joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aa70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x28], ecx
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x40414e4f
mov dword [esp + 0x14], 0
mov dword [esp + 0x17], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x10]
mov edi, eax
and edi, 0x7225336c
mov ebx, ecx
xor ebx, 0xf91299b6
add ebx, edi
mov edi, ebx
and edi, edx
add ebx, edx
add edi, edi
sub ebx, edi
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0xc]
add dl, 6
mov byte [esp + ecx + 0x10], dl
inc ecx
add eax, 2
cmp ecx, 0xb
jne 0x43aab0
mov ebx, dword [esp + 0x10]
mov eax, dword [0x44c2c8]
test eax, eax
je 0x43ab40
xor ecx, ecx
mov edx, dword [0x44c2cc]
nop
nop
cmp dword [edx + ecx*8], 0x10def2fc
je 0x43ab1a
mov edi, ecx
and edi, 1
xor ecx, 1
lea ecx, [ecx + edi*2]
cmp ecx, eax
jb 0x43ab00
jmp 0x43ab40
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x43ab40
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44c2d0]
push eax
call fcn.0043c490
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x43ac78
push dword [esp + 8]
call fcn.0043a8c0
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], 0x40414e4f
mov dword [esp + 0x14], 0
mov dword [esp + 0x17], 0
xor ecx, ecx
xor edx, edx
movzx eax, byte [esp + edx + 0x10]
mov edi, ecx
and edi, 0x7225336c
mov ebx, edx
xor ebx, 0xf91299b6
add ebx, edi
mov edi, ebx
and edi, eax
add ebx, eax
add edi, edi
sub ebx, edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
add al, 6
mov byte [esp + edx + 0x10], al
inc edx
add ecx, 2
cmp edx, 0xb
jne 0x43ab80
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x44c2c8]
test ecx, ecx
je 0x43ac07
xor edx, edx
mov eax, dword [0x44c2cc]
nop
nop
nop
cmp dword [eax + edx*8], 0x10def2fc
je 0x43abe0
inc edx
cmp ecx, edx
jne 0x43abd0
jmp 0x43ac07
mov eax, dword [eax + edx*8 + 4]
cmp eax, ebx
je 0x43ac07
push 0
push dword [esp + 0x28]
push dword [esp + 0xc]
push 5
push 4
push dword [0x44c2d0]
push eax
call fcn.0043c490
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x43ac6c
mov eax, dword [esp + 4]
mov edx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + edx + 0x3c]
add eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edx]
movzx edi, word [esi + edx]
test bx, bx
je 0x43ac45
add edx, 2
cmp bx, di
je 0x43ac30
cmp bx, di
je 0x43ac57
mov edx, dword [eax]
test edx, edx
jne 0x43ac20
mov ebx, 0xc0000225
jmp 0x43ac6c
mov ecx, dword [eax + 0x44]
mov edx, dword [esp + 0x28]
mov dword [edx + 4], ecx
mov eax, dword [eax + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.0043a980
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43acb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ecx + 4]
test esi, esi
je 0x43ad90
xor eax, eax
cmp dword [ecx], 0
jne 0x43ad95
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x40414e4f
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 8]
mov ebx, eax
and ebx, 0x7225336c
mov esi, edx
xor esi, 0xf91299b6
add esi, ebx
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [esp + 4], esi
mov ebx, dword [esp + 4]
add bl, 6
mov byte [esp + edx + 8], bl
inc edx
add eax, 2
cmp edx, 0xb
jne 0x43ad30
mov eax, dword [esp + 8]
mov esi, dword [0x44c2c8]
test esi, esi
je 0x43ad95
xor edi, edi
mov ebx, dword [0x44c2cc]
nop
cmp dword [ebx + edi*8], 0xcde6ec36
je 0x43ad9f
inc edi
cmp esi, edi
jne 0x43ad80
jmp 0x43ad95
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ad95
lea eax, [esp + 0x1c]
lea edx, [esp + 0x24]
push eax
push edx
push dword [ebp + 8]
push ecx
push 4
push dword [0x44c2d0]
push esi
call fcn.0043c490
add esp, 0x1c
jmp 0x43ad95

Function at 0x43add0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x43ae99
mov esi, ecx
mov dword [esp], eax
mov dword [esp + 8], 0x40414e4f
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
xor ecx, ecx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 8]
mov ebx, ecx
and ebx, 0x7225336c
mov edx, eax
xor edx, 0xf91299b6
add edx, ebx
mov ebx, edx
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
add dl, 6
mov byte [esp + eax + 8], dl
inc eax
add ecx, 2
cmp eax, 0xb
jne 0x43ae10
mov ecx, dword [0x44c2c8]
test ecx, ecx
je 0x43ae8c
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x44c2cc]
nop
cmp dword [ebx + edi*8], 0xa3c1f363
je 0x43ae70
inc edi
cmp ecx, edi
jne 0x43ae60
jmp 0x43ae8c
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43ae8c
push dword [esp]
push 1
push dword [0x44c2d0]
push ecx
call fcn.0043c490
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43b081
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43b081
mov dword [esp + 4], eax
mov dword [esp + 8], 0x40414e4f
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
xor edx, edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov ebx, edx
and ebx, 0x7225336c
mov edi, eax
xor edi, 0xf91299b6
add edi, ebx
mov ebx, edi
and ebx, ecx
add edi, ecx
add ebx, ebx
sub edi, ebx
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x18]
add cl, 6
mov byte [esp + eax + 8], cl
inc eax
add edx, 2
cmp eax, 0xb
jne 0x43af00
mov edi, dword [esp + 8]
mov edx, dword [0x44c2c8]
test edx, edx
je 0x43af8c
xor ecx, ecx
mov ebx, dword [0x44c2cc]
nop
cmp dword [ebx + ecx*8], 0x45a3f4b9
je 0x43af6a
mov eax, ecx
and eax, 1
xor ecx, 1
lea ecx, [ecx + eax*2]
cmp ecx, edx
jb 0x43af50
jmp 0x43af8c
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
je 0x43af8c
push dword [ebp + 8]
push dword [esp + 8]
push 2
push dword [0x44c2d0]
push ecx
call fcn.0043c490
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov ebx, dword [ebp + 0x10]
mov eax, ebx
sbb eax, 0
jl 0x43b076
cmp edi, 0xc000010a
jne 0x43b076
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x40414e4f
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
xor ecx, ecx
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 8]
mov ebx, ecx
and ebx, 0x7225336c
mov edx, eax
xor edx, 0xf91299b6
add edx, ebx
mov ebx, edx
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x20]
add dl, 6
mov byte [esp + eax + 8], dl
inc eax
add ecx, 2
cmp eax, 0xb
jne 0x43aff0
mov edi, dword [esp + 8]
mov ecx, dword [0x44c2c8]
test ecx, ecx
je 0x43b076
xor edx, edx
mov ebx, dword [0x44c2cc]
nop
cmp dword [ebx + edx*8], 0x39c83604
je 0x43b050
inc edx
cmp ecx, edx
jne 0x43b040
jmp 0x43b076
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x43b076
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0xc]
push 3
push dword [0x44c2d0]
push ecx
call fcn.0043c490
add esp, 0x18
mov edi, eax
test edi, edi
js 0x43b081
mov ecx, esi
call fcn.0043add0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43b090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x40414e4f
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 8]
mov edi, eax
and edi, 0x7225336c
mov edx, ecx
xor edx, 0xf91299b6
add edx, edi
mov edi, edx
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
mov dword [esp], edx
mov edx, dword [esp]
add dl, 6
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0xb
jne 0x43b0d0
test ebx, ebx
jne 0x43b10d
mov ebx, esp
mov eax, dword [esp + 8]
mov edx, dword [0x44c2c8]
test edx, edx
je 0x43b167
xor esi, esi
mov edi, dword [0x44c2cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xaead8b9f
je 0x43b140
inc esi
cmp edx, esi
jne 0x43b130
jmp 0x43b167
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x43b167
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push 5
push dword [0x44c2d0]
push edx
call fcn.0043c490
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, eax
test ecx, ecx
sete al
jmp dword [eax*4 + 0x44a084]

Function at 0x43c4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x278
push dword [0x4542e0]
call fcn.0043d7c0
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x44a430]

Function at 0x43d7c0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [ebp + 8]
push eax
sub esp, 0x18
mov esi, esp
sub esp, 8
mov ebx, esp
movzx eax, word [edi]
mov dword [ebp - 0x10], 0xc71094
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710a1
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc71047
add edx, 0xb9
movzx edx, dl
shl ecx, 8
add ecx, 0xb900
movzx ecx, cx
or ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc71047
shl edx, 0x10
add edx, 0xb90000
and edx, 0xff0000
or edx, ecx
mov ecx, dword [ebp - 0x10]
shl ecx, 0x18
add edx, ecx
add edx, 0xb9000000
xor ecx, ecx
cmp edx, eax
mov dword [ebp - 0x10], 0xc710c5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710c6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710c7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710c9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710ca
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xc710cb
mov eax, dword [ebp - 0x10]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44a5c0]

Function at 0x43e9a0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0xbbb80379
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov ecx, 0x8a5176b8
mov edx, 0x75ae8947
movzx esi, byte [esp + edx - 0x75ae8937]
mov eax, edx
and eax, esi
add eax, eax
mov ebx, esi
sub ebx, eax
add ebx, edx
and ebx, esi
mov eax, ebx
and eax, 2
mov edi, ebx
or edi, 2
imul edi, eax
mov eax, ebx
not edi
add edi, ebx
or ebx, 0xfffffffd
inc ebx
and eax, 0xfffffffd
imul eax, ebx
add edi, eax
or esi, ecx
and esi, edi
lea eax, [esi + esi]
not eax
add eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf
mov byte [esp + edx - 0x75ae8937], al
dec ecx
inc edx
cmp ecx, 0x8a5176a8
jne 0x43e9e0
xor eax, eax
mov ecx, dword [esp + 4]
cmp dword [esp + 0x10], ecx
setne al
jmp dword [eax*4 + 0x44ae20]
Function at 0x43f580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f5a0
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43f5bb
mov eax, 0xffffffff
jmp 0x43f5be
add eax, 0xa
push eax
call fcn.00408a60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea esi, [edi + 4]
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43f601
add ebx, 2
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43f5f0
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, edi
lea ecx, [esi + edx]
mov word [esp + 0x18], cx
lea ecx, [esi + edx]
add ecx, 2
mov word [esp + 0x1a], cx
mov dword [esp + 4], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, 0x1b6f6f60
mov esi, 0x36dedec0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x1b6f6f58]
mov edx, eax
xor edx, 0xbf7b3e28
mov ecx, esi
and ecx, 0x7ef67c50
lea ebx, [edx + ecx]
add edx, ecx
add edx, 0xe49090a1
mov ecx, edi
not ecx
and edx, ecx
and ecx, 0x879f0dea
and edi, 0x15
or edi, ecx
lea ecx, [ebx + ebx]
add ecx, 0xc9212142
sub ecx, ebx
xor edi, 0x7860f215
add ecx, 0x5f
or ecx, edi
lea edi, [ecx + ecx]
not edi
add edi, ecx
or edi, edx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x20]
lea edx, [ecx + ecx]
mov edi, edx
and edi, 0x3e
sub edi, ecx
and edx, 0xc0
add edx, edi
add dl, 0xe1
mov byte [esp + eax - 0x1b6f6f58], dl
inc eax
add esi, 2
cmp eax, 0x1b6f6f70
jne 0x43f6a0
mov edi, dword [esp + 8]
mov eax, dword [0x44c2c8]
test eax, eax
je 0x43f750
xor ecx, ecx
mov edx, dword [0x44c2cc]
mov esi, dword [esp + 4]
nop
cmp dword [edx + ecx*8], 0xbc8a835b
je 0x43f756
inc ecx
cmp eax, ecx
jne 0x43f740
jmp 0x43f793
mov esi, dword [esp + 4]
jmp 0x43f793
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43f793
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x44c2d0]
push eax
call fcn.0043c490
add esp, 0x38
mov edi, eax
push esi
call fcn.00408a70
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f7d0
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43f7eb
mov eax, 0xffffffff
jmp 0x43f7ee
add eax, 0xa
push eax
call fcn.00408a60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea esi, [edi + 4]
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43f831
add ebx, 2
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43f820
mov word [ecx], 0
mov ecx, 3
sub ecx, edi
and ecx, 2
mov edx, esi
and edx, 0xfffd
imul edx, ecx
and edi, 2
or esi, 2
imul esi, edi
add esi, edx
mov word [esp + 0x18], si
mov ecx, esi
and ecx, 2
xor esi, 2
lea ecx, [esi + ecx*2]
mov word [esp + 0x1a], cx
mov dword [esp + 4], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, 0x1b6f6f60
mov esi, 0x36dedec0
nop
nop
nop
movzx edi, byte [esp + eax - 0x1b6f6f58]
mov edx, eax
xor edx, 0xbf7b3e28
mov ecx, esi
and ecx, 0x7ef67c50
lea ebx, [edx + ecx]
add edx, ecx
add edx, 0xe49090a1
mov ecx, edi
not ecx
and edx, ecx
and ecx, 0x879f0dea
and edi, 0x15
or edi, ecx
lea ecx, [ebx + ebx]
add ecx, 0xc9212142
sub ecx, ebx
xor edi, 0x7860f215
add ecx, 0x5f
or ecx, edi
lea edi, [ecx + ecx]
not edi
add edi, ecx
or edi, edx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x20]
lea edx, [ecx + ecx]
mov edi, edx
and edi, 0x3e
sub edi, ecx
and edx, 0xc0
add edx, edi
add dl, 0xe1
mov byte [esp + eax - 0x1b6f6f58], dl
inc eax
add esi, 2
cmp eax, 0x1b6f6f70
jne 0x43f8d0
mov edi, dword [esp + 8]
mov eax, dword [0x44c2c8]
test eax, eax
je 0x43f980
xor ecx, ecx
mov edx, dword [0x44c2cc]
mov esi, dword [esp + 4]
nop
cmp dword [edx + ecx*8], 0xcd669f2f
je 0x43f986
inc ecx
cmp eax, ecx
jne 0x43f970
jmp 0x43f9b7
mov esi, dword [esp + 4]
jmp 0x43f9b7
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43f9b7
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44c2d0]
push eax
call fcn.0043c490
add esp, 0x24
mov edi, eax
push esi
call fcn.00408a70
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f9f0
mov ecx, eax
sar ecx, 1
and eax, 8
xor ecx, 4
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x43fa16
mov eax, 0xffffffff
jmp 0x43fa1c
lea eax, [ebx + ebx]
add eax, 2
push eax
call fcn.00408a60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [edi]
test cx, cx
je 0x43fa61
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x43fa50
mov word [edx], 0
lea ecx, [ebx + ebx]
mov word [esp + 4], cx
lea ecx, [ebx + ebx]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x32353437
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov eax, 0x1b6f6f60
mov esi, 0x36dedec0
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x1b6f6f38]
mov edx, eax
xor edx, 0xbf7b3e28
mov ecx, esi
and ecx, 0x7ef67c50
lea ebx, [edx + ecx]
add edx, ecx
add edx, 0xe49090a1
mov ecx, edi
not ecx
and edx, ecx
and ecx, 0x879f0dea
and edi, 0x15
or edi, ecx
lea ecx, [ebx + ebx]
add ecx, 0xc9212142
sub ecx, ebx
xor edi, 0x7860f215
add ecx, 0x5f
or ecx, edi
lea edi, [ecx + ecx]
not edi
add edi, ecx
or edi, edx
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0xc]
lea edx, [ecx + ecx]
mov edi, edx
and edi, 0x3e
sub edi, ecx
and edx, 0xc0
add edx, edi
add dl, 0xe1
mov byte [esp + eax - 0x1b6f6f38], dl
inc eax
add esi, 2
cmp eax, 0x1b6f6f70
jne 0x43fae0
mov edi, dword [esp + 0x28]
mov eax, dword [0x44c2c8]
test eax, eax
je 0x43fb90
xor ecx, ecx
mov edx, dword [0x44c2cc]
mov esi, dword [ebp + 0xc]
nop
nop
cmp dword [edx + ecx*8], 0xdcc9f508
je 0x43fb95
inc ecx
cmp eax, ecx
jne 0x43fb80
jmp 0x43fbba
mov esi, dword [ebp + 0xc]
jmp 0x43fbba
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43fbba
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x44c2d0]
push eax
call fcn.0043c490
add esp, 0x14
mov edi, eax
push dword [esp]
call fcn.00408a70
add esp, 4
test esi, esi
je 0x43fbcf
mov eax, dword [esp + 0x48]
mov dword [esi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x32353437
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, 0x1b6f6f60
mov edi, 0x36dedec0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1b6f6f60]
mov ebx, eax
xor ebx, 0xbf7b3e28
mov edx, edi
and edx, 0x7ef67c50
lea esi, [ebx + edx]
add ebx, edx
add ebx, 0xe49090a1
mov edx, ecx
not edx
and ebx, edx
and edx, 0x879f0dea
and ecx, 0x15
or ecx, edx
lea edx, [esi + esi]
add edx, 0xc9212142
sub edx, esi
xor ecx, 0x7860f215
add edx, 0x5f
or edx, ecx
lea ecx, [edx + edx]
not ecx
add ecx, edx
or ecx, ebx
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x1c]
lea ecx, [edx + edx]
mov esi, ecx
and esi, 0x3e
sub esi, edx
and ecx, 0xc0
add ecx, esi
add cl, 0xe1
mov byte [esp + eax - 0x1b6f6f60], cl
inc eax
add edi, 2
cmp eax, 0x1b6f6f70
jne 0x43fc20
mov eax, dword [esp]
mov ecx, dword [0x44c2c8]
test ecx, ecx
je 0x43fcd3
xor edx, edx
mov esi, dword [0x44c2cc]
mov edi, dword [ebp + 0xc]
nop
nop
cmp dword [esi + edx*8], 0xd75bc899
je 0x43fcdb
inc edx
cmp ecx, edx
jne 0x43fcc0
mov esi, dword [ebp + 0x10]
jmp 0x43fd06
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
jmp 0x43fd06
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
mov esi, dword [ebp + 0x10]
je 0x43fd06
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x44c2d0]
push ecx
call fcn.0043c490
add esp, 0x20
test edi, edi
je 0x43fd10
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43fd1c
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret