joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d130
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x448a78]

Function at 0x43d230
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x250
push dword [0x45298c]
call fcn.0043dcc0
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x448cac]

Function at 0x43dcc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
movzx eax, word [ebx]
mov dword [esp + 0x24], 0x81807d73
mov byte [esp + 0x28], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43dd20
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x24]
add ecx, 0xa4083dd2
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xac
mov edx, dword [esp]
mov byte [esp + edx + 0x24], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43dcf0
xor ecx, ecx
cmp dword [esp + 0x24], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448d6c]
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebx + eax]
mov dword [esp + 0x24], 0xe0e327cd
mov word [esp + 0x28], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x43dd90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x24]
add edx, 0x1751d3ff
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x1e
mov esi, dword [esp]
mov byte [esp + esi + 0x24], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x43dd60
xor edx, edx
cmp ecx, dword [esp + 0x24]
setne dl
jmp dword [edx*4 + 0x448d74]
mov edi, dword [ebx + eax + 0x78]
cmp dword [ebx + eax + 0x7c], 0
sete al
test edi, edi
sete cl
or cl, al
movzx ecx, cl
xor eax, eax
mov dword [esp + 8], edi
jmp dword [ecx*4 + 0x448d8c]
mov ecx, dword [case.0x43dd99.5]
xor eax, eax
nop
nop
jmp ecx
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov dword [esp + 4], 0xe0e3e235
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43e6de
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xb6bb8593
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x8a
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43e6b0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
test ebp, ebp
sete cl
jmp dword [ecx*4 + 0x449224]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
mov edi, dword [case.0x43e6ec.7]
xor eax, eax
mov ebx, dword [0x449260]
xor ecx, ecx
cmp esi, edx
setne cl
jmp dword [ecx*4 + 0x44922c]
mov ebp, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
mov edi, dword [case.0x43e6ec.7]
xor eax, eax
mov ebx, dword [0x449260]
xor ecx, ecx
cmp esi, edx
setne cl
jmp dword [ecx*4 + 0x44922c]
jmp edi
xor ecx, ecx
cmp dword [esi + 0x18], ebp
sete cl
jmp dword [ecx*4 + 0x449244]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43e790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov dword [esp + 4], 0x41405f8e
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43e7ee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x85450d8e
xor eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x30
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43e7c0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test edi, edi
sete dl
jmp dword [edx*4 + 0x449264]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, dword [0x449274]
mov ebx, dword [0x44928c]
mov ebp, dword [edx]
xor eax, eax
jmp case.0x43e7fc.2
jmp esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f1e0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43f1fb
mov eax, 0xffffffff
jmp 0x43f1fe
add eax, 0xa
push eax
call fcn.00409a50
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f241
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f230
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x90919293
mov dword [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x43f2f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x9bc3ec
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0x80
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x43f2c0
mov esi, dword [esp + 4]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43f361
xor edx, edx
mov edi, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x10f02cc2
je 0x43f320
inc edx
cmp ecx, edx
jne 0x43f310
jmp 0x43f361
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43f361
lea esi, [esp + 4]
lea edx, [esp + 0x18]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x60]
push dword [esp + 0x70]
push 0
push esi
push edx
push dword [esp + 0x70]
push dword [esp + 0x70]
push 0xb
push dword [0x44a97c]
push ecx
mov edi, eax
call fcn.0043d1f0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00409a60
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f3a0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43f3bb
mov eax, 0xffffffff
jmp 0x43f3be
add eax, 0xa
push eax
call fcn.00409a50
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f401
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f3f0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x90919293
mov dword [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x43f4b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x9bc3ec
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0x80
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x43f480
mov esi, dword [esp + 4]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43f513
xor edx, edx
mov ebx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x43f4e0
inc edx
cmp ecx, edx
jne 0x43f4d0
jmp 0x43f513
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f513
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push ebp
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44a97c]
push ecx
mov edi, eax
call fcn.0043d1f0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00409a60
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov edi, dword [ebp + 8]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + esi + 2], 0
lea esi, [esi + 2]
jne 0x43f550
sar esi, 1
lea ebx, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43f575
mov eax, 0xffffffff
jmp 0x43f577
add eax, eax
push eax
call fcn.00409a50
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x43f5c1
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x43f5b0
mov word [ecx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ecx, ebx
and ecx, 0xfffd
imul ecx, edx
and esi, 2
or ebx, 2
imul ebx, esi
lea edx, [ebx + ecx]
mov word [esp + 4], dx
add ecx, ebx
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x90919293
mov dword [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x43f680
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x9bc3ec
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x80
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x43f650
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43f6d9
xor edx, edx
mov edi, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x8896be63
je 0x43f6b0
inc edx
cmp ecx, edx
jne 0x43f6a0
jmp 0x43f6d9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43f6d9
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x44a97c]
push ecx
mov edi, eax
call fcn.0043d1f0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00409a60
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43f6ef
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x10], 0x90919293
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x43f763
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0x9bc3ec
xor eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x80
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x43f730
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x44a974]
test edx, edx
je 0x43f7b8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44a978]
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x43f790
inc edi
cmp edx, edi
jne 0x43f780
jmp 0x43f7b8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43f7b8
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x44a97c]
push edx
call fcn.0043d1f0
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43f7c5
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x43f7d1
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x90919293
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43f83e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x9bc3ec
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x80
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43f810
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43f89c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44a978]
cmp dword [ebp + ebx*8], 0x72e9dc72
je 0x43f871
inc ebx
cmp ecx, ebx
jne 0x43f860
jmp 0x43f89c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x43f89c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x43f956
mov dword [esp + 8], 0x90919293
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x43f901
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x9bc3ec
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x80
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x43f8d0
mov eax, dword [esp + 8]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43f94e
xor edx, edx
mov ebx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x43f930
inc edx
cmp ecx, edx
jne 0x43f920
jmp 0x43f94e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43f94e
push 0
push 0
push esi
push 3
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x18
test eax, eax
js 0x43f956
mov eax, dword [esp + 0x10]
test edi, edi
je 0x43f969
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f967
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x90919293
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43f9de
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x9bc3ec
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x80
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43f9b0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43fa3c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44a978]
cmp dword [ebp + ebx*8], 0xe6919031
je 0x43fa11
inc ebx
cmp ecx, ebx
jne 0x43fa00
jmp 0x43fa3c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x43fa3c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x43faf6
mov dword [esp + 8], 0x90919293
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x43faa1
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x9bc3ec
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x80
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x43fa70
mov eax, dword [esp + 8]
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x43faee
xor edx, edx
mov ebx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x43fad0
inc edx
cmp ecx, edx
jne 0x43fac0
jmp 0x43faee
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43faee
push 0
push 0
push esi
push 3
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x18
test eax, eax
js 0x43faf6
mov eax, dword [esp + 0x10]
test edi, edi
je 0x43fb00
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov bx, 0xfffc
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp word [edi + ebp], 0
lea ebp, [ebp + 2]
jne 0x43fb40
add ebp, 0xfffffffe
mov word [esp + 0xc], bp
and ebx, 4
xor ebp, 2
add ebp, ebx
mov word [esp + 0xe], bp
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x90919293
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43fbee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add eax, 0x9bc3ec
xor eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x80
mov edi, dword [esp]
mov byte [esp + edi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43fbc0
mov eax, dword [esp + 4]
mov edi, dword [0x44a974]
test edi, edi
je 0x43fc42
xor ebx, ebx
mov ebp, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x81105f7a
je 0x43fc21
inc ebx
cmp edi, ebx
jne 0x43fc10
jmp 0x43fc42
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43fc42
lea eax, [esp + 0x18]
push esi
push eax
push edx
push ecx
push 4
push dword [0x44a97c]
push edi
call fcn.0043d1f0
add esp, 0x1c
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411d62
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x417678], 0
push ebx
push esi
mov esi, 0x417680
jne 0x411d8e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x417698], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x417678], 1
push dword [0x417698]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x411e2b
push 0x14
push 8
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x411e55
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41767c]
test eax, eax
je 0x411dd0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x41767c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x411e5a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x417698]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x411e55
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x40eb55
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x40eb89
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and ecx, 0xff
movzx eax, byte [esi + eax]
xor eax, ecx
push eax
call fcn.0040eb39
mov ecx, dword [ebp + 8]
shr ecx, 8
xor eax, ecx
inc esi
cmp esi, dword [ebp + 0x10]
mov dword [ebp + 8], eax
jb 0x40eb60
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret 0xc

Function at 0x45362a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x45362a
lcall 0x5de5, 0x8b10c483
jmp fcn.00cf0ec0
Function at 0x419d38
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x15be1a08
insd dword es:[edi], dx
dec esp
xchg esp, eax
sahf
cwde
mov bh, 0x81
mov esi, dword [ebp + 0x2663d64d]
cmp esp, dword [ebp + 0xee09500]
cmp esp, dword es:[ebp + 0xee09500]
rol byte [esi], 0xd6
push es
sbb al, dl
sahf
sbb dh, al
push edi
inc ecx
mov eax, 0x925a925c
xchg byte [edi - 0x43], dh
scasd eax, dword es:[edi]
pop eax
pushfd
xchg esp, eax
push edi
xor byte [eax + 0x3aee1f48], bh
pop ecx
or al, 0x5e
jecxz 0x419d49
mov ebx, 0xb0c6f53d
in eax, dx
xchg edi, eax
inc eax
iretd

Function at 0x65996d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662168
cmp edx, dword [eax]
je 0x65998f
add eax, 8
inc ecx
cmp eax, 0x6621f8
jl 0x659980
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662168]
jne 0x659abd
mov eax, dword [0xa67a90]
cmp eax, 1
je 0x659a97
test eax, eax
jne 0x6599c0
cmp dword [0x662094], 1
je 0x659a97
cmp edx, 0xfc
je 0x659abd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6599f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a350
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a7e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659a3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a7e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65edfc
push edi
call fcn.0065c6b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a350
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a360
lea eax, [ebp - 0xa0]
push 0x65eddc
push eax
call fcn.0065a360
push dword [esi + 0x66216c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a360
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c624
add esp, 0x2c
pop edi
jmp 0x659abd
lea eax, [ebp + 8]
lea esi, [esi + 0x66216c]
push 0
push eax
push dword [esi]
call fcn.0065a7e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret