joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421e10
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push str._CS_15
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov eax, 0x202
mov word [ebp - 0x198], ax
lea ecx, [ebp - 0x194]
push ecx
movzx edx, word [ebp - 0x198]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
je 0x421e6f
mov dword [0x445900], 0
xor al, al
jmp 0x421f4e
mov eax, 2
mov word [0x4458f0], ax
movzx ecx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x4458f2], ax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x4458f4], eax
cmp dword [0x4458f4], 0xffffffff
jne 0x421f18
mov dword [ebp - 0x19c], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x421eda
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x445900], 0
xor al, al
jmp 0x421f4e
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0xc]
mov edx, dword [edx + ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x421f18
mov ecx, dword [ebp - 0x1a0]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x4458f4], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x445900], eax
cmp dword [0x445900], 0xffffffff
jne 0x421f46
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x445900], 0
xor al, al
jmp 0x421f4e
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
Function at 0x422480
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push str._CS_17
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
cmp dword [0x445900], 0
jne 0x4224e8
movzx eax, word [0x4457c6]
test eax, eax
je 0x4224e8
movzx ecx, word [0x4457c6]
push ecx
push 0x4457e0
call fcn.00421e10
add esp, 8
movzx edx, al
test edx, edx
jne 0x4224e8
mov eax, dword [0x445900]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x445900], 0
mov dword [0x445c64], 0xffffffff
xor al, al
jmp 0x422615
push 0x10
push 0x4458f0
mov ecx, dword [0x445900]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [0x445c64], eax
cmp dword [0x445c64], 0xffffffff
jne 0x4225b6
cmp dword [0x445900], 0
jne 0x4225b6
movzx edx, word [0x4457c6]
test edx, edx
je 0x4225b6
movzx eax, word [0x4457c6]
push eax
push 0x4457e0
call fcn.00421e10
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x422570
mov edx, dword [0x445900]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x445900], 0
mov dword [0x445c64], 0xffffffff
xor al, al
jmp 0x422615
push 0x10
push 0x4458f0
mov eax, dword [0x445900]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [0x445c64], eax
cmp dword [0x445c64], 0xffffffff
jne 0x4225b6
mov ecx, dword [0x445900]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x445900], 0
mov dword [0x445c64], 0xffffffff
xor al, al
jmp 0x422615
cmp dword [ebp + 0xc], 0
je 0x4225c4
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x4225f4
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x4225d3
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x445900]
push edx
call fcn.004227d0
add esp, 0x10
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x422800
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
mov dword [ebp - 0xc], 0
call esi
push dword [ebp - 0xc]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
xor esi, esi
xor edi, edi
cmp dword [ebx + 0x190], esi
jle 0x422918
mov al, byte [ebx + esi + 0x194]
movzx edx, al
mov ecx, edx
and edx, 0xf
shr ecx, 4
cmp ecx, 0xa
sbb al, al
add cl, 0x37
and al, 0xf9
add al, cl
mov ecx, dword [ebp - 8]
cmp edx, 0xa
mov byte [ecx + edi], al
sbb al, al
and al, 0xf9
inc esi
add al, 0x37
add al, dl
mov byte [ecx + edi + 1], al
add edi, 2
cmp esi, dword [ebx + 0x190]
jl 0x422852
test edi, edi
jle 0x422918
push ebx
mov byte [ecx + edi - 1], 0
call fcn.00432902
add esp, 4
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x422904
push 0x4347fc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4228fd
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0
call eax
cmp eax, 0x6f
jne 0x4228fd
push dword [ebp - 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
call dword [ebp - 0x10]
push esi
call fcn.00432902
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [edi - 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00432902
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
or eax, 0xffffffff
pop edi
pop esi
pop ebx
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
Function at 0x42ef40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x42ffe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x10], 0xdf8f69f0
xor edx, edx
mov dword [ebp - 0xc], 0xcef80da6
mov word [ebp - 8], 0x9cdf
mov byte [ebp - 6], 0xfc
mov word [ebp - 0x14], 0xfcc2
cmp eax, 2
sbb ecx, ecx
and ecx, eax
mov al, byte [ebp + ecx - 0x14]
xor byte [ebp + edx - 0x10], al
inc edx
lea eax, [ecx + 1]
cmp edx, 0xb
jb 0x430016
push 0xb
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004302b0
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret

Function at 0x430060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
test esi, esi
je 0x4300a1
mov edx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, esi
mov esi, dword [ebp + 0x14]
sub edi, edx
nop dword [eax]
cmp eax, dword [ebp + 0x18]
lea edx, [edx + 1]
sbb ecx, ecx
and ecx, eax
mov al, byte [edi + edx - 1]
xor al, byte [ecx + esi]
mov byte [edx - 1], al
lea eax, [ecx + 1]
sub ebx, 1
jne 0x430080
mov esi, dword [ebp + 0x10]
pop edi
pop ebx
mov eax, dword [ebp + 8]
mov byte [eax + esi], 0
pop esi
pop ebp
ret
Function at 0x4300b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x218], edi
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, edi
mov byte [ebp - 0x20e], 0
xor ebx, ebx
add esp, 0x18
mov dword [ebp - 0x21c], ebx
xor edx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x430117
sub ecx, esi
je 0x43015d
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
mov ebx, dword [ebp - 0x218]
sub edi, eax
lea ecx, [ebp - 0x108]
add ecx, edx
mov al, byte [edi + ecx]
xor al, dl
inc edx
mov byte [ecx], al
mov ecx, ebx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x430148
sub ecx, esi
cmp edx, ecx
jb 0x430133
mov edi, dword [ebp - 0x218]
xor ebx, ebx
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x430162
sub ecx, edx
je 0x4301b3
lea esi, [ebp - 0x20c]
mov ax, word [edi + ebx]
push 0x10
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtol
mov byte [esi], al
lea esi, [esi + 1]
mov eax, edi
add esp, 0xc
add ebx, 2
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4301a0
sub eax, edx
cmp ebx, eax
jb 0x430173
mov dword [ebp - 0x21c], ebx
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x4301f4
mov edx, dword [ebp - 0x214]
lea edi, [ebp - 0x108]
mov ebx, esi
sub edi, edx
mov esi, dword [ebp - 0x21c]
cmp eax, esi
lea edx, [edx + 1]
sbb ecx, ecx
and ecx, eax
mov al, byte [ebp + ecx - 0x20c]
xor al, byte [edi + edx - 1]
mov byte [edx - 1], al
lea eax, [ecx + 1]
sub ebx, 1
jne 0x4301d2
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov byte [eax + esi], 0
pop esi
pop ebx
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret

Function at 0x4302b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 1], al
xor eax, eax
test edi, edi
je 0x430315
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
sub ecx, esi
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edi
nop dword [eax + eax]
cmp eax, dword [ebp + 0x18]
lea esi, [esi + 1]
mov cl, byte [ecx + esi - 1]
sbb edx, edx
and edx, eax
sub cl, byte [edx + ebx]
lea eax, [edx + 1]
xor cl, byte [ebp - 1]
mov byte [esi - 1], cl
mov ecx, dword [ebp + 8]
sub edi, 1
jne 0x4302e0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
pop esi
mov byte [eax + ebx], 0
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop edi
mov byte [ecx + eax], cl
mov esp, ebp
pop ebp
ret
Function at 0x4310f0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
push str._CS_SS_2
mov dword [ebp - 0x210], eax
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
je 0x4312fb
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xff
ja 0x4312fb
push 0x100
lea eax, [ebp - 0x204]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp edi, 0x100
jne 0x431178
mov ecx, 0x40
lea edi, [ebp - 0x204]
rep movsd dword es:[edi], dword [esi]
jmp 0x43119f
xor ecx, ecx
nop word [eax + eax]
mov eax, ecx
mov byte [ebp + ecx - 0x104], cl
cdq
idiv edi
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, 0x100
jl 0x431180
xor edi, edi
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x104]
movzx eax, byte [ebp + esi - 0x204]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4311d6
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], al
inc esi
mov byte [ebp + edi - 0x104], dl
cmp esi, 0x100
jl 0x4311b0
push ebx
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 8], eax
je 0x4312e2
cmp dword [ebp - 0x210], eax
je 0x4312e2
cmp dword [ebp + 0x14], eax
jl 0x4312e2
mov edi, dword [ebp + 0x10]
jg 0x431224
test edi, edi
je 0x4312e2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20c], xmm0
mov ecx, dword [ebp - 0x208]
mov esi, dword [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
inc eax
and eax, 0x800000ff
jns 0x431250
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [ebp + eax - 0x104]
movzx edx, cl
add ebx, edx
mov dword [ebp - 0x208], eax
and ebx, 0x800000ff
jns 0x431272
dec ebx
or ebx, 0xffffff00
inc ebx
mov edi, dword [ebp - 0x208]
movzx eax, byte [ebp + ebx - 0x104]
mov byte [ebp + edi - 0x104], al
mov eax, edi
mov edi, dword [ebp + 0x10]
mov byte [ebp + ebx - 0x104], cl
mov ecx, dword [ebp + 8]
movzx eax, byte [ebp + eax - 0x104]
add eax, edx
movzx eax, al
movzx eax, byte [ebp + eax - 0x104]
xor al, byte [esi + ecx]
mov ecx, dword [ebp - 0x210]
mov byte [esi + ecx], al
add esi, 1
mov eax, dword [ebp - 0x214]
adc eax, 0
cmp eax, dword [ebp + 0x14]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x208]
jl 0x431241
jg 0x4312e2
cmp esi, edi
jb 0x431241
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
Function at 0x431310
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
push 0x100
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
je 0x431509
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xff
ja 0x431509
push 0x100
lea eax, [ebp - 0x204]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp edi, 0x100
jne 0x43138d
mov ecx, 0x40
lea edi, [ebp - 0x204]
rep movsd dword es:[edi], dword [esi]
jmp 0x4313af
xor ecx, ecx
nop
mov eax, ecx
mov byte [ebp + ecx - 0x104], cl
cdq
idiv edi
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, 0x100
jl 0x431390
xor edi, edi
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x104]
movzx eax, byte [ebp + esi - 0x204]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4313e6
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], al
inc esi
mov byte [ebp + edi - 0x104], dl
cmp esi, 0x100
jl 0x4313c0
push ebx
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 8], eax
je 0x4314f6
cmp dword [ebp - 0x210], eax
je 0x4314f6
cmp dword [ebp + 0x14], eax
jl 0x4314f6
mov edi, dword [ebp + 0x10]
jg 0x431434
test edi, edi
je 0x4314f6
xorps xmm0, xmm0
movlpd qword [ebp - 0x20c], xmm0
mov ecx, dword [ebp - 0x208]
mov esi, dword [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
inc eax
and eax, 0x800000ff
jns 0x431460
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [ebp + eax - 0x104]
movzx edx, cl
add ebx, edx
mov dword [ebp - 0x208], eax
and ebx, 0x800000ff
jns 0x431482
dec ebx
or ebx, 0xffffff00
inc ebx
mov edi, dword [ebp - 0x208]
movzx eax, byte [ebp + ebx - 0x104]
mov byte [ebp + edi - 0x104], al
mov eax, edi
mov edi, dword [ebp + 0x10]
mov byte [ebp + ebx - 0x104], cl
mov cl, byte [ebp + eax - 0x104]
movzx eax, cl
add eax, edx
mov edx, dword [ebp + 8]
movzx eax, al
movzx eax, byte [ebp + eax - 0x104]
xor al, byte [esi + edx]
xor al, cl
mov ecx, dword [ebp - 0x210]
mov byte [esi + ecx], al
add esi, 1
mov eax, dword [ebp - 0x214]
adc eax, 0
cmp eax, dword [ebp + 0x14]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x208]
jl 0x431451
jg 0x4314f6
cmp esi, edi
jb 0x431451
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
Function at 0x431ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x431f8c
test bl, 0xf
jne 0x431f8c
push esi
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x431f0e
mov esi, dword [ebp + 0x10]
mov ecx, edi
sub esi, edi
mov edx, ebx
nop dword [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x431f00
lea esi, [edi + ebx]
mov edi, ebx
mov dword [ebp - 4], esi
add esi, 0xfffffff0
shr edi, 4
test edi, edi
je 0x431f73
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00432340
add esp, 8
cmp dword [ebx + 8], 1
jne 0x431f4e
cmp edi, 1
je 0x431f58
mov eax, esi
mov edx, 0x10
nop
mov cl, byte [eax - 0x10]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x431f40
sub esi, 0x10
sub edi, 1
jne 0x431f23
jmp 0x431f70
mov edx, dword [ebx + 0x10]
mov ecx, 0x10
sub edx, esi
mov al, byte [edx + esi]
lea esi, [esi + 1]
xor byte [esi - 1], al
sub ecx, 1
jne 0x431f62
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov ecx, ebx
pop edi
pop esi
movzx edx, byte [eax - 1]
xor eax, eax
sub ecx, edx
cmp edx, ebx
pop ebx
cmovbe eax, ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x431fb0
xor eax, eax
pop ebx
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x431fd0
mov esi, dword [ebp + 0x10]
mov ecx, edi
sub esi, edi
mov edx, ebx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x431fc2
lea esi, [edi - 0x10]
mov edi, ebx
shr edi, 4
add esi, ebx
test edi, edi
je 0x432036
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00432340
add esp, 8
cmp dword [ebx + 8], 1
jne 0x43200e
mov edx, 0x10
cmp edi, 1
je 0x432020
mov eax, esi
nop dword [eax]
mov cl, byte [eax - 0x10]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x432000
sub esi, 0x10
sub edi, 1
jne 0x431fe1
mov ebx, dword [ebp + 0x14]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [ebx + 0x10]
sub edi, esi
mov cl, byte [edi + esi]
lea esi, [esi + 1]
xor byte [esi - 1], cl
sub edx, 1
jne 0x432025
mov ebx, dword [ebp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x432040
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x43206e
mov esi, dword [ebp + 0xc]
mov ecx, edi
sub esi, edi
mov edx, ebx
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x432060
push ebx
push edi
call fcn.00431e30
mov ecx, eax
add esp, 8
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x432088
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
shr ecx, 4
mov dword [ebp - 4], ecx
mov esi, dword [eax + 0x10]
test ecx, ecx
je 0x432174
lea ecx, [eax + 0x14]
mov dword [ebp - 8], ecx
cmp dword [eax + 8], 1
jne 0x4320c2
mov ecx, edi
sub esi, edi
mov edx, 0x10
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x4320b1
mov ecx, dword [ebp - 8]
mov ebx, edi
mov edx, 0x10
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [ebx], al
inc ebx
sub edx, 1
jne 0x4320d0
mov eax, dword [ebp + 8]
mov byte [ebp + 0x17], 1
cmp dword [eax], 1
jl 0x432163
lea esi, [edx + 1]
nop dword [eax]
mov ecx, edi
mov edx, 0x10
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
mov al, byte [eax + 0x434d50]
mov byte [ecx - 1], al
sub edx, 1
jne 0x432100
push edx
push edi
call fcn.004325b0
mov eax, dword [ebp + 8]
add esp, 8
cmp esi, dword [eax]
je 0x432130
push 0
push edi
call fcn.00432400
add esp, 8
mov edx, dword [ebp + 8]
mov eax, edi
shl esi, 4
add edx, 0x14
add edx, esi
mov esi, 0x10
mov cl, byte [edx]
lea edx, [edx + 1]
xor byte [eax], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x432142
mov al, byte [ebp + 0x17]
inc al
movzx esi, al
mov byte [ebp + 0x17], al
mov eax, dword [ebp + 8]
cmp esi, dword [eax]
jle 0x4320f0
sub dword [ebp - 4], 1
lea ecx, [eax + 0x14]
mov esi, edi
mov edi, ebx
jne 0x4320a2
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432180
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, 1
push edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], 1
mov eax, dword [esi + 4]
sub eax, 0x80
je 0x4321d6
sub eax, 0x40
je 0x4321c6
sub eax, 0x40
jne 0x4321d6
mov eax, 0x20
mov dword [esi], 0xe
lea edi, [eax - 0x18]
jmp 0x4321e6
mov eax, 0x18
mov dword [esi], 0xc
lea edi, [eax - 0x12]
jmp 0x4321e6
mov edi, 4
mov dword [esi], 0xa
mov eax, 0x10
push eax
push dword [esi + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 0x14], edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
movzx edx, al
lea ecx, [eax + 0x14]
mov eax, dword [esi]
add ecx, esi
lea eax, [eax*4 + 4]
cmp edx, eax
jge 0x432323
lea eax, [edi*4]
mov esi, ecx
sub esi, eax
lea edi, [ebp - 8]
sub edi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
nop
mov eax, dword [ecx - 4]
mov dword [ebp - 0x20], eax
mov dword [ecx], eax
mov eax, edx
xor edx, edx
mov byte [ebp - 9], bl
div dword [ebp - 0x14]
test edx, edx
jne 0x4322b9
mov edx, dword [ebp - 0x20]
mov edi, 4
mov eax, edx
shr eax, 8
mov byte [ecx], al
movzx eax, byte [ecx + 2]
mov byte [ecx + 1], al
movzx eax, byte [ecx + 3]
mov byte [ecx + 3], dl
mov edx, ecx
mov byte [ecx + 2], al
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
mov al, byte [eax + 0x434d50]
mov byte [edx - 1], al
sub edi, 1
jne 0x432270
mov esi, dword [ebp - 0x18]
mov edx, ecx
mov edi, 4
nop
mov al, byte [esi + edx]
lea edx, [edx + 1]
xor byte [edx - 1], al
sub edi, 1
jne 0x432290
mov esi, dword [ebp - 0x1c]
add bl, bl
mov al, bl
movzx ebx, bl
xor al, 0x1b
cmp byte [ebp - 9], 0
movzx eax, al
cmovl ebx, eax
mov byte [ebp - 8], bl
jmp 0x4322e4
cmp dword [ebp - 0x14], 6
jbe 0x4322e7
cmp edx, 4
jne 0x4322e7
mov edx, ecx
mov edi, 4
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
mov al, byte [eax + 0x434d50]
mov byte [edx - 1], al
sub edi, 1
jne 0x4322d0
mov edi, dword [ebp - 0x18]
mov edx, 4
nop dword [eax]
mov al, byte [esi]
inc esi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x4322f0
mov eax, dword [ebp - 0x10]
sub edi, 4
inc al
mov dword [ebp - 0x1c], esi
movzx edx, al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov eax, dword [eax]
lea eax, [eax*4 + 4]
cmp edx, eax
jl 0x432230
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
Function at 0x432340
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x10
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov eax, dword [ebx]
lea esi, [ebx + 0x14]
shl eax, 4
add esi, eax
sub esi, edi
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x432360
mov bl, byte [ebx]
test bl, bl
je 0x4323ed
mov esi, dword [ebp + 8]
movzx eax, bl
add esi, 4
shl eax, 4
add esi, eax
mov dword [ebp + 8], esi
push 1
push edi
call fcn.004325b0
add esp, 8
mov eax, edi
mov edx, 0x10
nop word [eax + eax]
movzx ecx, byte [eax]
lea eax, [eax + 1]
mov cl, byte [ecx + 0x434c50]
mov byte [eax - 1], cl
sub edx, 1
jne 0x4323a0
mov edx, esi
mov ecx, edi
mov esi, 0x10
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub esi, 1
jne 0x4323c0
cmp bl, 1
je 0x4323df
push 1
push edi
call fcn.00432400
add esp, 8
mov esi, dword [ebp + 8]
sub esi, 0x10
mov dword [ebp + 8], esi
add bl, 0xff
jne 0x432385
pop edi
pop esi
pop ebx
pop ebp
ret