joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4277d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x44f88c]
mov dword [esp], 0xe3a3e185
mov dword [esp + 4], 0xe776e574
mov dword [esp + 8], 0xdb7bd99c
mov dword [esp + 0xc], 0xdf7fdd48
mov dword [esp + 0x10], 0xd37ed1b5
mov dword [esp + 0x14], 0xd74ed560
mov dword [esp + 0x18], 0xcb54c95d
mov dword [esp + 0x1c], 0xcf6bcd68
mov dword [esp + 0x20], 0xc360c152
mov dword [esp + 0x24], 0xc754c55d
mov dword [esp + 0x28], 0x3b96399c
mov dword [esp + 0x2c], 0x3fac3d8c
mov dword [esp + 0x30], 0x339431af
mov dword [esp + 0x34], 0x37aa35ad
mov dword [esp + 0x38], 0x2bb9298d
mov dword [esp + 0x3c], 0x2d2c
mov ecx, 0x5364e5d8
movzx edx, byte [esp + ecx - 0x5364e5d8]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x47
xor edx, 0xc7
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x5364e5d8], dl
inc ecx
cmp ecx, 0x5364e618
jne 0x427860
lea ebp, [esp + 0x44]
mov ebx, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call eax
mov edi, dword [esp + 0x44]
test edi, edi
jns 0x4278b3
mov eax, 0xffffffff
jmp 0x4278b6
lea eax, [edi + edi]
push eax
call fcn.0040c560
add esp, 4
mov esi, eax
mov eax, dword [0x44f88c]
mov dword [esp], 0x9f5f99bd
mov dword [esp + 4], 0xa3529d6c
mov dword [esp + 8], 0xa747a164
mov dword [esp + 0xc], 0xab4ba550
mov dword [esp + 0x10], 0xaf72a98d
mov dword [esp + 0x14], 0xb35aad78
mov dword [esp + 0x18], 0xb744b145
mov dword [esp + 0x1c], 0xbb5fb550
mov dword [esp + 0x20], 0xbf58b94e
mov dword [esp + 0x24], 0x43b4bd55
mov dword [esp + 0x28], 0x479a41a4
mov dword [esp + 0x2c], 0x4bbc4594
mov dword [esp + 0x30], 0x4fa449bb
mov dword [esp + 0x34], 0x53be4da5
mov dword [esp + 0x38], 0x57a151b5
mov word [esp + 0x3c], 0x5554
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xda
xor dl, byte [esp + ecx]
add dl, 0xbe
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x44
jne 0x427960
push ebp
push edi
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp], 0x57fe4914
mov dword [esp + 4], 0x53e055e9
mov dword [esp + 8], 0x5ff351fc
mov dword [esp + 0xc], 0x5bf45de2
mov dword [esp + 0x10], 0xa71859f1
mov dword [esp + 0x14], 0xa3a2a508
mov word [esp + 0x18], 0
mov eax, 0x2b321bee
mov ecx, 0xd4cde412
nop
nop
movzx edi, byte [esp + eax - 0x2b321bee]
mov edx, eax
and edx, edi
add edx, edx
lea ebp, [eax + edi]
sub edx, edi
add edx, ecx
and ebp, 1
or edx, 1
add edx, ebp
mov bl, 0x5b
sub bl, dl
mov byte [esp + eax - 0x2b321bee], bl
inc eax
dec ecx
cmp eax, 0x2b321c08
jne 0x4279c0
push 0
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0x6c]
call fcn.004222d0
add esp, 0x14
mov ebx, eax
jmp dword [0x44b408]
Function at 0x42a030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x910a9f09
mov dword [esp + 0x58], 0x95319337
mov dword [esp + 0x5c], 0x8948970b
mov dword [esp + 0x60], 0x8d028b2f
mov dword [esp + 0x64], 0x818e8f2b
mov word [esp + 0x68], 0
mov byte [esp + 0x6a], 0
mov eax, 0x2aec865
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x2aec811]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 6
mov byte [esp + eax - 0x2aec811], cl
inc eax
cmp eax, 0x2aec87c
jne 0x42a0a0
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043db50
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44bad0]
Function at 0x42e700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42e75a
cmp edi, 1
je 0x42e75a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42e731
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42e730
cmp ecx, 0x20
je 0x42e730
cmp ecx, 0x2b
mov edx, edi
je 0x42e750
cmp ecx, 0x2d
jne 0x42e76f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42e774
xor edi, edi
test eax, eax
je 0x42e92d
mov dword [eax], 0x16
jmp 0x42e92d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42e79d
cmp edx, 0x10
jne 0x42e7b5
cmp byte [ebx], 0x30
jne 0x42e796
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42e7b7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42e7b7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42e810
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42e8c8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42e837
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42e8f8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42e8f8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42e7f0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42e880
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42e889
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42e8ad
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42e8dd
test bl, bl
jne 0x42e8dd
mov ebx, dword [esp + 0x10]
jmp 0x42e803
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42e7e5
mov esi, edi
test bl, bl
jne 0x42e8eb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42e7e5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42e906
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42e914
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42e924
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42e92d
cmp byte [esp + 3], 0
jne 0x42e92d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435320
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.0040dd20
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435359
jmp 0x43548b
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x435385
cmp eax, 0
setne cl
jmp 0x43538d
xor ebx, ebx
test cl, 1
jne 0x435399
jmp 0x435485
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0040c7b0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
mov ecx, dword [ebp - 0x14]
jne 0x4353ce
jmp 0x435477
mov cl, byte [edi]
mov byte [ebp - 0x10], cl
mov byte [esi], 0x27
mov byte [esi + 1], 0xd
mov byte [esi + 2], 0xf
mov byte [esi + 3], 7
mov byte [esi + 4], 0xa
mov byte [esi + 5], 6
mov byte [esi + 6], 0x33
mov byte [esi + 7], 0x1d
mov byte [esi + 8], 0xc
mov byte [esi + 9], 0xc3
mov byte [esi + 0xa], 2
mov byte [esi + 0xb], 7
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], 0x8d
mov ecx, 0xe
mov byte [esi + ecx], 0
add ecx, 1
cmp ecx, 0x12
jne 0x43540f
jmp 0x43541d
xor ecx, ecx
cmp ecx, 0x12
jae 0x43544c
movzx edi, byte [esi + ecx]
mov edx, 0x59
sub edx, ecx
or edx, edi
xor edi, 0xffffffff
mov ebx, ecx
add ebx, 0xa6
or ebx, edi
and edx, ebx
mov bl, 0xc1
sub bl, dl
mov byte [esi + ecx], bl
add ecx, 1
jmp 0x43541f
jmp 0x43544e
jmp 0x435450
jmp 0x435452
jmp 0x435454
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040d050
mov bl, al
and bl, 1
mov ecx, dword [ebp - 0x14]
jmp 0x435477
sub esp, 4
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x435485
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x439da0
lea esi, [ecx + edx]
add esi, 0xfffffffe
add edx, ecx
mov edi, 1
sub edi, edx
and edi, ecx
mov edx, ecx
not edx
and edx, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
sub edx, edi
mov dword [esp + 8], edx
mov dword [esp], 0x22222093
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor esi, esi
mov ebp, 0x94df43c7
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, esi
xor ebx, 0x94df43c7
and ebx, ebp
mov edx, ebx
not edx
or edx, edi
sub ebx, edi
add ebx, edx
lea edx, [esi + 0x6b20bc38]
or edx, edi
and edx, ebx
add dl, 0xe8
mov byte [esp + esi], dl
dec ebp
inc esi
cmp esi, 7
jne 0x439df0
mov edx, dword [esp + 0xc]
cmp edx, dword [esp + 0x10]
je 0x439e92
mov esi, dword [esp]
mov edx, dword [esp + 8]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x439e51
mov ebp, eax
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x439e40
cmp edi, 3
jb 0x439e92
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
movzx edx, word [ecx + edi*2]
xor edx, eax
imul edx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, edx
imul eax, esi
movzx edx, word [ecx + edi*2 + 4]
xor edx, eax
imul edx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, edx
mov edx, ebx
imul eax, esi
add edi, 4
cmp ebx, edi
jne 0x439e60
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ade0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43aee9
mov ebp, dword [esp + 0x18]
xor eax, eax
mov edi, 2
jmp 0x43ae15
mov ebp, edx
mov eax, dword [esp]
lea ecx, [edi + 4]
add edi, 2
cmp edi, esi
mov edi, ecx
jae 0x43aeeb
mov esi, eax
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00421370
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00421370
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
mov ecx, esi
and ecx, 1
mov edx, ebp
mov ebp, esi
xor ebp, 1
lea ecx, [ecx*2]
add ecx, ebp
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
mov esi, dword [esp + 0x1c]
cmp edi, esi
jae 0x43ae00
movzx eax, byte [edx + edi]
push eax
call fcn.00421370
add esp, 4
cmp al, 0x40
jne 0x43ae80
mov ebp, dword [esp + 0x18]
jmp 0x43ae02
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
and ebp, 1
mov edx, dword [esp]
mov esi, edx
or esi, 1
add esi, ebp
mov ebx, dword [esp + 0x20]
mov byte [ebx + edx], cl
lea ecx, [edi + 1]
cmp ecx, dword [esp + 0x1c]
jae 0x43aeda
mov ebx, eax
mov ebp, dword [esp + 0x18]
movzx eax, byte [ebp + edi + 1]
push eax
call fcn.00421370
add esp, 4
cmp al, 0x40
je 0x43aecf
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
inc esi
mov eax, esi
mov esi, dword [esp + 0x1c]
jmp 0x43ae05
mov eax, esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
jmp 0x43ae05
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43da60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0x37363908
xor ecx, ecx
xor edx, edx
movzx esi, byte [esp + edx]
mov edi, ecx
and edi, 4
mov ebx, edx
xor ebx, 0xe559bd36
add ebx, edi
mov edi, ebx
and edi, esi
mov eax, edi
and eax, 0x3d
mov ebp, edi
or ebp, 0xfd
inc ebp
imul ebp, eax
mov eax, edi
and eax, 2
or edi, 2
imul edi, eax
sub ebp, edi
add ebx, esi
add ebx, ebp
add bl, 0xf2
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 4
jne 0x43da70

Function at 0x43daf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44d668]

Function at 0x43db50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 4], 0
mov dword [esp + 8], 0xfcfdfeff
xor eax, eax
nop
xor byte [esp + eax + 8], al
inc eax
cmp eax, 4
jne 0x43db70
mov edi, dword [esp + 8]
mov eax, dword [0x44f890]
test eax, eax
je 0x43dbc6
xor ecx, ecx
mov edx, dword [0x44f894]
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43dba0
inc ecx
cmp eax, ecx
jne 0x43db90
jmp 0x43dbc6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43dbc6
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f898]
push eax
call fcn.0043ff80
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43dcc4
push dword [esp + 4]
call fcn.0043da60
add esp, 4
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 0xfcfdfeff
xor edx, edx
nop
nop
nop
nop
xor byte [esp + edx + 0xc], dl
inc edx
cmp edx, 4
jne 0x43dbf0
mov edi, dword [esp + 0xc]
mov edx, dword [0x44f890]
test edx, edx
je 0x43dc5c
mov dword [esp], ecx
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44f894]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43dc32
inc ebp
cmp edx, ebp
jne 0x43dc20
mov ebp, ecx
jmp 0x43dc5c
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43dc5c
push 0
push dword [esp + 4]
push eax
push 5
push 4
push dword [0x44f898]
push edx
mov esi, eax
call fcn.0043ff80
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43dcbb
mov dword [esp], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43dc95
add edi, 2
cmp si, bp
je 0x43dc80
cmp si, bp
je 0x43dca7
mov esi, dword [ecx]
test esi, esi
jne 0x43dc70
mov edi, 0xc0000225
jmp 0x43dcbb
mov edx, dword [ecx + 0x44]
mov esi, dword [esp]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043daf0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43dcf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43dd90
xor eax, eax
cmp dword [ecx], 0
jne 0x43dde7
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43dd60
mov eax, dword [esp]
mov esi, dword [0x44f890]
test esi, esi
je 0x43dde7
xor edi, edi
mov ebx, dword [0x44f894]
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43ddf0
inc edi
cmp esi, edi
jne 0x43dd80
jmp 0x43dde7
mov dword [esp + 4], 0x4f0e0910
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x1b706142
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1b70613e]
lea edx, [eax - 0x1b706100]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
xor edx, 0x4b
and ecx, 0x34
add ecx, ecx
sub ecx, edx
inc cl
mov byte [esp + eax - 0x1b70613e], cl
inc eax
cmp eax, 0x1b706149
jne 0x43ddb0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43dde7
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f898]
push esi
call fcn.0043ff80
add esp, 0x1c
jmp 0x43dde7

Function at 0x43de30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43deaa
push ebx
push edi
push esi
push eax
mov dword [esp], 0xfcfdfeff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + edx], dl
inc edx
cmp edx, 4
jne 0x43de50
mov edx, dword [0x44f890]
test edx, edx
je 0x43de9e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f894]
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43de80
inc edi
cmp edx, edi
jne 0x43de70
jmp 0x43de9e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43de9e
push eax
push 1
push dword [0x44f898]
push edx
mov esi, ecx
call fcn.0043ff80
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43deb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], ecx
cmp dword [ecx + 8], 0
je 0x43df28
mov eax, dword [esp + 8]
mov edx, dword [eax]
test edx, edx
je 0x43df28
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43dee0
mov eax, dword [esp]
mov esi, dword [0x44f890]
test esi, esi
je 0x43dfa6
mov ecx, edi
xor edi, edi
mov ebx, dword [0x44f894]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xdef797a3
je 0x43df84
inc edi
cmp esi, edi
jne 0x43df10
mov edi, ecx
mov ebx, dword [ebp + 0xc]
jmp 0x43dfa6
mov dword [esp], 0xc98a8b94
mov byte [esp + 4], 0
mov eax, esp
mov ecx, 0x748bfa1c
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov edx, ecx
or edx, esi
lea edi, [ecx - 0x748bfa00]
and edi, esi
not edx
or edx, edi
lea esi, [edx + edx]
and esi, 0x8d77c520
xor edx, 0xb9441d6f
sub edx, esi
lea esi, [edx*2 + 2]
inc edx
sub edx, esi
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x748bfa17
jne 0x43df40
mov eax, dword [esp]
jmp 0x43e0e8
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
je 0x43dfa6
push dword [ebp + 8]
push edx
push 2
push dword [0x44f898]
push esi
call fcn.0043ff80
add esp, 0x14
cmp ebx, 1
mov edx, edi
sbb edx, 0
jl 0x43e06f
cmp eax, 0xc000010a
jne 0x43e06f
mov esi, ebx
and esi, 0xffffd8f0
mov eax, esi
xor eax, 0xffffd8f0
mov ecx, ebx
mov ebx, edi
not ebx
mov edx, ecx
and edx, 0x270f
imul ebx, edx
mul edx
mov dword [esp + 0x10], eax
add edx, ebx
mov ebx, edx
or ecx, 0xffffd8f0
imul edi, ecx
mov eax, ecx
mul esi
add edx, edi
sub edx, esi
add eax, dword [esp + 0x10]
adc edx, ebx
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov dword [esp + 0xc], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + eax + 0xc], al
inc eax
cmp eax, 4
jne 0x43e020
mov eax, dword [esp + 0xc]
mov esi, dword [0x44f890]
test esi, esi
je 0x43e06f
xor edi, edi
mov ebx, dword [0x44f894]
cmp dword [ebx + edi*8], 0x53f09cfa
je 0x43e050
inc edi
cmp esi, edi
jne 0x43e040
jmp 0x43e06f
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e06f
mov eax, esp
push eax
push 0
push edx
push 3
push dword [0x44f898]
push esi
call fcn.0043ff80
add esp, 0x18
test eax, eax
js 0x43e0e8
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
test edx, edx
je 0x43e0e8
mov dword [esp], 0xfcfdfeff
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + ebx], bl
inc ebx
cmp ebx, 4
jne 0x43e090
mov esi, dword [0x44f890]
test esi, esi
je 0x43e0de
mov ecx, dword [esp]
xor ebx, ebx
mov edi, dword [0x44f894]
nop
nop
cmp dword [edi + ebx*8], 0x7e776f1
je 0x43e0c0
inc ebx
cmp esi, ebx
jne 0x43e0b0
jmp 0x43e0de
mov esi, dword [edi + ebx*8 + 4]
cmp esi, ecx
je 0x43e0de
push edx
push 1
push dword [0x44f898]
push esi
mov edi, eax
call fcn.0043ff80
mov eax, edi
add esp, 0x10
mov ecx, dword [esp + 8]
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43e100
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e187
push 0xf8eb88df
push dword [0x44f884]
call fcn.00442960
add esp, 8
test eax, eax
je 0x43e155
mov ecx, dword [esi]
test ecx, ecx
je 0x43e184
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43e160
cmp dword [esp], 0
je 0x43e160
mov dword [esi + 4], 3
jmp 0x43e184
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43e1d0
lea eax, [esp + 4]
push eax
call fcn.00443190
add esp, 4
test al, al
je 0x43e184
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x43e181
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43e1d0
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43e1a0
mov eax, dword [esp]
mov edx, dword [0x44f890]
test edx, edx
je 0x43e234
xor esi, esi
mov ebx, dword [0x44f894]
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43e210
inc esi
cmp edx, esi
jne 0x43e1c0
jmp 0x43e234
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43e1e0
mov eax, dword [esp]
mov edx, dword [0x44f890]
test edx, edx
je 0x43e234
xor esi, esi
mov ebx, dword [0x44f894]
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43e210
inc esi
cmp edx, esi
jne 0x43e200
jmp 0x43e234
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43e234
push dword [esp + 0x28]
push edi
push ebp
push dword [esp + 0x28]
push ecx
push 5
push dword [0x44f898]
push edx
call fcn.0043ff80
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43e529
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x43e53a
cmp eax, 2
je 0x43e5ac
jmp 0x43e5d6
push 0xf8eb88df
push dword [0x44f884]
call fcn.00442960
add esp, 8
test eax, eax
je 0x43e577
mov ecx, dword [esi]
test ecx, ecx
je 0x43e5a4
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43e580
cmp dword [esp], 0
je 0x43e580
mov dword [esi + 4], 3
jmp 0x43e5a4
mov dword [esi + 4], 1
jmp 0x43e5d6
lea eax, [esp + 4]
push eax
call fcn.00443190
add esp, 4
test al, al
je 0x43e5a4
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x43e5a1
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43e5d6
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x4578a4]
call fcn.00442960
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43e644
mov ecx, dword [esi]
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43e5f0
mov eax, dword [esp]
mov edx, dword [0x44f890]
test edx, edx
je 0x43e644
xor esi, esi
mov ebx, dword [0x44f894]
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43e620
inc esi
cmp edx, esi
jne 0x43e610
jmp 0x43e644
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43e644
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44f898]
push edx
call fcn.0043ff80
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18