joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0xf0fffefd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edi, edi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp]
mov eax, edi
and eax, 0xa
mov edx, ebp
xor edx, 0xf04e77d5
add edx, eax
xor edx, esi
mov eax, edx
and eax, 1
or edx, 1
add edx, eax
add dl, 0xd6
mov byte [esp + ebp], dl
inc ebp
add edi, 2
cmp ebp, 7
jne 0x43da20
test ebx, ebx
jne 0x43da56
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44f26c]
test ebp, ebp
je 0x43daa7
xor edx, edx
mov esi, dword [0x44f270]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43da80
inc edx
cmp ebp, edx
jne 0x43da70
jmp 0x43daa7
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43daa7
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x68
mov dword [esp + 0x50], 0x139e11a6
mov dword [esp + 0x54], 0x6fda6dd0
mov dword [esp + 0x58], 0x6b1c69dc
mov dword [esp + 0x5c], 0x67d265d8
mov dword [esp + 0x60], 0x636261d4
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
xor eax, eax
nop
nop
nop
movzx edx, byte [esp + eax + 0x50]
lea ecx, [edx + edx]
not ecx
add ecx, edx
mov esi, 0xc3
sub esi, eax
or esi, ecx
lea ecx, [eax + 0x3c]
or ecx, edx
and ecx, esi
add cl, 0xd4
mov byte [esp + eax + 0x50], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x17
jb 0x43e740
lea eax, [esp + 0x50]
push eax
call fcn.004413a0
add esp, 4
mov dword [0x457288], eax
mov dword [esp + 0x2c], 0xc09e65d8
test eax, eax
je 0x43e799
mov dword [esp + 0x2c], 0xac39fa83
mov esi, 0x7d08cac1
xor eax, eax
cmp esi, 0xeaf7a7e3
setl al
mov eax, dword [eax*4 + 0x44bb5c]
mov ecx, 0x44cba813
xor ecx, dword [0x44bb64]
add eax, ecx
inc eax
mov dword [esp + 8], ecx
jmp eax

Function at 0x43fa30
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44bff8]

Function at 0x4413a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0x1060734
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xc1
xor cl, byte [esp + eax + 8]
add cl, 0x3b
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne case.default.0x4413e7
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x44c960]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, dword [0x44c988]
mov dword [esp], 0
mov edi, dword [0x44c9a4]
mov ecx, dword [edx]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x44c968]
mov dword [esp + 4], ecx
mov ebp, dword [ecx + 0x30]
xor eax, eax
test ebp, ebp
setne al
jmp dword [eax*4 + 0x44c970]
mov ecx, dword [esp + 0x28]
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x441458
mov eax, edx
not eax
or eax, 0xffffffdf
add edx, eax
add edx, 0x21
movzx eax, word [ebp]
lea ebx, [eax - 0x41]
cmp bx, 0x1a
jae 0x441471
mov ebx, eax
not ebx
or ebx, 0xffffffdf
add eax, ebx
add eax, 0x21
test dx, dx
je 0x441481
add ebp, 2
add ecx, 2
cmp dx, ax
je 0x441440
xor ecx, ecx
cmp dx, ax
sete cl
mov edx, dword [esp + 0x10]
jmp dword [ecx*4 + 0x44c978]
jmp esi
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x18]
mov dword [esp], eax
xor eax, eax
jmp dword [eax*4 + 0x44c990]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441860
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xb18e8f5c
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
lea edx, [eax + eax]
mov esi, edx
and esi, 0xa
mov ebx, eax
xor ebx, 0x5d
add ebx, esi
xor bl, byte [esp + eax]
add bl, 0x2f
mov byte [esp + eax], bl
and edx, 2
xor eax, 1
add eax, edx
cmp eax, 8
jb case.default.0x4418b2
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44ca40]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44ca48]
mov edi, 1
jmp dword [edi*4 + 0x44ca58]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44ca48]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44ca50]
mov eax, dword [esi + 0x28]
xor edi, edi
jmp dword [edi*4 + 0x44ca58]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x441930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x40]
movzx eax, word [esi]
mov dword [esp], 0x4342bb8d
mov dword [esp + 4], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x10
xor dl, byte [esp + ecx]
add dl, 0xb0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne case.default.0x44196e
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44ca60]
mov ebx, dword [edx + edi + 0x78]
mov esi, dword [edx + edi + 0x7c]
test esi, esi
sete ch
test ebx, ebx
sete cl
or cl, ch
movzx ecx, cl
jmp dword [ecx*4 + 0x44ca70]
mov dword [esp + 0x10], esi
mov eax, dword [edx + ebx + 0x20]
add eax, edx
mov dword [esp + 0x28], eax
mov eax, dword [edx + ebx + 0x24]
add eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [edx + ebx + 0x1c]
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebx
mov ecx, dword [edx + ebx + 0x18]
lea eax, [edx - 1]
mov dword [esp + 0x24], eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x20], ecx
cmp edi, ecx
setb bl
mov dword [esp + 8], 2
jmp dword [ebx*4 + 0x44ca78]
mov eax, dword [esp + 0x28]
mov ebx, dword [eax + edi*4]
lea ecx, [edx + ebx]
add ebx, dword [esp + 0x24]
mov eax, ecx
inc ebx
cmp byte [eax], 0
lea eax, [eax + 1]
jne 0x441a70
mov esi, ecx
not esi
and esi, ebx
mov dword [esp], 0x727e7ce9
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 0xea
sub dl, al
xor dl, byte [esp + eax]
mov dh, 0x96
sub dh, dl
mov byte [esp + eax], dh
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 4
jb 0x441a90
mov dword [esp + 0xc], edi
add esi, esi
xor ebx, ecx
mov ebp, esi
sub ebp, ebx
je 0x441ad0
mov edi, dword [esp]
sub ebx, esi
cmp ebx, 0xfffffffc
jbe 0x441ae0
mov ebx, 0x3205b60c
jmp 0x441b1b
mov eax, 0x3205b60c
jmp 0x441b40
mov edx, ebp
and edx, 0xfffffffc
mov ebx, 0x3205b60c
nop
nop
nop
nop
nop
nop
movsx eax, byte [ecx]
xor eax, ebx
imul eax, edi
movsx esi, byte [ecx + 1]
xor esi, eax
imul esi, edi
movsx eax, byte [ecx + 2]
xor eax, esi
imul eax, edi
movsx ebx, byte [ecx + 3]
xor ebx, eax
imul ebx, edi
add ecx, 4
add edx, 0xfffffffc
jne 0x441af0
mov eax, ebx
and ebp, 3
je 0x441b40
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [ecx + edx]
xor eax, ebx
imul eax, edi
inc edx
mov ebx, eax
cmp ebp, edx
jne 0x441b30
xor ecx, ecx
cmp eax, dword [esp + 0x44]
setne cl
jmp dword [ecx*4 + 0x44ca80]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
xor ecx, ecx
mov ebp, dword [esp + 0x1c]
cmp eax, ebp
setae cl
mov ebx, dword [esp + 0x40]
jmp dword [ecx*4 + 0x44ca88]
xor ecx, ecx
cmp dword [esp + 8], 2
sete cl
jmp dword [ecx*4 + 0x44caa8]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4421b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4421d0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4421eb
mov eax, 0xffffffff
jmp 0x4421ee
add eax, 0xa
push eax
call fcn.004083e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x442231
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x442220
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov ecx, 0xd7bde360
mov edx, 0x9f
nop
nop
nop
movzx esi, byte [esp + ecx + 0x28421ca0]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
add edi, 0xc94a8f1f
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + ecx + 0x28421ca0], bl
inc ecx
dec edx
cmp ecx, 0xd7bde366
jne 0x4422b0
mov esi, dword [esp]
mov ecx, dword [0x44f26c]
test ecx, ecx
je 0x442352
xor edx, edx
mov edi, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x442310
inc edx
cmp ecx, edx
jne 0x442300
jmp 0x442352
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x442352
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44f274]
mov edi, eax
call fcn.0043fac0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004083f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x442390
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4423ab
mov eax, 0xffffffff
jmp 0x4423ae
add eax, 0xa
push eax
call fcn.004083e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x4423f1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x4423e0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
add ecx, ebx
mov word [esp + 8], cx
mov edx, ecx
and edx, 2
or ecx, 2
add ecx, edx
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov ecx, 0xd7bde360
mov edx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x28421ca0]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add ebx, 0xc94a8f1f
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
mov byte [esp + ecx + 0x28421ca0], bl
inc ecx
dec edx
cmp ecx, 0xd7bde366
jne 0x442480
mov esi, dword [esp]
mov ecx, dword [0x44f26c]
test ecx, ecx
je 0x442514
xor edx, edx
mov ebx, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x4424e0
inc edx
cmp ecx, edx
jne 0x4424d0
jmp 0x442514
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x442514
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44f274]
mov edi, eax
call fcn.0043fac0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004083f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x442550
mov esi, eax
sar esi, 1
and eax, 8
mov ecx, esi
xor ecx, 4
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x442578
mov eax, 0xffffffff
jmp 0x44257f
lea eax, [ebx*2 + 2]
push eax
call fcn.004083e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x4425c1
add edi, 2
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x4425b0
mov word [ecx], 0
and esi, 2
mov ecx, esi
xor ecx, 2
mov edx, ebx
and edx, 0xfffd
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xbcbdbebf
mov word [esp + 0x24], 0
mov ecx, 0xd7bde360
mov edx, 0x9f
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x28421cc0]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
add edi, 0xc94a8f1f
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + ecx + 0x28421cc0], bl
inc ecx
dec edx
cmp ecx, 0xd7bde366
jne 0x442640
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44f26c]
test ecx, ecx
je 0x4426c9
xor edx, edx
mov edi, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x4426a0
inc edx
cmp ecx, edx
jne 0x442690
jmp 0x4426c9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4426c9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44f274]
mov edi, eax
call fcn.0043fac0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.004083f0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4426df
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4426f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0xd7bde360
mov edx, 0x9f
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x28421ca0]
mov ebx, edx
xor ebx, eax
and ebx, ecx
xor ebx, eax
add ebx, 0xc94a8f1f
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax + 0x28421ca0], cl
inc eax
dec edx
cmp eax, 0xd7bde366
jne 0x442720
mov eax, dword [esp]
mov edx, dword [0x44f26c]
test edx, edx
je 0x4427a8
xor ebx, ebx
mov ecx, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x442780
inc ebx
cmp edx, ebx
jne 0x442770
jmp 0x4427a8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x4427a8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x20
test edi, edi
je 0x4427b2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x4427be
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4427d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0xd7bde360
mov ebx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x28421ca0]
mov ebp, ebx
xor ebp, eax
and ebp, edi
xor ebp, eax
add ebp, 0xc94a8f1f
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
mov byte [esp + eax + 0x28421ca0], cl
inc eax
dec ebx
cmp eax, 0xd7bde366
jne 0x442800
mov eax, dword [esp]
mov ebx, dword [0x44f26c]
test ebx, ebx
je 0x44288e
xor ebp, ebp
mov edi, dword [0x44f270]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x442860
inc ebp
cmp ebx, ebp
jne 0x442850
jmp 0x44288e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44288e
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x30
cmp eax, 0x103
jne 0x442949
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0xd7bde360
mov ecx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x28421ca0]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
add esi, 0xc94a8f1f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x28421ca0], dl
inc eax
dec ecx
cmp eax, 0xd7bde366
jne 0x4428c0
mov eax, dword [esp]
mov ecx, dword [0x44f26c]
test ecx, ecx
je 0x442941
xor edx, edx
mov edi, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x442920
inc edx
cmp ecx, edx
jne 0x442910
jmp 0x442941
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x442941
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x18
test eax, eax
js 0x442949
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x442960
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44295e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0xd7bde360
mov ebx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x28421ca0]
mov ebp, ebx
xor ebp, eax
and ebp, edi
xor ebp, eax
add ebp, 0xc94a8f1f
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
mov byte [esp + eax + 0x28421ca0], cl
inc eax
dec ebx
cmp eax, 0xd7bde366
jne 0x4429a0
mov eax, dword [esp]
mov ebx, dword [0x44f26c]
test ebx, ebx
je 0x442a2e
xor ebp, ebp
mov edi, dword [0x44f270]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x442a00
inc ebp
cmp ebx, ebp
jne 0x4429f0
jmp 0x442a2e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x442a2e
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x30
cmp eax, 0x103
jne 0x442ae9
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0xd7bde360
mov ecx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x28421ca0]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
add esi, 0xc94a8f1f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x28421ca0], dl
inc eax
dec ecx
cmp eax, 0xd7bde366
jne 0x442a60
mov eax, dword [esp]
mov ecx, dword [0x44f26c]
test ecx, ecx
je 0x442ae1
xor edx, edx
mov edi, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x442ac0
inc edx
cmp ecx, edx
jne 0x442ab0
jmp 0x442ae1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x442ae1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x18
test eax, eax
js 0x442ae9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x442af7
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x442b20
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0xd7bde360
mov edi, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x28421ca0]
mov ebx, edi
xor ebx, eax
and ebx, ecx
xor ebx, eax
add ebx, 0xc94a8f1f
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax + 0x28421ca0], cl
inc eax
dec edi
cmp eax, 0xd7bde366
jne 0x442bb0
mov eax, dword [esp]
mov edi, dword [0x44f26c]
test edi, edi
je 0x442c35
xor ebx, ebx
mov ebp, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x442c11
inc ebx
cmp edi, ebx
jne 0x442c00
jmp 0x442c35
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x442c35
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 0x10
push edi
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xce9370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xce938e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xd12074
push ecx
mov edi, eax
call fcn.00cfd198
mov esi, eax
add esp, 8
test esi, esi
jne 0xce93cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00cfd02e
push esi
call fcn.00cfcfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret