joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [edi]
test dl, dl
je 0x4134b6
lea ecx, [edi + 1]
xor eax, eax
jmp 0x413479
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4134aa
movzx edi, dl
mov ebp, edi
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x413470
test dl, dl
jns 0x413470
mov edx, edi
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x413470
and edi, 0xfffffff8
cmp edi, 0xf0
jne 0x413471
add eax, 2
jmp 0x413471
mov ebp, eax
inc ebp
jns 0x4134c2
mov eax, 0xffffffff
jmp 0x4134c9
mov eax, 2
mov ebp, 1
jmp 0x4134c9
lea eax, [eax*2 + 2]
push eax
call fcn.00408630
add esp, 4
mov dword [esi], eax
push 0
push dword [esp + 0x18]
push ebp
push eax
call fcn.0040afc0
add esp, 0x10
mov ebp, ebx
movzx edx, byte [ebx]
test dl, dl
je 0x41353a
lea ecx, [ebp + 1]
xor eax, eax
jmp 0x413509
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x41353c
movzx ebx, dl
mov edi, ebx
and edi, 0xfffffff0
cmp edi, 0xe0
je 0x413500
test dl, dl
jns 0x413500
mov edx, ebx
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x413500
and ebx, 0xfffffff8
cmp ebx, 0xf0
jne 0x413501
add eax, 2
jmp 0x413501
xor eax, eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebx, [eax + ecx*2]
test ebx, ebx
jns 0x413552
mov eax, 0xffffffff
jmp 0x413555
lea eax, [ebx + ebx]
push eax
call fcn.00408630
add esp, 4
mov dword [esi + 4], eax
push 0
push ebp
push ebx
push eax
call fcn.0040afc0
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x413700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x413720
lea ecx, [edi + eax]
add ecx, 0xfffffffe
add eax, edi
mov edx, 1
sub edx, eax
and edx, edi
mov ebp, edi
not ebp
and ebp, ecx
sub ebp, edx
mov ebx, dword [esi + 4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x413750
sar ebp, 1
lea edx, [ebx + eax]
add edx, 0xfffffffe
mov ecx, ebx
not ecx
and ecx, edx
add eax, ebx
mov edx, 1
sub edx, eax
and edx, ebx
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ebp]
inc eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x413791
mov eax, 0xffffffff
jmp 0x413793
add eax, eax
push eax
call fcn.00408630
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x4137c1
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4137b0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x4137f1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4137e0
mov word [eax], 0
jmp dword [0x4428d8]
Function at 0x413b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x300
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413b60
sar esi, 1
lea ecx, [esp + 0xc8]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4497f4]
mov ebx, dword [esp + 0xc8]
mov edi, 0xffffffff
test ebx, ebx
jns 0x413b9a
mov eax, 0xffffffff
jmp 0x413b9d
lea eax, [ebx + ebx]
push eax
call fcn.00408630
add esp, 4
lea ecx, [esp + 0xc8]
push ecx
push ebx
mov dword [esp + 0x30], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4497f4]
mov eax, dword [esp + 0xc8]
mov ecx, eax
add ecx, 0xd
js 0x413bd8
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408630
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x138], 0xc172c760
mov dword [esp + 0x13c], 0xcd5fc363
mov dword [esp + 0x140], 0xc92ecf50
mov dword [esp + 0x144], 0xb565cb76
mov dword [esp + 0x148], 0xb12bb726
mov dword [esp + 0x14c], 0xbd23b31b
mov dword [esp + 0x150], 0xb9bebf2a
mov byte [esp + 0x154], 0
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x138]
lea ecx, [eax + eax]
mov esi, ecx
and esi, 0x22
mov edi, eax
xor edi, 0x1c1b27b1
add edi, esi
lea esi, [edi + edi]
not esi
add esi, edi
mov ebx, edi
and ebx, edx
lea edi, [edx + edx]
not edi
add edi, edx
and edi, esi
or edi, ebx
lea edx, [edi + edi]
not edx
add edx, edi
mov esi, edx
xor esi, 0x76
and edx, 9
add edx, edx
sub edx, esi
inc dl
mov byte [esp + eax + 0x138], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x1d
jb 0x413c40
mov eax, dword [esp + 0x28]
movzx ecx, word [eax]
mov edi, dword [esp + 4]
mov eax, edi
test cx, cx
je 0x413cd1
mov eax, dword [esp + 0x28]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413cc0
mov word [eax], 0
movzx ecx, word [esp + 0x138]
test cx, cx
je 0x413d01
lea edx, [esp + 0x13a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413cf0
mov word [eax], 0
lea eax, [esp + 0x30]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043c010
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442df4]
Function at 0x418000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov dword [esp + 8], 0xb1648f5d
mov dword [esp + 0xc], 0xb523b325
mov dword [esp + 0x10], 0xb9b6b75a
mov eax, 0xdd
mov ecx, 0x22
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xd5]
mov edi, eax
and edi, edx
mov esi, ecx
xor esi, edx
add esi, edx
sub esi, edi
and edx, ecx
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, esi
mov dl, 0xae
sub dl, bl
mov byte [esp + eax - 0xd5], dl
inc eax
dec ecx
cmp ecx, 0x16
jne 0x418040
mov dword [esp + 0x30], 0xb11a8f64
mov dword [esp + 0x34], 0xb522b324
mov dword [esp + 0x38], 0xb967b76e
mov dword [esp + 0x3c], 0xbd56bb69
mov dword [esp + 0x40], 0xa15bbf2d
mov dword [esp + 0x44], 0xa54ea343
mov dword [esp + 0x48], 0xa937a74c
mov dword [esp + 0x4c], 0xad3eab3d
mov dword [esp + 0x50], 0x51aeaf76
mov eax, 0x663ff7dd
mov ecx, 0x99c00822
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ecx
movzx edi, byte [esp + eax - 0x663ff7ad]
lea edx, [eax - 0x663ff700]
and edx, edi
add edx, edx
lea esi, [eax + edi]
mov ebx, dword [esp + 4]
sub ebx, edi
and ebx, edx
not edx
and edx, esi
sub edx, ebx
mov edi, edx
and edi, 0xc028ac
mov ecx, edx
and ecx, 2
mov ebx, ecx
xor ebx, 2
imul ebx, edi
or edi, 2
imul edi, ecx
xor edx, 0xae
add edx, ebx
mov ecx, dword [esp + 4]
add edx, edi
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax - 0x663ff7ad], dl
inc eax
dec ecx
cmp eax, 0x663ff801
jne 0x4180d0
movzx ecx, word [esp + 0x30]
lea eax, [esp + 0x15c]
test cx, cx
je 0x418161
lea edx, [esp + 0x32]
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418150
mov word [eax], 0
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x418191
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418180
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x4181c1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4181b0
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov dword [esp + 0x30], 0x1b141c76
mov byte [esp + 0x34], 0x7c
mov dword [esp + 0x35], 0
mov word [esp + 0x39], 0
lea eax, [esp + 0x30]
xor ecx, ecx
xor edx, edx
nop
mov esi, ecx
and esi, 0x2c
mov ebx, edx
xor ebx, 0xe9
sub ebx, esi
inc bl
xor bl, byte [eax]
add bl, 0x6e
mov byte [eax], bl
inc eax
dec edx
add ecx, 0xfffffffe
cmp edx, 0xfffffff5
jne 0x4181f0
movzx eax, byte [esp + 0x30]
test al, al
je 0x41822b
lea ecx, [esp + 0x31]
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x418220
mov byte [edi], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x15c]
push eax
push ecx
push edx
call fcn.0040b6f0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x44313c]
mov ecx, dword [0x443144]
mov edx, ecx
and edx, 0x13f3d48e
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xec0c2b72
jmp eax
Function at 0x418ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov edx, dword [ebp + 0x10]
push eax
sub esp, 0x18
mov dword [ebp - 0x20], esp
sub esp, 0x34
mov dword [ebp - 0x18], esp
sub esp, 0x18
mov dword [ebp - 0x10], esp
sub esp, 0x20
mov dword [ebp - 0x34], esp
sub esp, 0x24
mov edi, esp
sub esp, 0x34
mov dword [ebp - 0x2c], esp
sub esp, 0x1c
mov dword [ebp - 0x30], esp
push eax
mov dword [ebp - 0x28], esp
xor eax, eax
test edx, edx
setne al
xor ebx, ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
jmp dword [eax*4 + 0x443248]
Function at 0x41ba90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41baa0
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x4497f4]
mov edi, dword [esp + 4]
test edi, edi
jns 0x41bacf
mov eax, 0xffffffff
jmp 0x41bad2
lea eax, [edi + edi]
push eax
call fcn.00408630
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x4497f4]
lea ebx, [esp + 8]
push ebx
push esi
call fcn.0043c1d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4433cc]
Function at 0x41d4b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d4c0
cmp eax, 0xffffffed
jge 0x41d4d7
mov eax, 0xffffffff
jmp 0x41d4da
add eax, 0x12
push eax
call fcn.00408630
add esp, 4
mov esi, eax
mov dword [esp], 0x29872bf8
mov dword [esp + 4], 0x2d912f83
mov dword [esp + 8], 0x31c033d8
mov dword [esp + 0xc], 0x35903794
mov dword [esp + 0x10], 0x3b34
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x47
xor cl, byte [esp + eax]
add cl, 0x9d
mov byte [esp + eax], cl
mov ecx, eax
or ecx, 0x37583eea
and eax, 0xa
add eax, ecx
add eax, 0xc8a7c117
cmp eax, 0x14
jb 0x41d510
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41d561
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d550
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41d591
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d580
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043c1d0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x443474]
Function at 0x41f289
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
push eax
sub esp, 0x1c
mov eax, esp
push eax
mov dword [ebp - 0x24], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x28], esp
sub esp, 8
mov dword [ebp - 0x44], esp
sub esp, 0x50
mov dword [ebp - 0x40], esp
sub esp, 0x4c
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x10
mov dword [ebp - 0x20], esp
sub esp, 0x40
mov dword [ebp - 0x30], esp
mov dword [eax], 0xf1c20feb
mov dword [eax + 4], 0xf557f361
mov dword [eax + 8], 0xf95af757
mov dword [eax + 0xc], 0xfd6afb3b
mov dword [eax + 0x10], 0xe13aff6c
mov dword [eax + 0x14], 0xe576e343
mov dword [eax + 0x18], 0xe901e747
mov dword [eax + 0x1c], 0xebe8
mov dword [ebp - 0x1c], eax
add eax, 0x1c
mov dword [ebp - 0x14], eax
xor eax, eax
xor edi, edi
mov esi, dword [ebp - 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + edi]
mov dword [ebp - 0x18], ebx
mov ecx, eax
and ecx, 0x3a
mov edx, edi
xor edx, 0xfcb9e67d
add edx, ecx
mov ecx, ebx
xor ecx, edx
lea ebx, [ecx + ecx]
not ebx
add ebx, ecx
and ebx, edx
add ebx, ebx
sub edx, ebx
add dl, byte [ebp - 0x18]
add dl, 0x8f
mov byte [esi + edi], dl
inc edi
add eax, 2
cmp edi, 0x20
jne 0x41f310
lea edx, [ebp - 0x62]
mov edi, edx
mov ecx, 7
mov eax, dword [ebp - 0x1c]
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x46]
mov ecx, 1
mov eax, dword [ebp - 0x14]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x24]
push edi
push 0
push 0
push 0xe
push edx
push 0
call dword [0x4497f4]
mov edi, dword [edi]
test edi, edi
jns 0x41f38a
mov eax, 0xffffffff
jmp 0x41f38d
lea eax, [edi + edi]
push eax
call fcn.00408630
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x24]
push ebx
push edi
push eax
push 0xe
lea eax, [ebp - 0x62]
push eax
push 0
call dword [0x4497f4]
mov eax, dword [ebx]
mov ecx, eax
and ecx, 9
xor eax, 9
lea eax, [eax + ecx*2]
mov dword [ebp - 0x3c], eax
add eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], esi
jmp dword [0x443994]
Function at 0x42da80
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x42daa6
xor ebx, ebx
test al, 1
jne 0x42dab1
jmp 0x42dc30
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42daed
jmp 0x42dc2a
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00428ec0
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42dc19
mov dword [ebp - 0x28], eax
mov ebx, eax
sub ebx, 0xffffffff
sub esp, 4
mov dword [esp], ebx
call fcn.00408630
sub esp, 8
mov dword [ebp - 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00428f30
add esp, 0xc
mov al, byte [edi]
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1c], 0xa1
mov byte [ebp - 0x1b], 0x47
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x19], 0x79
mov byte [ebp - 0x18], 0x4e
mov byte [ebp - 0x17], 0x7e
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x15], 0x7b
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0xd7
mov eax, 0xe
mov byte [ebp + eax - 0x1c], 0
add eax, 1
cmp eax, 0x10
jne 0x42db85
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x10
jae 0x42dbe6
movzx edx, byte [ebp + eax - 0x1c]
mov ebx, eax
add ebx, 0x4322df57
mov esi, ebx
and esi, edx
shl esi, 1
sub ebx, esi
mov ecx, dword [ebp + 8]
add ebx, edx
mov edx, ebx
and edx, 0xb4
xor edx, 0xb4
and ebx, 0x4b
sub ebx, edx
add bl, 1
mov byte [ebp + eax - 0x1c], bl
add eax, 0x61fbd692
mov edx, eax
xor edx, 0x61fbd691
shl eax, 1
and eax, 0x5c
sub eax, edx
jmp 0x42db97
lea eax, [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], eax
mov esi, dword [ebp - 0x24]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
call fcn.004094e0
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00408640
add esp, 4
jmp 0x42dc17
jmp 0x42dc19
sub esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42dc2a
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edx + 2], 0
lea edx, [edx + 2]
jne 0x432ba0
mov dword [esp], 0x626260f3
mov byte [esp + 4], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
or cl, 0xe8
xor cl, byte [esp + ebx]
add cl, 0x78
mov byte [esp + ebx], cl
xor ebx, 0x7f
mov ecx, 0x80
sub ecx, ebx
cmp ebx, 0x7b
mov ebx, ecx
ja 0x432bc0
test edx, edx
je 0x432c4e
mov ecx, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x432c11
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [esi]
add esi, 2
xor eax, ebp
imul eax, ecx
mov ebp, eax
dec ebx
jne 0x432c00
cmp edi, 3
jb 0x432c4e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [esi + edi*2]
xor ebx, eax
imul ebx, ecx
movzx eax, word [esi + edi*2 + 2]
xor eax, ebx
imul eax, ecx
movzx ebx, word [esi + edi*2 + 4]
xor ebx, eax
imul ebx, ecx
movzx eax, word [esi + edi*2 + 6]
xor eax, ebx
imul eax, ecx
add edi, 4
cmp edx, edi
jne 0x432c20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.0043c010
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4459d0]

Function at 0x433980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043c760
add esp, 0x14
test eax, eax
js 0x433ab6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043cb50
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x433a1a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4339e8
mov eax, 0xffffffff
jmp 0x4339ef
lea eax, [eax*2 + 2]
push eax
call fcn.00408630
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043d1b0
add esp, 0x14
test eax, eax
jns 0x433a1a
push esi
call fcn.00408640
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x1c1d1a1b
mov dword [esp + 8], 0
nop
nop
nop
mov ecx, ebx
add cl, 0x3a
xor cl, byte [esp + ebx + 4]
add cl, 0xde
mov byte [esp + ebx + 4], cl
mov ecx, ebx
xor ecx, 0xfffffffe
or ebx, 1
and ecx, ebx
add ebx, ecx
cmp ebx, 8
jb 0x433a30
mov ecx, dword [0x4497f8]
test ecx, ecx
je 0x433a9a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4497fc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x433a80
inc edi
cmp ecx, edi
jne 0x433a70
jmp 0x433a9a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x433a9a
push eax
push 4
push ecx
push dword [0x449800]
call fcn.00438810
add esp, 0x10
test esi, esi
jne 0x433ab8
lea eax, [esp + 4]
push eax
call fcn.0043be00
add esp, 4
test al, al
je 0x433ab6
cmp dword [esp + 4], 1
je 0x433ab8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4356c0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445db4]

Function at 0x435740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x1c1d1a1b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3a
xor cl, byte [esp + eax]
add cl, 0xde
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x435770
mov edi, dword [esp]
mov eax, dword [0x4497f8]
test eax, eax
je 0x4357d6
xor ecx, ecx
mov edx, dword [0x4497fc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x4357b0
inc ecx
cmp eax, ecx
jne 0x4357a0
jmp 0x4357d6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x4357d6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x449800]
call fcn.00438810
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x89cacb30
mov dword [esp + 4], 0
mov eax, 0xb7dd33b3
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x4822cc4d]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 0x81
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x4822cc4d], cl
inc eax
cmp eax, 0xb7dd33bb
jne 0x4357f0
cmp edi, dword [esp]
jne 0x435925
push dword [esp + 0xc]
call fcn.00435670
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x1c1d1a1b
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0x3a
xor cl, byte [esp + edx]
add cl, 0xde
mov byte [esp + edx], cl
inc edx
cmp edx, 8
jne 0x435850
mov edi, dword [esp]
mov edx, dword [0x4497f8]
test edx, edx
je 0x4358bc
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x4497fc]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x435892
inc ebp
cmp edx, ebp
jne 0x435880
mov ebp, ecx
jmp 0x4358bc
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x4358bc
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x449800]
mov esi, eax
call fcn.00438810
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43591c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x4358f5
add edi, 2
cmp si, bp
je 0x4358e0
cmp si, bp
je 0x435907
mov esi, dword [ecx]
test esi, esi
jne 0x4358d0
mov edi, 0xc0000225
jmp 0x43591c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.004356c0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x435960
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x435a10
xor eax, eax
cmp dword [ecx], 0
jne 0x435a72
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x1c1d1a1b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
mov ebx, eax
add bl, 0x3a
xor bl, byte [esp + eax]
add bl, 0xde
mov byte [esp + eax], bl
inc eax
cmp eax, 8
jne 0x4359d0
mov eax, dword [esp]
mov esi, dword [0x4497f8]
test esi, esi
je 0x435a72
xor edi, edi
mov ebx, dword [0x4497fc]
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x435a7b
inc edi
cmp esi, edi
jne 0x435a00
jmp 0x435a72
mov dword [esp + 8], 0x57161920
mov dword [esp + 0xc], 0
mov eax, 0xc6
mov ecx, 0x19
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xbe]
mov edi, ecx
and edi, 0x1d
mov edx, eax
and edx, 0xc2
or edx, edi
xor edx, 0xe2
or edx, esi
lea ebx, [esi + esi]
not ebx
add ebx, esi
or ebx, eax
and ebx, edx
mov dl, 0x21
sub dl, bl
mov byte [esp + eax - 0xbe], dl
inc eax
dec ecx
cmp eax, 0xce
jne 0x435a30
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x435a72
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x449800]
call fcn.00438810
add esp, 0x1c
jmp 0x435a72

Function at 0x435ab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x435b4a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x1c1d1a1b
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x3a
xor bl, byte [esp + edx]
add bl, 0xde
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x435ae0
mov edx, dword [0x4497f8]
test edx, edx
je 0x435b3e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4497fc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x435b20
inc edi
cmp edx, edi
jne 0x435b10
jmp 0x435b3e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x435b3e
push eax
push 4
push edx
push dword [0x449800]
mov esi, ecx
call fcn.00438810
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret