joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435bf0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.0040e590
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435c29
jmp 0x435d76
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x435d70
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00431e40
add esp, 4
jmp 0x435c82
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x435c94
jmp 0x435d5f
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040cbb0
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00431eb0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x71
mov byte [edi + 1], 0xaf
mov byte [edi + 2], 0xad
mov byte [edi + 3], 0xa9
mov byte [edi + 4], 0x96
mov byte [edi + 5], 0xb6
mov byte [edi + 6], 0x89
mov byte [edi + 7], 0xbb
mov byte [edi + 8], 0x88
mov byte [edi + 9], 0x71
mov byte [edi + 0xa], 0xbe
mov byte [edi + 0xb], 0xb9
mov byte [edi + 0xc], 0xbc
mov byte [edi + 0xd], 0x2f
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x435d04
xor eax, eax
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
cmp eax, 0x10
jae 0x435d32
mov dh, byte [edi + eax]
mov dl, al
add dl, 0x8b
xor dl, dh
add dl, 0x49
mov byte [edi + eax], dl
add eax, 1
jmp 0x435d18
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.0040d7b0
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.0040cbc0
add esp, 4
jmp 0x435d5d
jmp 0x435d5f
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x435d70
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edx, dword [esp + 0x3c]
mov edi, 0xffffffff
mov ecx, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edi
add ecx, 3
cmp byte [edx + edi + 1], 0
lea edi, [edi + 1]
jne 0x43aec0
shr ecx, 2
movzx eax, byte [edx + edi - 1]
cmp eax, 0x3d
je 0x43aee1
cmp eax, 0x2e
jne 0x43aee2
dec ecx
movzx eax, byte [edx + edi - 2]
cmp eax, 0x3d
je 0x43aef1
cmp eax, 0x2e
jne 0x43aef2
dec ecx
mov dword [esp + 4], ecx
mov edx, 0
test edi, edi
je 0x43aff3
xor ebx, ebx
mov ebp, 2
jmp 0x43af22
mov edx, ebx
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov ebx, edx
cmp ebp, edi
mov ebp, eax
jae 0x43aff3
mov eax, dword [esp + 0x3c]
mov esi, edi
mov edi, eax
movzx eax, byte [eax + ebp - 2]
push eax
call fcn.00422200
add esp, 4
mov byte [esp], al
movzx eax, byte [edi + ebp - 1]
mov edi, esi
mov esi, ebx
push eax
call fcn.00422200
add esp, 4
mov ebx, eax
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, byte [esp]
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x40]
mov byte [ecx + esi], al
lea edx, [esi + 1]
cmp ebp, edi
jae 0x43af10
mov eax, dword [esp + 0x3c]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00422200
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43af10
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x40]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, edi
jae 0x43af0c
mov ecx, dword [esp + 0x3c]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.00422200
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x43af10
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x40]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x43af10
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x43b085
mov esi, dword [esp + 0x40]
lea edx, [esi + 0x20]
lea edi, [esp + 8]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x28]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x43b081
cmp ebx, 0x21
je 0x43b06b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 8]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 8]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x43b040
test bl, 1
je 0x43b081
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 8]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]

Function at 0x43e100
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 0xc
mov esi, dword [esp + 0x18]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x44d928]

Function at 0x43e1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
mov eax, 0x59
mov ecx, 0x26
nop
nop
nop
mov esi, ecx
and esi, 0x3e
mov edx, eax
and edx, 0x41
or edx, esi
xor dl, byte [esp + eax - 0x59]
xor dl, 0xbe
add dl, 0xc3
mov byte [esp + eax - 0x59], dl
inc eax
dec ecx
cmp eax, 0x5f
jne 0x43e1d0
mov edi, dword [esp]
mov eax, dword [0x44fabc]
test eax, eax
je 0x43e246
xor ecx, ecx
mov edx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43e220
inc ecx
cmp eax, ecx
jne 0x43e210
jmp 0x43e246
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e246
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44fac4]
push eax
call fcn.00440ac0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43e355
mov dword [esp + 0xc], ebp
push dword [esp + 8]
call fcn.0043e040
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
mov esi, 0x59
mov edi, 0x26
nop
nop
mov ebp, edi
and ebp, 0x3e
mov edx, esi
and edx, 0x41
or edx, ebp
xor dl, byte [esp + esi - 0x59]
xor dl, 0xbe
add dl, 0xc3
mov byte [esp + esi - 0x59], dl
inc esi
dec edi
cmp esi, 0x5f
jne 0x43e280
mov edi, dword [esp]
mov edx, dword [0x44fabc]
test edx, edx
je 0x43e2f5
xor ebp, ebp
mov esi, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43e2d0
inc ebp
cmp edx, ebp
jne 0x43e2c0
jmp 0x43e2f5
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43e2f5
push 0
push ecx
push eax
push 5
push 4
push dword [0x44fac4]
push edx
mov esi, eax
call fcn.00440ac0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e34c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43e325
add edi, 2
cmp si, bp
je 0x43e310
cmp si, bp
je 0x43e337
mov esi, dword [ecx]
test esi, esi
jne 0x43e300
mov edi, 0xc0000225
jmp 0x43e34c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e100
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43e390
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43e460
xor eax, eax
cmp dword [ecx], 0
jne 0x43e4ab
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
mov eax, 0x59
mov esi, 0x26
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x3e
mov ebx, eax
and ebx, 0x41
or ebx, edi
xor bl, byte [esp + eax - 0x59]
xor bl, 0xbe
add bl, 0xc3
mov byte [esp + eax - 0x59], bl
inc eax
dec esi
cmp eax, 0x5f
jne 0x43e410
mov eax, dword [esp]
mov esi, dword [0x44fabc]
test esi, esi
je 0x43e4ab
xor edi, edi
mov ebx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43e4b4
inc edi
cmp esi, edi
jne 0x43e450
jmp 0x43e4ab
mov dword [esp + 8], 0x579699e0
mov byte [esp + 0xc], 0
xor eax, eax
nop
movzx ecx, byte [esp + eax + 8]
lea edx, [eax + 0xa6]
and edx, ecx
lea esi, [ecx + ecx]
not esi
add esi, ecx
mov ecx, 0x59
sub ecx, eax
and ecx, esi
or ecx, edx
mov dl, 0xc1
sub dl, cl
mov byte [esp + eax + 8], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43e470
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e4ab
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44fac4]
push esi
call fcn.00440ac0
add esp, 0x1c
jmp 0x43e4ab

Function at 0x43e4f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43e59a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
mov edx, 0x59
mov esi, 0x26
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x3e
mov ebx, edx
and ebx, 0x41
or ebx, edi
xor bl, byte [esp + edx - 0x59]
xor bl, 0xbe
add bl, 0xc3
mov byte [esp + edx - 0x59], bl
inc edx
dec esi
cmp edx, 0x5f
jne 0x43e520
mov edx, dword [0x44fabc]
test edx, edx
je 0x43e58e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43e570
inc edi
cmp edx, edi
jne 0x43e560
jmp 0x43e58e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43e58e
push eax
push 1
push dword [0x44fac4]
push edx
mov esi, ecx
call fcn.00440ac0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43e860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e8f4
push 0xf8eb88df
push dword [0x44fab0]
call fcn.00443160
add esp, 8
test eax, eax
je 0x43e8b9
mov ecx, dword [esi]
test ecx, ecx
je 0x43e8f1
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43e8cd
cmp dword [esp], 0
je 0x43e8cd
mov dword [esi + 4], 3
jmp 0x43e8f1
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43e973
lea eax, [esp + 0xc]
push eax
call fcn.00443820
add esp, 4
test al, al
je 0x43e8f1
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e8ee
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43e973
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
mov eax, 0x59
mov edx, 0x26
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x3e
mov ebx, eax
and ebx, 0x41
or ebx, esi
xor bl, byte [esp + eax - 0x59]
xor bl, 0xbe
add bl, 0xc3
mov byte [esp + eax - 0x59], bl
inc eax
dec edx
cmp eax, 0x5f
jne 0x43e920
mov eax, dword [esp]
mov edx, dword [0x44fabc]
test edx, edx
je 0x43ea04
xor esi, esi
mov ebx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43e9e0
inc esi
cmp edx, esi
jne 0x43e960
jmp 0x43ea04
mov dword [esp], 0xe0e7e6e5
mov word [esp + 4], 0
mov eax, 0x59
mov edx, 0x26
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x3e
mov ebx, eax
and ebx, 0x41
or ebx, esi
xor bl, byte [esp + eax - 0x59]
xor bl, 0xbe
add bl, 0xc3
mov byte [esp + eax - 0x59], bl
inc eax
dec edx
cmp eax, 0x5f
jne 0x43e990
mov eax, dword [esp]
mov edx, dword [0x44fabc]
test edx, edx
je 0x43ea04
xor esi, esi
mov ebx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43e9e0
inc esi
cmp edx, esi
jne 0x43e9d0
jmp 0x43ea04
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ea04
push ecx
push ebp
push edi
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push dword [0x44fac4]
push edx
call fcn.00440ac0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43ed30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43ed49
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43ed5a
cmp eax, 2
je 0x43edd0
jmp 0x43edfd
push 0xf8eb88df
push dword [0x44fab0]
call fcn.00443160
add esp, 8
test eax, eax
je 0x43ed9b
mov ecx, dword [esi]
test ecx, ecx
je 0x43edc8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43eda4
cmp dword [esp + 4], 0
je 0x43eda4
mov dword [esi + 4], 3
jmp 0x43edc8
mov dword [esi + 4], 1
jmp 0x43edfd
lea eax, [esp + 0xc]
push eax
call fcn.00443820
add esp, 4
test al, al
je 0x43edc8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43edc5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43edfd
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x457ad8]
call fcn.00443160
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43ee94
mov ecx, dword [esi]
mov dword [esp + 4], 0xe0e7e6e5
mov word [esp + 8], 0
mov eax, 0x59
mov edx, 0x26
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x3e
mov ebx, eax
and ebx, 0x41
or ebx, esi
xor bl, byte [esp + eax - 0x55]
xor bl, 0xbe
add bl, 0xc3
mov byte [esp + eax - 0x55], bl
inc eax
dec edx
cmp eax, 0x5f
jne 0x43ee20
mov eax, dword [esp + 4]
mov edx, dword [0x44fabc]
test edx, edx
je 0x43ee94
xor esi, esi
mov ebx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43ee70
inc esi
cmp edx, esi
jne 0x43ee60
jmp 0x43ee94
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ee94
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44fac4]
push edx
call fcn.00440ac0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43fb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [esp + 0x24], 0x813a8732
mov dword [esp + 0x28], 0x8d36832c
mov dword [esp + 0x2c], 0x89f88f38
mov dword [esp + 0x30], 0x953e8b24
mov dword [esp + 0x34], 0x91969720
mov word [esp + 0x38], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa1
xor cl, byte [esp + eax + 0x24]
add cl, 0xdb
mov byte [esp + eax + 0x24], cl
inc eax
cmp eax, 0x16
jne 0x43fb60
lea eax, [esp + 0x24]
push eax
call fcn.00442c30
add esp, 4
mov dword [0x457ad8], eax
mov esi, 0xf091f20
test eax, eax
je 0x43fb96
mov esi, 0x31901666
lea edi, [esp + 0x1e]
mov ebp, 0x82a91a7d
xor eax, eax
cmp ebp, 0xf2a3a5b1
setl al
mov eax, dword [eax*4 + 0x44d940]
mov ecx, 0x216bbf40
xor ecx, dword [0x44d948]
add eax, ecx
inc eax
jmp eax

Function at 0x440a30
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44dcfc]
Function at 0x4422c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x27c
mov ebx, dword [0x457af4]
mov ebp, dword [0x457af0]
mov eax, ebp
or eax, ebx
jne 0x44234a
mov dword [esp + 0x4c], 0xffa09fa
mov dword [esp + 0x50], 0x3fe0de8
mov dword [esp + 0x54], 0x73401fc
mov dword [esp + 0x58], 0x1be605e0
mov dword [esp + 0x5c], 0x1f1e19e4
mov word [esp + 0x60], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x42
xor cl, byte [esp + eax + 0x4c]
add cl, 0xb6
mov byte [esp + eax + 0x4c], cl
inc eax
cmp eax, 0x16
jne 0x442310
lea eax, [esp + 0x4c]
push eax
call fcn.00441f70
add esp, 4
mov ebp, eax
mov dword [0x457af4], edx
mov dword [0x457af0], eax
jp 0x442384
add byte [ecx], cl
ror byte [edi], 1
test ah, bl
add byte [eax], al
invalid
mov ebx, edx
lea eax, [esp + 0x14c]
push 0x40

Function at 0x442770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov ebx, dword [esp + 0x260]
mov dword [esp + 0x3b], 0xe48040
in al, 0
Function at 0x442c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x43424110
mov word [esp + 8], 0
xor eax, eax
mov ecx, 0x627cca0f
nop
nop
nop
movzx esi, byte [esp + eax + 4]
mov edi, ecx
or edi, esi
not edi
mov edx, eax
xor edx, 0xf
and edx, esi
or edx, edi
add edx, 0xec6ff24f
mov esi, edx
xor esi, 0x67
and edx, 0x18
add edx, edx
sub edx, esi
add dl, 0x68
mov byte [esp + eax + 4], dl
inc eax
dec ecx
cmp eax, 6
jne case.default.0x442c95
Function at 0x443050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xd7d6c938
mov word [esp + 4], 0
mov eax, 0x206c1bae
mov edx, 0xdf93e451
nop
movzx ebx, byte [esp + eax - 0x206c1bae]
mov esi, edx
or esi, ebx
lea ebp, [edx + 0x206c1bc0]
mov ecx, ebp
and ecx, 0x16
mov edi, eax
and edi, 0x89
or edi, ecx
and ebp, 0x1a
mov ecx, eax
and ecx, 0x85
or ecx, ebp
xor edi, 0x36
xor ecx, 0x3a
and ecx, edi
not ebx
or ebx, ecx
and ebx, esi
mov ecx, ebx
xor ecx, 0xd9
not ebx
and ebx, 0x59
add ebx, ebx
sub ebx, ecx
add bl, 0xc0
mov byte [esp + eax - 0x206c1bae], bl
inc eax
dec edx
cmp eax, 0x206c1bb4
jne 0x443070
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x1c], 0
sete cl
jmp dword [ecx*4 + 0x44e5d0]

Function at 0x443160
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x2c]
movzx eax, word [esi]
mov dword [esp], 0x3025b4d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x129c69ff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x129c69ff]
lea edi, [ecx - 0x129c697f]
and edi, edx
add edi, edi
sub edx, edi
add edx, ecx
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [esp + ecx - 0x129c69ff], dl
inc ecx
cmp ecx, 0x129c6a06
jne 0x443190
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44e620]

Function at 0x4433a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edx + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x4433c0
mov dword [esp], 0x22222093
mov dword [esp + 8], ecx
neg ecx
mov dword [esp + 4], ecx
mov edi, 0x894f12b7
mov ecx, 0xc686ef47
mov ebx, 0x76b0ee48
mov esi, 0x397910b8
nop
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
movzx ebx, byte [esp + edi + 0x76b0ed49]
mov dword [esp + 0xc], ebx
mov edx, esi
xor edx, ebx
or edx, ecx
mov ebx, edx
not ebx
mov ecx, ebx
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
mov ebp, edx
and ebp, 2
and ecx, 0xb9
imul ebp, ecx
shr edx, 1
and edx, 1
imul edx, ecx
add ebp, ebx
lea edx, [ebx + edx*2]
mov ebx, dword [esp + 0x10]
mov ecx, edi
sub ecx, edx
add ebp, ebx
mov edx, dword [esp + 0xc]
and ecx, edx
not edx
and edx, ebp
sub ecx, edx
add cl, 0x68
mov byte [esp + edi + 0x76b0ed49], cl
mov ecx, dword [esp + 0x14]
inc edi
dec ecx
dec ebx
inc esi
cmp edi, 0x894f12bb
jne 0x4433f0
cmp dword [esp + 8], 0
je 0x4434a9
mov edx, dword [esp]
mov ecx, edx
not ecx
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 4]
nop
nop
nop
nop
movsx esi, byte [ebx]
inc ebx
mov edi, eax
and edi, esi
add eax, esi
add edi, edi
sub eax, edi
mov esi, eax
or esi, edx
mov edi, eax
and edi, edx
imul edi, esi
mov esi, eax
not esi
and esi, edx
and eax, ecx
imul eax, esi
add eax, edi
inc ebp
jne 0x443480
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4436b3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp + 0x3c]
lea ecx, [edx + ebp]
mov edx, dword [ebp + edx]
mov dword [esp + 4], 0xf10ec8bc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xfd
xor bl, byte [esp + eax + 4]
add bl, 0xf
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 4
jne case.default.0x4436f1
mov eax, dword [esp + 4]
xor ebx, ebx
cmp edx, eax
setne bl
jmp dword [ebx*4 + 0x44e6f0]

Function at 0x443a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x3c]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + esi + 2], 0
lea esi, [esi + 2]
jne 0x443a50
sar esi, 1
lea ebx, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x443a75
mov eax, 0xffffffff
jmp 0x443a77
add eax, eax
push eax
call fcn.0040cbb0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x443ac2
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x443ab0
mov word [ecx], 0
mov ecx, ebx
and ecx, 0xfffd
and esi, 2
mov edx, esi
xor edx, 2
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp + 8], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov ecx, esp
mov edx, 0xd5
nop
nop
nop
nop
movzx esi, byte [ecx]
lea ebx, [edx - 0x6e7ce300]
or ebx, esi
and esi, edx
not ebx
or ebx, esi
mov esi, ebx
and esi, 0x60
xor ebx, 0xe0
lea ebx, [ebx + esi*2]
add bl, 0x4e
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xcf
jne 0x443b40
mov esi, dword [esp]
mov ecx, dword [0x44fabc]
test ecx, ecx
je 0x443bd4
xor edx, edx
mov ebx, dword [0x44fac0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x443ba0
inc edx
cmp ecx, edx
jne 0x443b90
jmp 0x443bd4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443bd4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x44fac4]
push ecx
mov edi, eax
call fcn.00440ac0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cbc0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret