joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 0x10]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4154b0
sar ebx, 1
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4154d0
sar eax, 1
lea ecx, [ebx + eax]
add ecx, 2
test ecx, ecx
jns 0x4154ee
mov eax, 0xffffffff
jmp 0x4154f5
add eax, ebx
add eax, eax
add eax, 4
push eax
call fcn.00437310
add esp, 4
mov edi, eax
movzx ecx, word [esi]
test cx, cx
je 0x415521
add esi, 2
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x415510
mov word [eax], 0
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x415551
add edx, 2
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415540
mov word [eax], 0
lea eax, [esp + 0x14]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043c4a0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x442f24]
mov ecx, 0x3c9e568a
xor ecx, dword [0x442f2c]
add eax, ecx
inc eax
jmp eax
Function at 0x4159c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4159e0
sar esi, 1
lea edi, [esp + 0x94]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44a668]
mov ebx, dword [esp + 0x94]
test ebx, ebx
jns 0x415a15
mov eax, 0xffffffff
jmp 0x415a18
lea eax, [ebx + ebx]
push eax
call fcn.00437310
add esp, 4
push edi
push ebx
mov dword [esp + 0x80], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44a668]
mov dword [esp + 0x30], 0x4b0845fa
mov dword [esp + 0x34], 0x4fdd49ed
mov dword [esp + 0x38], 0xb32c4dda
mov dword [esp + 0x3c], 0xb71bb108
mov dword [esp + 0x40], 0xbb21b520
mov dword [esp + 0x44], 0xbf29b915
mov dword [esp + 0x48], 0xa3bcbd2c
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov word [esp + 0x54], 0
mov dword [esp + 0xa0], 0
mov ecx, dword [esp + 0xa0]
cmp ecx, 0x25
ja 0x415af9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
movzx esi, byte [esp + ecx + 0x30]
lea ecx, [edx + esi]
add ecx, 0xf48e4975
add edx, 0xf48e4975
and edx, esi
add edx, edx
sub ecx, edx
add cl, 0xcd
mov edx, dword [esp + 0xa0]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
cmp ecx, 0x26
jb 0x415ab0
lea edi, [esp + 0xd0]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xec]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x94]
mov ecx, 1
sub ecx, eax
and ecx, 1
and eax, 0xfffffffe
sub eax, ecx
mov ecx, eax
add ecx, 0xe
jns 0x415b41
mov eax, 0xffffffff
jmp 0x415b46
add eax, eax
add eax, 0x1c
mov edi, dword [esp + 0x78]
push eax
call fcn.00437310
add esp, 4
mov esi, eax
movzx ecx, word [edi]
test cx, cx
je 0x415b81
lea edx, [edi + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415b70
mov word [eax], 0
movzx ecx, word [esp + 0xd0]
test cx, cx
je 0x415bb1
lea edx, [esp + 0xd2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415ba0
mov word [eax], 0
lea eax, [esp + 0x18]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043c4a0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x443360]
mov ecx, 0x85b1eed0
xor ecx, dword [0x443368]
add eax, ecx
inc eax
jmp eax
Function at 0x41a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0x20], 0x4be945fa
mov dword [esp + 0x24], 0x4fd749e1
mov dword [esp + 0x28], 0xb31e4d1a
mov dword [esp + 0x2c], 0xb716b116
lea eax, [esp + 0x30]
mov word [esp + 0x30], 0xb5b6
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x42], 0
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x25
ja 0x41a500
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x20]
mov esi, edx
and esi, 0xf48e4975
xor edx, 0xf48e4975
lea edx, [edx + esi*2]
mov esi, edx
and esi, ecx
add ecx, edx
add esi, esi
sub ecx, esi
add cl, 0xcd
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x26
jb 0x41a4c0
mov ebx, dword [ebp + 8]
lea edi, [esp + 0xc]
lea esi, [esp + 0x20]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x1c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a530
mov edi, esi
cmp eax, 0xffffffed
jge 0x41a549
mov eax, 0xffffffff
jmp 0x41a54c
add eax, 0x12
push eax
call fcn.00437310
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41a581
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41a570
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
je 0x41a5b1
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a5a0
mov word [eax], 0
push edi
push esi
call fcn.0043c6a0
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x443bd8]
mov ecx, 0x86860cf4
xor ecx, dword [0x443be0]
add eax, ecx
inc eax
jmp eax
Function at 0x41da40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0x10], 0xb4b0d31
mov dword [esp + 0x14], 0x7760978
mov dword [esp + 0x18], 0x3630558
mov dword [esp + 0x1c], 0x1f7f018c
mov dword [esp + 0x20], 0x1b7e1d21
mov dword [esp + 0x24], 0x176e1974
mov dword [esp + 0x28], 0x13601599
mov dword [esp + 0x2c], 0x2f53116c
mov dword [esp + 0x30], 0x2b542da2
mov dword [esp + 0x34], 0x27a82951
mov dword [esp + 0x38], 0x23462558
mov dword [esp + 0x3c], 0x3fb02170
mov dword [esp + 0x40], 0x3b403d4f
mov dword [esp + 0x44], 0x37423941
mov dword [esp + 0x48], 0x33bd3549
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x3130
mov dword [esp + 0x4e], 0
mov dword [esp + 0x52], 0
mov dword [esp + 0x56], 0
mov word [esp + 0x5a], 0
mov dword [esp + 0x6c], 0
mov ecx, dword [esp + 0x6c]
cmp ecx, 0x4b
ja 0x41db37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x6c]
add cl, 2
xor cl, byte [esp + edx + 0x10]
add cl, 0xf2
mov edx, dword [esp + 0x6c]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 0x6c]
mov ecx, dword [esp + 0x6c]
cmp ecx, 0x4c
jb 0x41db10
lea ebx, [esp + 0x6c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xa8]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44a668]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41db80
mov eax, 0xffffffff
jmp 0x41db83
lea eax, [edi + edi]
push eax
call fcn.00437310
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x44a668]
mov dword [esp + 0x10], 0x5b325924
mov dword [esp + 0x14], 0x47d045d9
mov dword [esp + 0x18], 0x432f412c
mov dword [esp + 0x1c], 0x4f2c4dde
mov dword [esp + 0x20], 0x4bd84921
mov dword [esp + 0x24], 0x77767518
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov word [esp + 0x30], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x21
ja 0x41dc36
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x593e8cc]
mov edi, ecx
not edi
or edi, edx
and edx, ecx
add edx, edi
sub eax, edx
add al, 0x37
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x22
jb 0x41dc00
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.004185b0
add esp, 0x14
mov ebx, eax
jmp dword [0x444578]
Function at 0x42ea40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, esp
push eax
mov dword [esi + 0x18], esp
push eax
mov edi, esp
sub esp, 0x20
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push eax
mov dword [esi + 0x2c], esp
push eax
mov dword [esi + 0x30], eax
mov byte [esi + 0xb], 0
mov dword [esi + 0x10], ecx
xor eax, eax
lea eax, [esi + 0x34]
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [0x44070c]
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [0x440710]
jmp 0x42eaa4
cmp eax, 0
setne al
test al, 1
jne 0x42eab3
jmp 0x42ec1a
sub esp, 4
mov dword [esp], 1
call dword [0x440700]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
jmp 0x42eaca
cmp dword [ecx], 0
setne al
jmp 0x42ead2
jmp 0x42ead4
test al, 1
jne 0x42eadd
jmp 0x42ec12
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call dword [0x4406c0]
mov ecx, dword [esi + 0x18]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00409100
add esp, 4
mov dword [edi], eax
cmp dword [edi], 0
setne al
test al, 1
mov eax, dword [esi + 0x10]
jne 0x42eb14
jmp 0x42ebfe
mov ecx, dword [esi + 0x30]
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
mov edi, dword [eax]
mov eax, dword [esi + 0x2c]
mov al, byte [eax]
mov byte [esi + 0x14], al
mov byte [ebx], 0xf3
mov byte [ebx + 1], 0xcd
mov byte [ebx + 2], 0xcb
mov byte [ebx + 3], 0xc3
mov byte [ebx + 4], 0xd6
mov byte [ebx + 5], 0xca
mov byte [ebx + 6], 0xd7
mov byte [ebx + 7], 0xc5
mov byte [ebx + 8], 0xac
mov byte [ebx + 9], 0xf7
mov byte [ebx + 0xa], 0xbe
mov byte [ebx + 0xb], 0x43
mov byte [ebx + 0xc], 0xb8
mov byte [ebx + 0xd], 0xcd
mov word [ebx + 0x12], 0
mov dword [ebx + 0xe], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0xc]
cmp eax, 0x14
jae 0x42ebe3
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
jmp 0x42eb84
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0xc]
movzx ecx, byte [ebx + eax]
mov dword [esi + 0x1c], ecx
mov edx, edi
add edx, 0x31ba0738
lea eax, [edi + ecx + 0x31ba0738]
and edx, ecx
mov ecx, 0xce45f8c7
sub ecx, edi
or ecx, dword [esi + 0x1c]
add edi, ecx
lea ecx, [edx + edi + 0x31ba0739]
mov edx, ecx
xor edx, eax
not ecx
and eax, ecx
add eax, eax
sub eax, edx
add al, 0x78
mov ecx, dword [esi + 0xc]
mov byte [ebx + ecx], al
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
cmp eax, 0x14
jb 0x42eb84
mov edx, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
jmp 0x42ebe3
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [esp + 8], edx
call fcn.00409860
and al, 1
mov byte [esi + 0xb], al
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
jmp 0x42ec02
sub esp, 4
mov dword [esp], eax
call dword [0x4406c4]
jmp 0x42ec10
jmp 0x42ec12
call dword [0x4406fc]
jmp 0x42ec1a
mov al, byte [esi + 0xb]
jmp 0x42ec1f
jmp 0x42ec21
jmp 0x42ec23
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43c2d0
cmp edi, 0xfffffff5
jge 0x43c2e7
mov eax, 0xffffffff
jmp 0x43c2ea
lea eax, [edi + 0xa]
push eax
call fcn.00437310
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43c331
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43c320
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 8], ax
add edi, 0xa
mov word [esp + 0xa], di
mov dword [esp + 0xc], esi
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1b
ja 0x43c41e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x725c0c28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xe7
and eax, 0x67
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1c
jb 0x43c3d0
mov edi, dword [esp + 0x10]
mov eax, dword [0x44b674]
test eax, eax
je 0x43c48d
xor ecx, ecx
mov edx, dword [0x44b678]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb1cf12ba
je 0x43c450
inc ecx
cmp eax, ecx
jne 0x43c440
jmp 0x43c48d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c48d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x44b67c]
push eax
call fcn.004392f0
add esp, 0x38
mov edi, eax
push esi
call fcn.00408fc0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c4c0
sar eax, 1
lea ebx, [eax + 4]
and eax, 1
mov ecx, ebx
or ecx, 1
add ecx, eax
jns 0x43c4e3
mov ecx, 0xffffffff
jmp 0x43c4e5
add ecx, ecx
push ecx
call fcn.00437310
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [edi]
test cx, cx
je 0x43c531
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x43c520
mov word [eax], 0
lea eax, [ebx + ebx]
mov word [esp + 8], ax
lea eax, [ebx + ebx]
add eax, 2
mov word [esp + 0xa], ax
mov dword [esp + 0xc], esi
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1b
ja 0x43c61e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x725c0c28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xe7
and eax, 0x67
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1c
jb 0x43c5d0
mov edi, dword [esp + 0x10]
mov eax, dword [0x44b674]
test eax, eax
je 0x43c681
xor ecx, ecx
mov edx, dword [0x44b678]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x37e2bdc6
je 0x43c650
inc ecx
cmp eax, ecx
jne 0x43c640
jmp 0x43c681
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c681
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44b67c]
push eax
call fcn.004392f0
add esp, 0x24
mov edi, eax
push esi
call fcn.00408fc0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c6c0
sar eax, 1
lea ebx, [eax + 4]
and eax, 1
mov ecx, ebx
or ecx, 1
add ecx, eax
jns 0x43c6e3
mov ecx, 0xffffffff
jmp 0x43c6e5
add ecx, ecx
push ecx
call fcn.00437310
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [edi]
test cx, cx
je 0x43c731
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x43c720
mov word [eax], 0
lea eax, [ebx + ebx]
mov word [esp + 8], ax
lea eax, [ebx + ebx]
add eax, 2
mov word [esp + 0xa], ax
mov dword [esp + 0xc], esi
mov dword [esp + 0x44], 0x18
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1b
ja 0x43c81e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x725c0c28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xe7
and eax, 0x67
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1c
jb 0x43c7d0
mov edi, dword [esp + 0x10]
mov eax, dword [0x44b674]
test eax, eax
je 0x43c875
xor ecx, ecx
mov edx, dword [0x44b678]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x6a34d54b
je 0x43c850
inc ecx
cmp eax, ecx
jne 0x43c840
jmp 0x43c875
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c875
lea ecx, [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
push edx
push 2
push dword [0x44b67c]
push eax
call fcn.004392f0
add esp, 0x14
mov edi, eax
push esi
call fcn.00408fc0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43c88b
mov eax, dword [esp + 0x30]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1b
ja 0x43c94e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x725c0c28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xe7
and eax, 0x67
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1c
jb 0x43c900
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x44b674]
test edx, edx
je 0x43c9a8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44b678]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x904d52bc
je 0x43c980
inc edi
cmp edx, edi
jne 0x43c970
jmp 0x43c9a8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43c9a8
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x44b67c]
push edx
call fcn.004392f0
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43c9b5
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x43c9c1
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1b
ja 0x43ca7e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x725c0c28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xe7
and eax, 0x67
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1c
jb 0x43ca30
mov eax, dword [esp + 0x10]
mov edi, dword [0x44b674]
test edi, edi
je 0x43cadd
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x44b678]
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xcdf6794a
je 0x43cab0
inc ebx
cmp edi, ebx
jne 0x43caa0
jmp 0x43cadd
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43cadd
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x44b67c]
push edi
call fcn.004392f0
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43cbe8
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1b
ja 0x43cb8e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x725c0c28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xe7
and eax, 0x67
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1c
jb 0x43cb40
mov eax, dword [esp + 0x10]
mov ecx, dword [0x44b674]
test ecx, ecx
je 0x43cbe0
xor edx, edx
mov esi, dword [0x44b678]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x7a1a689f
je 0x43cbc0
inc edx
cmp ecx, edx
jne 0x43cbb0
jmp 0x43cbe0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43cbe0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x44b67c]
push ecx
call fcn.004392f0
add esp, 0x18
test eax, eax
js 0x43cbe8
mov eax, dword [esp + 8]
test edi, edi
je 0x43cbfb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43cbf9
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret