joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427f30
Capabilities:
Encode data using xor
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov dword [esp + 4], 0x7f32795d
mov dword [esp + 8], 0x63057def
mov dword [esp + 0xc], 0x670a6101
mov dword [esp + 0x10], 0x6bfa6525
mov dword [esp + 0x14], 0x6f2a69f8
mov dword [esp + 0x18], 0x93066d0d
mov dword [esp + 0x1c], 0x97b391f1
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x9594
mov dword [esp + 0x22], 0
mov ecx, 0x6a
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x66]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xee
mov byte [esp + ecx - 0x66], dl
inc ecx
cmp ecx, 0x8c
jne 0x427f90
lea ebx, [esp + 0x76]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x92]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x64]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x450b14]
mov esi, dword [esp + 0x64]
mov edi, 0xffffffff
test esi, esi
jns 0x428000
mov eax, 0xffffffff
jmp 0x428003
lea eax, [esi + esi]
push eax
call fcn.0040ce70
add esp, 4
push ebp
push esi
mov dword [esp + 0x5c], eax
push eax
push 0xe
push ebx
push 0
call dword [0x450b14]
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
js 0x428030
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040ce70
add esp, 4
mov dword [esp], eax
mov dword [esp + 4], 0x33e231d4
mov dword [esp + 8], 0x3fdd3ddd
mov dword [esp + 0xc], 0x3bdb39d3
mov dword [esp + 0x10], 0xc72bc52b
mov dword [esp + 0x14], 0xc3c2c133
mov dword [esp + 0x18], 0
mov eax, 0x74
mov ecx, 0x1f3e3d8b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x70]
mov edx, eax
and edx, ebx
mov esi, edx
and esi, 2
mov ebp, edx
or edx, 2
imul edx, esi
xor esi, 2
and ebp, 0xfffffffd
imul ebp, esi
add edx, ebp
lea esi, [eax + ebx]
add esi, 0xe0c1c200
mov ebp, ecx
sub ebp, ebx
and ebp, edx
not edx
and edx, esi
sub edx, ebp
add dl, 0xbc
mov byte [esp + eax - 0x70], dl
inc eax
dec ecx
cmp eax, 0x8c
jne 0x428080
mov edi, dword [esp + 0x54]
movzx ecx, word [edi]
mov esi, dword [esp]
mov eax, esi
test cx, cx
je 0x4280f1
lea edx, [edi + 2]
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4280e0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
mov ebp, dword [esp + 0xa8]
je 0x428121
lea edx, [esp + 6]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428110
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push esi
call fcn.00444a20
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c3b4]
Function at 0x428730
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xf1bdff9b
mov dword [esp + 8], 0xf542f340
mov dword [esp + 0xc], 0xc955f7b0
mov dword [esp + 0x10], 0xcd69cb7c
mov dword [esp + 0x14], 0xc162cfab
mov dword [esp + 0x18], 0xc57ac394
mov dword [esp + 0x1c], 0xd978c773
mov dword [esp + 0x20], 0xdd7ddb7c
mov dword [esp + 0x24], 0xd17cdf6e
mov dword [esp + 0x28], 0xd560d36b
mov dword [esp + 0x2c], 0x297ad770
mov dword [esp + 0x30], 0x2d982b78
mov dword [esp + 0x34], 0x21882f9d
mov dword [esp + 0x38], 0x259e239b
mov dword [esp + 0x3c], 0x39932783
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x3b38
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x55
xor dl, byte [esp + ecx + 4]
add dl, 0x57
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x43
jne 0x4287d0
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x450b14]
mov ebp, dword [esp]
test ebp, ebp
jns 0x42882c
mov eax, 0xffffffff
jmp 0x428833
lea eax, [ebp*2]
push eax
call fcn.0040ce70
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x450b14]
mov dword [esp + 4], 0xb7de89f4
mov dword [esp + 8], 0xb320b529
mov dword [esp + 0xc], 0xbfd3b1dc
mov dword [esp + 0x10], 0xbbd4bd22
mov dword [esp + 0x14], 0xa738b9d1
mov dword [esp + 0x18], 0xa3a2a5c8
mov eax, 0x61
mov ecx, 0x9447669e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6bb89966]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, ecx
and edx, eax
or edx, edi
mov edi, edx
and edi, 0x69
xor edx, 0xe9
lea edx, [edx + edi*2]
inc dl
mov byte [esp + ecx + 0x6bb89966], dl
dec eax
inc ecx
cmp eax, 0x49
jne 0x428890
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.00423920
add esp, 0x14
jmp dword [0x44c3fc]
Function at 0x42b360
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x54], 0x99e69be1
mov dword [esp + 0x58], 0xa5c9a7f3
mov dword [esp + 0x5c], 0xa190a3d7
mov dword [esp + 0x60], 0xadd6afcb
mov dword [esp + 0x64], 0xa9aaabc7
mov byte [esp + 0x68], 0
mov eax, 0x8559649b
mov ecx, 0x64
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x7aa69bb9]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov ebx, edx
and ebx, 0x78
add ebx, ebx
xor edx, 7
sub ebx, edx
mov byte [esp + eax + 0x7aa69bb9], bl
inc eax
dec ecx
cmp eax, 0x855964b0
jne 0x42b3d0
lea esi, [esp + 0x54]
lea ecx, [esp + 0x30]
push esi
call fcn.0043e700
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44cae8]
Function at 0x436530
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4366bf
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x436582
cmp edi, 0
setne al
jmp 0x43658a
jmp 0x43658c
xor ebx, ebx
test al, 1
jne 0x436597
jmp 0x4366b9
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.004321e0
mov esi, eax
cmp esi, 0
setne al
jmp 0x4365b7
xor ebx, ebx
test al, 1
jne 0x4365c2
jmp 0x4366ad
mov ebx, esi
add ebx, 1
mov dword [esp], ebx
call fcn.0040ce70
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00432250
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x59
mov byte [esp + 0x15], 0x83
mov byte [esp + 0x16], 0x85
mov byte [esp + 0x17], 0x81
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x82
mov byte [esp + 0x1a], 0x71
mov byte [esp + 0x1b], 0x87
mov byte [esp + 0x1c], 0x70
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x82
mov byte [esp + 0x1f], 0x81
mov byte [esp + 0x20], 0x9c
mov byte [esp + 0x21], 0xb
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x13
jne 0x436636
xor eax, eax
mov ebp, dword [esp + 0x28]
cmp eax, 0x13
jae 0x43667d
movzx edx, byte [esp + eax + 0x14]
mov ebx, eax
add ebx, 5
mov ecx, edx
xor ecx, 0xffffffff
or ebx, ecx
add ebx, edx
mov ecx, eax
add ecx, 5
or ecx, edx
mov edx, 0xfe
sub edx, ebx
and ecx, edx
add cl, 0xe7
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x436649
jmp 0x43667f
jmp 0x436681
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
call fcn.0040d9d0
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], ebp
call fcn.0040ce80
jmp 0x4366ab
jmp 0x4366ad
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x43bc60
mov eax, esi
and eax, 0xfffffffc
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 3
mov edx, dword [esp]
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
mov ecx, dword [esp]
shr edx, 2
movzx eax, byte [edi + ecx - 1]
cmp eax, 0x3d
je 0x43bc9e
cmp eax, 0x2e
jne 0x43bc9f
dec edx
mov eax, ecx
not eax
and eax, 2
and ecx, 0xfffffffd
sub ecx, eax
movzx eax, byte [edi + ecx]
cmp eax, 0x3d
je 0x43bcb9
cmp eax, 0x2e
jne 0x43bcba
dec edx
mov dword [esp + 8], edx
mov edx, 0
cmp dword [esp], 0
je 0x43bdbc
xor esi, esi
mov ebp, 2
jmp 0x43bcf2
mov edx, dword [esp + 4]
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x43bdbc
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00422700
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.00422700
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
cmp ebp, ecx
jae 0x43bce0
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 8], edx
call fcn.00422700
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x43bce0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea edx, [esi + 2]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x44]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp]
mov ecx, dword [esp]
jae 0x43bcd6
mov ebx, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
call fcn.00422700
add esp, 4
cmp al, 0x40
jne 0x43bd9b
mov edx, dword [esp + 4]
jmp 0x43bdb4
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
and esi, 1
mov edx, dword [esp + 4]
or edx, 1
add edx, esi
mov ecx, dword [esp]
jmp 0x43bce0
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x43be55
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x43be51
cmp ebx, 0x21
je 0x43be3b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x43be10
test bl, 1
je 0x43be51
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e6b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44e6a8]

Function at 0x43e700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xe0e7e6e5
mov byte [esp + 4], 0
mov eax, 0x33dd2a9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x33dd2a9]
lea edx, [eax - 0x33dd200]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, ecx
and edx, 0x32
xor ecx, 0xb2
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x33dd2a9], cl
inc eax
cmp eax, 0x33dd2ae
jne 0x43e730
mov edi, dword [esp]
mov eax, dword [0x450b18]
test eax, eax
je 0x43e7b6
xor ecx, ecx
mov edx, dword [0x450b1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43e790
inc ecx
cmp eax, ecx
jne 0x43e780
jmp 0x43e7b6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e7b6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x450b20]
push eax
call fcn.00441600
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43e8d5
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.0043e630
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xe0e7e6e5
mov byte [esp + 4], 0
mov edx, 0x33dd2a9
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x33dd2a9]
lea edi, [edx - 0x33dd200]
and edi, esi
or esi, edx
xor esi, edi
mov edi, esi
and edi, 0x32
xor esi, 0xb2
lea ecx, [esi + edi*2]
inc cl
mov byte [esp + edx - 0x33dd2a9], cl
inc edx
cmp edx, 0x33dd2ae
jne 0x43e7f0
mov edi, dword [esp]
mov edx, dword [0x450b18]
test edx, edx
je 0x43e875
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x450b1c]
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43e850
inc ebp
cmp edx, ebp
jne 0x43e840
jmp 0x43e875
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43e875
push 0
push ecx
push eax
push 5
push 4
push dword [0x450b20]
push edx
mov esi, eax
call fcn.00441600
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e8cc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43e8a5
add edi, 2
cmp si, bp
je 0x43e890
cmp si, bp
je 0x43e8b7
mov esi, dword [ecx]
test esi, esi
jne 0x43e880
mov edi, 0xc0000225
jmp 0x43e8cc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e6b0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43e920
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43e9f0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ea34
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xe0e7e6e5
mov byte [esp + 4], 0
mov eax, 0x33dd2a9
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x33dd2a9]
lea edi, [eax - 0x33dd200]
and edi, esi
or esi, eax
xor esi, edi
mov edi, esi
and edi, 0x32
xor esi, 0xb2
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + eax - 0x33dd2a9], bl
inc eax
cmp eax, 0x33dd2ae
jne 0x43e990
mov eax, dword [esp]
mov esi, dword [0x450b18]
test esi, esi
je 0x43ea34
xor edi, edi
mov ebx, dword [0x450b1c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43ea3d
inc edi
cmp esi, edi
jne 0x43e9e0
jmp 0x43ea34
mov dword [esp + 8], 0xcf0e0910
mov word [esp + 0xc], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 4
mov edx, ecx
xor edx, 2
add edx, esi
xor dl, byte [esp + ecx + 8]
add dl, 0xf6
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 6
jne 0x43ea10
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ea34
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x450b20]
push esi
call fcn.00441600
add esp, 0x1c
jmp 0x43ea34

Function at 0x43ea80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43eb3a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xe0e7e6e5
mov byte [esp + 4], 0
mov edx, 0x33dd2a9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x33dd2a9]
lea edi, [edx - 0x33dd200]
and edi, esi
or esi, edx
xor esi, edi
mov edi, esi
and edi, 0x32
xor esi, 0xb2
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x33dd2a9], bl
inc edx
cmp edx, 0x33dd2ae
jne 0x43eab0
mov edx, dword [0x450b18]
test edx, edx
je 0x43eb2e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450b1c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43eb10
inc edi
cmp edx, edi
jne 0x43eb00
jmp 0x43eb2e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43eb2e
push eax
push 1
push dword [0x450b20]
push edx
mov esi, ecx
call fcn.00441600
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43edf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43ee7e
push 0xf8eb88df
push dword [0x450b0c]
call fcn.00443d50
add esp, 8
test eax, eax
je 0x43ee49
mov ecx, dword [esi]
test ecx, ecx
je 0x43ee7b
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ee57
cmp dword [esp], 0
je 0x43ee57
mov dword [esi + 4], 3
jmp 0x43ee7b
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43ef07
lea eax, [esp + 8]
push eax
call fcn.00444680
add esp, 4
test al, al
je 0x43ee7b
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43ee78
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43ef07
mov dword [esp], 0xe0e7e6e5
mov byte [esp + 4], 0
mov eax, 0x33dd2a9
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x33dd2a9]
lea esi, [eax - 0x33dd200]
and esi, edx
or edx, eax
xor edx, esi
mov esi, edx
and esi, 0x32
xor edx, 0xb2
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax - 0x33dd2a9], dl
inc eax
cmp eax, 0x33dd2ae
jne 0x43eea0
mov eax, dword [esp]
mov edx, dword [0x450b18]
test edx, edx
je 0x43efb4
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x450b1c]
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43ef90
inc esi
cmp edx, esi
jne 0x43eef0
jmp 0x43efb4
mov dword [esp], 0xe0e7e6e5
mov byte [esp + 4], 0
mov eax, 0x33dd2a9
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x33dd2a9]
lea esi, [eax - 0x33dd200]
and esi, edx
or edx, eax
xor edx, esi
mov esi, edx
and esi, 0x32
xor edx, 0xb2
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax - 0x33dd2a9], dl
inc eax
cmp eax, 0x33dd2ae
jne 0x43ef20
mov eax, dword [esp]
mov edx, dword [0x450b18]
test edx, edx
je 0x43efb4
xor esi, esi
mov ebx, dword [0x450b1c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43ef80
inc esi
cmp edx, esi
jne 0x43ef70
jmp 0x43efb4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43efb4
push ebp
push edi
push dword [esp + 0x2c]
jmp 0x43ef9e
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43efb4
push dword [esp + 0x2c]
push edi
push ebp
push dword [esp + 0x2c]
push ecx
push 5
push dword [0x450b20]
push edx
call fcn.00441600
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43f309
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43f31a
cmp eax, 2
je 0x43f390
jmp 0x43f3bd
push 0xf8eb88df
push dword [0x450b0c]
call fcn.00443d50
add esp, 8
test eax, eax
je 0x43f35b
mov ecx, dword [esi]
test ecx, ecx
je 0x43f388
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43f364
cmp dword [esp + 4], 0
je 0x43f364
mov dword [esi + 4], 3
jmp 0x43f388
mov dword [esi + 4], 1
jmp 0x43f3bd
lea eax, [esp + 0xc]
push eax
call fcn.00444680
add esp, 4
test al, al
je 0x43f388
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43f385
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43f3bd
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x458b34]
call fcn.00443d50
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f464
mov ecx, dword [esi]
mov dword [esp + 4], 0xe0e7e6e5
mov byte [esp + 8], 0
mov eax, 0x33dd2a9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x33dd2a5]
lea esi, [eax - 0x33dd200]
and esi, edx
or edx, eax
xor edx, esi
mov esi, edx
and esi, 0x32
xor edx, 0xb2
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax - 0x33dd2a5], dl
inc eax
cmp eax, 0x33dd2ae
jne 0x43f3e0
mov eax, dword [esp + 4]
mov edx, dword [0x450b18]
test edx, edx
je 0x43f464
xor esi, esi
mov ebx, dword [0x450b1c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43f440
inc esi
cmp edx, esi
jne 0x43f430
jmp 0x43f464
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f464
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x450b20]
push edx
call fcn.00441600
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44ebdc]
Function at 0x443b58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x3020130
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x40
xor dl, byte [esp + eax]
add dl, 0xc0
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne case.default.0x443b91
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44f5ac]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44f5e4]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44f5c4]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44f5e4]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44f5c4]
cmp eax, dword [eax + eax - 0x4a]
cmp eax, dword [eax + eax + 1]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x100443b], bl
add byte [eax], al
add byte [edx], ah
cmp al, 0x44
add al, ah
cmp eax, dword [eax + eax - 0x11]
cmp eax, dword [eax + eax]
cmp al, 0x44
add byte [edx], ah
cmp al, 0x44
add byte [eax], dl
cmp al, 0x44
add byte [eax], dl
cmp al, 0x44
add byte [eax], dl
cmp al, 0x44
add byte [edx], dl
cmp al, 0x44
add byte [eax], dl
cmp al, 0x44
add byte [eax], dh
cmp al, 0x44
add byte [eax], dh
cmp al, 0x44
add byte [edx], dh
cmp al, 0x44
add byte [eax], dh
cmp al, 0x44
add byte [esp + edi + 0x3d340044], bl
cmp al, 0x44
add byte [edi + 0x3cd00044], dh
inc esp