cmp ecx, esi
jne 0x42a440
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x436bc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 0xc], 0xb18e8f84
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
lea eax, [esp + 0xc]
mov ecx, 0xe2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [edx + edx]
not esi
add esi, edx
lea ebx, [esi + esi]
not ebx
add ebx, esi
or ebx, ecx
and edx, ecx
not ebx
or ebx, edx
add bl, 0x6f
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0xdb
jne 0x436bf0
mov ecx, dword [esp + 0xc]
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov eax, 0x79534acf
nop
nop
nop
movzx edx, byte [esp + eax - 0x79534acf]
xor edx, eax
mov esi, 0x26
sub esi, edx
add edx, 0x19
and esi, 0x24
and edx, 0xdb
sub edx, esi
mov byte [esp + eax - 0x79534acf], dl
inc eax
cmp eax, 0x79534ad4
jne 0x436c30
mov eax, dword [esp]
mov edx, dword [0x44aef0]
test edx, edx
je 0x436cb1
xor esi, esi
mov edi, dword [0x44aef4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xeb857808
je 0x436c90
inc esi
cmp edx, esi
jne 0x436c80
jmp 0x436cb1
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x436cb1
lea eax, [esp + 0x14]
push eax
push ecx
push 0xffffffffffffffff
push 0xc
push edx
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x18
test eax, eax
js 0x436d30
mov ecx, dword [esp + 0x14]
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov eax, 0x79534acf
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x79534acf]
xor edx, eax
mov esi, 0x26
sub esi, edx
add edx, 0x19
and esi, 0x24
and edx, 0xdb
sub edx, esi
mov byte [esp + eax - 0x79534acf], dl
inc eax
cmp eax, 0x79534ad4
jne 0x436cd0
mov eax, dword [esp]
mov edx, dword [0x44aef0]
test edx, edx
je 0x436d43
xor esi, esi
mov edi, dword [0x44aef4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x8869e8e9
je 0x436d37
inc esi
cmp edx, esi
jne 0x436d20
jmp 0x436d43
xor ebx, ebx
jmp 0x436dde
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x436de7
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov edx, 0x79534acf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x79534acf]
xor ebx, edx
mov esi, 0x26
sub esi, ebx
add ebx, 0x19
and esi, 0x24
and ebx, 0xdb
sub ebx, esi
mov byte [esp + edx - 0x79534acf], bl
inc edx
cmp edx, 0x79534ad4
jne 0x436d60
test eax, eax
setns bl
mov eax, dword [0x44aef0]
test eax, eax
je 0x436dda
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x44aef4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x1b6183f2
je 0x436dc0
inc esi
cmp eax, esi
jne 0x436db0
jmp 0x436dda
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x436dda
push ecx
push 4
push eax
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov eax, esp
lea esi, [esp + 0xc]
push eax
push 4
push esi
push 0x14
push ecx
push 0x14
push edx
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x20
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0xc], 0
setne byte [esp + 0xb]
jmp 0x436d43
Function at 0x4377c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043ec60
add esp, 0x14
test eax, eax
js 0x4378ff
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043f060
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43785a
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x437824
mov eax, 0xffffffff
jmp 0x43782b
lea eax, [eax*2 + 2]
push eax
call fcn.00409730
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.0043f650
add esp, 0x14
test eax, eax
js 0x43784f
mov eax, esi
jmp 0x43785a
push esi
call fcn.00409740
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0xd8dbdac5
mov byte [esp + 8], 0
mov edx, 0x79534acf
nop
movzx ebx, byte [esp + edx - 0x79534acb]
xor ebx, edx
mov esi, 0x26
sub esi, ebx
add ebx, 0x19
and esi, 0x24
and ebx, 0xdb
sub ebx, esi
mov byte [esp + edx - 0x79534acb], bl
inc edx
cmp edx, 0x79534ad4
jne 0x437870
mov edx, dword [0x44aef0]
test edx, edx
je 0x4378ee
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44aef4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x4378d0
inc edi
cmp edx, edi
jne 0x4378c0
jmp 0x4378ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4378ee
push ecx
push 4
push edx
push dword [0x44aef8]
mov esi, eax
call fcn.0043be00
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x437901
lea eax, [esp + 4]
push eax
call fcn.0043e2f0
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x4394c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x14]
mov dword [esp], 0x23222170
mov ecx, 0xf5f8e8b8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0xa071748]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x30206465
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor edx, 0x32237467
add ebx, edx
add ebx, esi
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + ecx + 0xa071748], bl
inc ecx
cmp ecx, 0xf5f8e8bc
jne 0x4394e0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x452f14]
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x4395d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov dword [esp + 8], 0
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov eax, 0xcf
mov ecx, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xcf]
lea edi, [eax - 0x80]
mov edx, eax
and edx, esi
mov ebp, ecx
and ebp, 0x10
and edi, 0x4f
or edi, ebp
xor edi, esi
xor edi, 0x90
not edx
and edx, edi
add dl, 0xf5
mov byte [esp + eax - 0xcf], dl
inc eax
dec ecx
cmp eax, 0xd4
jne 0x439600
mov edi, dword [esp]
mov eax, dword [0x44aef0]
test eax, eax
je 0x439686
xor ecx, ecx
mov edx, dword [0x44aef4]
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x439660
inc ecx
cmp eax, ecx
jne 0x439650
jmp 0x439686
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x439686
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xdf9e999c
mov word [esp + 4], 0
mov eax, 0x5a
mov ecx, 0xa5
nop
nop
movzx edx, byte [esp + eax - 0x5a]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, eax
and edx, ecx
or edx, esi
add dl, 0x3e
mov byte [esp + eax - 0x5a], dl
inc eax
dec ecx
cmp eax, 0x60
jne 0x4396a0
cmp edi, dword [esp]
jne 0x439826
mov dword [esp + 0x10], ebx
push dword [esp + 8]
call fcn.004394c0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov ebp, 0xcf
mov ebx, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebp - 0xcf]
lea esi, [ebp - 0x80]
mov edx, ebp
and edx, ecx
mov edi, ebx
and edi, 0x10
and esi, 0x4f
or esi, edi
xor esi, ecx
xor esi, 0x90
not edx
and edx, esi
add dl, 0xf5
mov byte [esp + ebp - 0xcf], dl
inc ebp
dec ebx
cmp ebp, 0xd4
jne 0x439700
mov edi, dword [esp]
mov edx, dword [0x44aef0]
test edx, edx
je 0x439789
xor esi, esi
mov ebp, dword [0x44aef4]
nop
nop
cmp dword [ebp + esi*8], 0x61813e67
je 0x439761
inc esi
cmp edx, esi
jne 0x439750
jmp 0x439789
mov edx, dword [ebp + esi*8 + 4]
cmp edx, edi
je 0x439789
push 0
push dword [esp + 0x10]
push eax
push 5
push 0x10
push edx
push dword [0x44aef8]
mov esi, eax
call fcn.0043be00
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43981d
mov dword [esp], 0x5312133d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
mov dl, 0x3b
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, dl
and dh, 0x2f
xor dh, byte [esp + ecx]
xor dh, 0xef
add dh, 0x2c
mov byte [esp + ecx], dh
inc ecx
dec dl
cmp ecx, 7
jne 0x4397b0
mov ebx, dword [esp]
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edx + esi]
mov edi, dword [esp + 0x28]
movzx edi, word [edi + esi]
test bp, bp
je 0x4397f9
add esi, 2
cmp bp, di
je 0x4397e0
cmp bp, di
je 0x439808
mov esi, dword [ecx]
test esi, esi
jne 0x4397d0
mov edi, ebx
jmp 0x43981d
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00439550
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x439860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x439930
xor eax, eax
cmp dword [ecx], 0
jne 0x439980
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov eax, 0xcf
mov edx, 0x10
nop
nop
movzx ebp, byte [esp + eax - 0xcf]
lea edi, [eax - 0x80]
mov ebx, eax
and ebx, ebp
mov esi, edx
and esi, 0x10
and edi, 0x4f
or edi, esi
xor edi, ebp
xor edi, 0x90
not ebx
and ebx, edi
add bl, 0xf5
mov byte [esp + eax - 0xcf], bl
inc eax
dec edx
cmp eax, 0xd4
jne 0x4398d0
mov eax, dword [esp]
mov esi, dword [0x44aef0]
test esi, esi
je 0x439980
xor edi, edi
mov ebx, dword [0x44aef4]
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43998a
inc edi
cmp esi, edi
jne 0x439920
jmp 0x439980
mov dword [esp + 8], 0x37f6f9e0
mov byte [esp + 0xc], 0
xor eax, eax
nop
mov ecx, eax
and ecx, 4
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ecx
or ecx, 2
imul ecx, edx
add ecx, esi
mov edx, eax
xor edx, 0x19f00956
mov esi, ecx
and esi, edx
xor edx, ecx
lea ecx, [edx + esi*2]
xor cl, byte [esp + eax + 8]
add cl, 0x52
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 5
jne 0x439940
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x439980
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push dword [esp + 0x44]
push ecx
push 0x10
push esi
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x1c
jmp 0x439980

Function at 0x4399c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x439a7e
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov edx, 0xcf
mov eax, 0x10
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edx - 0xcf]
lea edi, [edx - 0x80]
mov ebx, edx
and ebx, ebp
mov esi, eax
and esi, 0x10
and edi, 0x4f
or edi, esi
xor edi, ebp
xor edi, 0x90
not ebx
and ebx, edi
add bl, 0xf5
mov byte [esp + edx - 0xcf], bl
inc edx
dec eax
cmp edx, 0xd4
jne 0x4399f0
mov edx, dword [0x44aef0]
test edx, edx
je 0x439a71
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44aef4]
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439a50
inc edi
cmp edx, edi
jne 0x439a40
jmp 0x439a71
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x439a71
push dword [esp + 8]
push 4
push edx
push dword [0x44aef8]
mov esi, ecx
call fcn.0043be00
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], ecx
cmp dword [ecx + 8], 0
je 0x439b30
mov eax, dword [esp + 8]
mov ebx, dword [eax]
test ebx, ebx
je 0x439b30
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov eax, 0xcf
mov edi, 0x10
nop
nop
movzx ecx, byte [esp + eax - 0xcf]
lea esi, [eax - 0x80]
mov edx, edi
and edx, 0x10
and esi, 0x4f
or esi, edx
mov edx, eax
and edx, ecx
xor esi, ecx
xor esi, 0x90
not edx
and edx, esi
add dl, 0xf5
mov byte [esp + eax - 0xcf], dl
inc eax
dec edi
cmp eax, 0xd4
jne 0x439ac0
mov eax, dword [esp]
mov esi, dword [0x44aef0]
test esi, esi
je 0x439baa
xor edi, edi
mov edx, dword [0x44aef4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + edi*8], 0xaf0e0c2e
je 0x439b8d
inc edi
cmp esi, edi
jne 0x439b20
jmp 0x439baa
mov dword [esp], 0xa96a6b6c
mov word [esp + 4], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
lea esi, [ecx - 0x5d549199]
xor esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xfc
mov byte [esp + ecx], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 6
sub eax, edx
add eax, ecx
mov ecx, eax
cmp eax, 6
jb 0x439b50
mov eax, dword [esp]
jmp 0x439cc2
mov ecx, dword [edx + edi*8 + 4]
cmp ecx, eax
je 0x439baa
push dword [ebp + 8]
push ebx
push 8
push ecx
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x14
cmp dword [ebp + 0xc], 1
mov ecx, dword [ebp + 0x10]
sbb ecx, 0
jl 0x439cb1
cmp eax, 0xc000010a
jne 0x439cb1
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0x270f
mov edi, esi
and edi, 0xffffd8f0
mov eax, edi
xor eax, 0xffffd8f0
mov ebx, dword [ebp + 0x10]
not ebx
imul ebx, ecx
mul ecx
mov dword [esp + 0xc], eax
mov ecx, edx
add ecx, ebx
or esi, 0xffffd8f0
mov eax, esi
mul edi
mov ebx, dword [ebp + 0x10]
imul ebx, esi
add edx, ebx
sub edx, edi
add eax, dword [esp + 0xc]
adc edx, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov eax, 0xcf
mov esi, 0x10
nop
movzx ebx, byte [esp + eax - 0xcf]
lea edi, [eax - 0x80]
mov ecx, esi
and ecx, 0x10
and edi, 0x4f
or edi, ecx
mov ecx, eax
and ecx, ebx
xor edi, ebx
xor edi, 0x90
not ecx
and ecx, edi
add cl, 0xf5
mov byte [esp + eax - 0xcf], cl
inc eax
dec esi
cmp eax, 0xd4
jne 0x439c30
mov eax, dword [esp]
mov esi, dword [0x44aef0]
test esi, esi
je 0x439cb1
xor edi, edi
mov ecx, dword [0x44aef4]
nop
nop
nop
cmp dword [ecx + edi*8], 0x4c697c35
je 0x439c90
inc edi
cmp esi, edi
jne 0x439c80
jmp 0x439cb1
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x439cb1
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 0xc
push ecx
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x18
test eax, eax
js 0x439cc2
mov ecx, dword [esp + 8]
mov esi, eax
call fcn.004399c0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x439cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x30]
mov eax, dword [ecx]
mov dword [esp + 8], eax
mov dword [esp], 0xd8dbdac5
mov byte [esp + 4], 0
mov edx, 0xcf
mov ecx, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0xcf]
lea esi, [edx - 0x80]
mov eax, edx
and eax, edi
mov ebp, ecx
and ebp, 0x10
and esi, 0x4f
or esi, ebp
xor esi, edi
xor esi, 0x90
not eax
and eax, esi
add al, 0xf5
mov byte [esp + edx - 0xcf], al
inc edx
dec ecx
cmp edx, 0xd4
jne 0x439d00
test ebx, ebx
jne 0x439d40
lea ebx, [esp + 0xc]
mov eax, dword [esp]
mov edx, dword [0x44aef0]
test edx, edx
je 0x439d9b
xor esi, esi
mov ebp, dword [0x44aef4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + esi*8], 0xe6c7f7c6
je 0x439d71
inc esi
cmp edx, esi
jne 0x439d60
jmp 0x439d9b
mov edx, dword [ebp + esi*8 + 4]
cmp edx, eax
je 0x439d9b
push ebx
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x18]
push 0x14
push edx
push dword [0x44aef8]
call fcn.0043be00
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43aa40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov dword [esp + 0x30], 0x79e67bee
mov dword [esp + 0x34], 0x65f26714
mov dword [esp + 0x38], 0x613063f0
mov dword [esp + 0x3c], 0x6dfa6f0c
mov dword [esp + 0x40], 0x696a6bf8
mov dword [esp + 0x44], 0
mov eax, 0xd023076b
mov ecx, 0x94
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x2fdcf8c5]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
mov edx, esi
and edx, 0x68
xor esi, 0xe8
lea edx, [esi + edx*2]
inc dl
mov byte [esp + eax + 0x2fdcf8c5], dl
inc eax
dec ecx
cmp eax, 0xd0230783
jne 0x43aa90
lea eax, [esp + 0x30]
push eax
call fcn.0043d5c0
add esp, 4
mov dword [0x452f0c], eax
mov dword [esp + 0xc], 0x746f86d8
test eax, eax
je 0x43aae6
mov dword [esp + 0xc], 0x925b346f
mov esi, 0x583e63ff
xor eax, eax
cmp esi, 0x86955d7
setl al
mov eax, dword [eax*4 + 0x4477e4]
mov ecx, 0x63bf344
xor ecx, dword [0x4477ec]
add eax, ecx
inc eax
mov dword [esp + 8], ecx
jmp eax

Function at 0x43bd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447ca0]

Function at 0x43cd30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 0xc], 0xb9ba5577
mov byte [esp + 0x10], 0
mov ecx, 0x1f
mov edx, 0xa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x99
mov ebx, ecx
and ebx, 0x26
or ebx, esi
xor bl, byte [esp + ecx - 0x13]
xor bl, 0xd9
add bl, 0x25
mov byte [esp + ecx - 0x13], bl
inc ecx
dec edx
cmp ecx, 0x24
jne 0x43cd60
xor ecx, ecx
cmp dword [esp + 0xc], eax
setne cl
mov eax, dword [ecx*4 + 0x4480fc]
mov ecx, dword [0x448104]
mov edx, ecx
not edx
or edx, 0x884246bf
add edx, ecx
or ecx, 0x884246bf
mov esi, 0xfffffffe
sub esi, edx
and esi, ecx
add eax, esi
inc eax
jmp eax
Function at 0x43d5c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0x393a3b6c
mov byte [esp + 0xc], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 6
mov edx, ecx
xor edx, 0xb
add edx, esi
xor dl, byte [esp + ecx + 8]
add dl, 0xc9
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 5
jne case.default.0x43d611
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x4485c0]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov edi, dword [case.0x43d611.3]
mov ecx, dword [edx]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x4485c8]
mov dword [esp + 4], ecx
mov ebp, dword [ecx + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov ebx, 1
jmp dword [eax*4 + 0x4485d0]
mov ecx, dword [esp + 0x28]
nop
nop
movzx edx, word [ecx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x43d66f
or edx, 0x20
movzx eax, word [ebp]
lea esi, [eax - 0x41]
cmp si, 0x1a
jae 0x43d67f
or eax, 0x20
mov esi, edi
test dx, dx
je 0x43d691
add ecx, 2
add ebp, 2
cmp dx, ax
je 0x43d660
xor ecx, ecx
cmp dx, ax
sete cl
mov edx, dword [esp + 0x10]
jmp dword [ecx*4 + 0x4485d8]
mov ecx, dword [esp + 4]
jmp dword [ebx*4 + 0x4485f0]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43d6b4
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0x393a3b6c
mov byte [esp + 0xc], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 6
mov edx, ecx
xor edx, 0xb
add edx, esi
xor dl, byte [esp + ecx + 8]
add dl, 0xc9
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 5
jne case.default.0x43d611
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x4485c0]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov edi, dword [case.0x43d611.3]
mov ecx, dword [edx]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x4485c8]
mov dword [esp + 4], ecx
mov ebp, dword [ecx + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov ebx, 1
jmp dword [eax*4 + 0x4485d0]
mov ecx, dword [esp + 0x28]
nop
nop
movzx edx, word [ecx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x43d66f
or edx, 0x20
movzx eax, word [ebp]
lea esi, [eax - 0x41]
cmp si, 0x1a
jae 0x43d67f
or eax, 0x20
mov esi, edi
test dx, dx
je 0x43d691
add ecx, 2
add ebp, 2
cmp dx, ax
je 0x43d660
xor ecx, ecx
cmp dx, ax
sete cl
mov edx, dword [esp + 0x10]
jmp dword [ecx*4 + 0x4485d8]
mov ecx, dword [esp + 4]
jmp dword [ebx*4 + 0x4485f0]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret