joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov dword [esp + 8], 0x49dc4b1d
mov dword [esp + 0xc], 0x45d747c5
mov dword [esp + 0x10], 0x414243d6
mov dword [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edx, 0xc
sub edx, eax
lea esi, [eax + 0xf3]
and esi, 0xc6
mov edi, edx
and edi, 0x39
or edi, esi
mov esi, 0x58d40c
sub esi, eax
xor edi, esi
xor edi, 0xc6
and edx, esi
or edx, edi
mov ebx, esi
xor ebx, ecx
and edx, ecx
not ecx
and ecx, esi
add ebx, esi
not ebx
add ebx, ecx
or ebx, edx
add bl, 0x41
mov byte [esp + eax + 8], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x10
jb 0x41cff0
mov dword [esp + 0x34], 0xf19a0fa4
mov dword [esp + 0x38], 0xf562f364
mov dword [esp + 0x3c], 0xf927f72e
mov dword [esp + 0x40], 0xfd56fb29
mov dword [esp + 0x44], 0xe15bff6d
mov dword [esp + 0x48], 0xe54ee343
mov dword [esp + 0x4c], 0xe977e74c
mov dword [esp + 0x50], 0xed7eeb7d
mov dword [esp + 0x54], 0xd1eeef36
mov word [esp + 0x58], 0
mov byte [esp + 0x5a], 0
mov eax, 0xfd
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xc9]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xf
mov byte [esp + eax - 0xc9], dl
inc eax
dec ecx
cmp eax, 0x124
jne 0x41d0b0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0x41d103
lea edx, [esp + 0x36]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d0f0
jmp 0x41d106
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41d131
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d120
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41d161
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d150
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x34], 0x959090ca
mov byte [esp + 0x38], 0x38
mov dword [esp + 0x39], 0
mov byte [esp + 0x3d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xcb
xor cl, byte [esp + eax + 0x34]
add cl, 9
mov byte [esp + eax + 0x34], cl
inc eax
cmp eax, 0xa
jne 0x41d190
movzx eax, byte [esp + 0x34]
test al, al
je 0x41d1cb
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d1c0
mov byte [esi], 0
lea eax, [esp + 0x140]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.0040b6e0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x4469b8]
mov ecx, 0x40ba4041
xor ecx, dword [0x4469c0]
add eax, ecx
inc eax
jmp eax
Function at 0x420cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420ce0
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44cd18]
mov dword [esp + 8], 0xf13e3f19
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov ecx, 0x77f33335
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x77f3332d]
xor edx, ecx
add edx, 0xa9e267ef
mov ebx, edx
xor ebx, 6
and edx, 6
lea edx, [ebx + edx*2]
add dl, 2
mov byte [esp + ecx - 0x77f3332d], dl
inc ecx
cmp ecx, 0x77f3333c
jne 0x420d20
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446cb8]
Function at 0x422860
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x422870
cmp eax, 0xffffffed
jge 0x422887
mov eax, 0xffffffff
jmp 0x42288a
add eax, 0x12
push eax
call fcn.004086e0
add esp, 4
mov esi, eax
mov dword [esp], 0xff109e4
mov dword [esp + 4], 0x38b0de9
mov dword [esp + 8], 0x7340134
mov dword [esp + 0xc], 0x1bfc05e0
mov word [esp + 0x10], 0x1918
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
mov eax, 0x28952842
mov ecx, 0xbd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x28952842]
mov ebx, ecx
xor ebx, eax
and ebx, edx
xor ebx, eax
add ebx, 0x351636b5
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esp + eax - 0x28952842], dl
inc eax
dec ecx
cmp eax, 0x2895285a
jne 0x4228e0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x422931
add edi, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422920
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422961
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422950
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440ba0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446d88]
Function at 0x424fdd
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x21e527db
mov dword [esp + 8], 0x3d922390
mov dword [esp + 0xc], 0x399d3fe0
mov dword [esp + 0x10], 0x35993bb4
mov dword [esp + 0x14], 0x319237cb
mov dword [esp + 0x18], 0xd8a339c
mov dword [esp + 0x1c], 0x9b80f83
mov dword [esp + 0x20], 0x5b50bb4
mov dword [esp + 0x24], 0x1a407b6
mov dword [esp + 0x28], 0x1db003bb
mov dword [esp + 0x2c], 0x19ba1fa0
mov dword [esp + 0x30], 0x15a81bc8
mov dword [esp + 0x34], 0x11a817a5
mov dword [esp + 0x38], 0xeda613ab
mov dword [esp + 0x3c], 0xe963ef53
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xebe8
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov ecx, 0x2a0d46c9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x2a0d46c5]
xor edx, ecx
mov esi, edx
and esi, 0x12
xor edx, 0x12
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x2a0d46c5], dl
inc ecx
cmp ecx, 0x2a0d470d
jne 0x424f90
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44cd18]
mov dword [esp + 4], 0x718e8fa9
mov byte [esp + 8], 0
xor ecx, ecx
nop
nop
movzx edi, byte [esp + ecx + 4]
lea edx, [ecx + 0x22bc7d9d]
xor edx, edi
mov edi, edx
and edi, 0xec
mov ebp, edx
and ebp, 2
mov ebx, ebp
xor ebx, 2
imul ebx, edi
or edi, 2
imul edi, ebp
xor edx, 0xee
add edx, ebx
add edx, edi
inc dl
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
and ecx, 6
mov edi, ecx
xor edi, 6
xor ecx, 0xfffffffe
or ecx, edi
not ecx
add ecx, edx
cmp ecx, 5
jb case.default.0x42505e
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x4473bc]
mov ebx, dword [esp]
test ebx, ebx
jns 0x425073
mov eax, 0xffffffff
jmp 0x425076
lea eax, [ebx + ebx]
push eax
call fcn.004086e0
add esp, 4
mov edi, eax
mov eax, esp
push eax
push ebx
push edi
push 0x1e
push esi
push 0
call dword [0x44cd18]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4473c4]
xor ebx, ebx
jmp dword [0x4473cc]
mov dword [esp + 4], 0x63fa61d4
mov dword [esp + 8], 0x67f865f1
mov dword [esp + 0xc], 0x5bff59fc
mov dword [esp + 0x10], 0x5ffc5dce
mov dword [esp + 0x14], 0x53c051c9
mov dword [esp + 0x18], 0x575655f0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
mov edx, eax
and edx, 0x30
mov ebx, ecx
xor ebx, 0x7c381698
add ebx, edx
mov edx, ebx
or edx, esi
and ebx, esi
sub edx, ebx
add dl, 8
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x18
jne 0x4250e0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0xac]
call fcn.00420cd0
add esp, 0x14
mov ebx, eax
jmp dword [0x4473cc]
push edi
call fcn.004086f0
add esp, 4
mov eax, dword [case.0x42505e.1]
nop
nop
nop
nop
nop
jmp eax
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xf0
mov dword [esp], 0x63a36185
mov dword [esp + 4], 0x67f665f4
mov dword [esp + 8], 0x5bfb599c
mov dword [esp + 0xc], 0x5fff5dc8
mov dword [esp + 0x10], 0x535251b5
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x98
xor dl, byte [esp + ecx]
add dl, 8
mov byte [esp + ecx], dl
add ecx, 0xcf0c503b
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add ecx, 0x30f3afc5
cmp ecx, 0x18
jb 0x42a430
lea esi, [esp + 0xaa]
mov edx, esp
mov edi, esi
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xbe]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 9
push esi
push 0
call dword [0x44cd18]
mov dword [esp], 0x23626183
mov byte [esp + 4], 0
mov ecx, 0x838d8e18
mov edx, 0xe7
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x7c7271e8]
mov ebp, edx
xor ebp, ecx
and ebp, ebx
xor ebp, ecx
lea ebx, [ebp + 0x87]
not ebp
and ebp, 1
xor ebx, 1
lea ebx, [ebx + ebp*2]
mov byte [esp + ecx + 0x7c7271e8], bl
inc ecx
dec edx
cmp ecx, 0x838d8e1d
jne 0x42a4b0
xor ecx, ecx
cmp eax, dword [esp]
setne cl
jmp dword [ecx*4 + 0x447ea0]
Function at 0x433cd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00418930
sub esp, 0x14
mov edi, esp
jmp 0x433ce5
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x433d0b
jmp 0x433e74
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x433d47
jmp 0x433e6c
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042f7a0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x433d7b
jmp 0x433e5b
mov ebx, eax
add ebx, 1
mov dword [ebp - 0x1c], eax
jmp 0x433d85
sub esp, 4
mov dword [esp], ebx
call fcn.004086e0
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042f810
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xff
mov byte [edi + 1], 0x95
mov byte [edi + 2], 0x97
mov byte [edi + 3], 0xaf
mov byte [edi + 4], 0x9a
mov byte [edi + 5], 0xae
mov byte [edi + 6], 0x83
mov byte [edi + 7], 0xb5
mov byte [edi + 8], 0x84
mov byte [edi + 9], 0xf3
mov byte [edi + 0xa], 0xb2
mov byte [edi + 0xb], 0xbf
mov byte [edi + 0xc], 0xb0
mov byte [edi + 0xd], 0x25
mov eax, 0xe
mov ecx, dword [ebp + 8]
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x433df0
xor esi, esi
cmp esi, 0x14
jae 0x433e27
mov dl, byte [edi + esi]
movzx ecx, dl
mov eax, esi
add eax, 0xbd27834a
mov ebx, eax
and ebx, ecx
mov ecx, dword [ebp + 8]
shl ebx, 1
sub eax, ebx
add al, dl
add al, 0x8e
mov byte [edi + esi], al
add esi, 1
jmp 0x433dfe
jmp 0x433e29
mov esi, dword [ebp - 0x14]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.004095f0
mov bl, al
and bl, 1
jmp 0x433e49
jmp 0x433e4b
sub esp, 4
mov dword [esp], esi
call fcn.004086f0
add esp, 4
jmp 0x433e5b
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x433e6c
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x433e74
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x438eb0
mov dword [esp], 0x222220b3
mov word [esp + 4], 0
mov esi, 0xd23c8288
nop
nop
movzx edi, byte [esp + esi + 0x2dc37d78]
xor edi, esi
lea ebx, [edi + 0x57]
not edi
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
mov byte [esp + esi + 0x2dc37d78], bl
inc esi
cmp esi, 0xd23c828e
jne 0x438ed0
test edx, edx
je 0x438f5e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x438f21
mov ebp, eax
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438f10
cmp edi, 3
jb 0x438f5e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x438f30
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
lea eax, [esp + 0x10]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x40]
call fcn.004409e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44932c]

Function at 0x439d60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00441160
add esp, 0x14
test eax, eax
js 0x439e9f
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004415b0
add esp, 0x24
mov ecx, eax
xor esi, esi
mov eax, 0
test ecx, ecx
js 0x439dff
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x439dc9
mov eax, 0xffffffff
jmp 0x439dd0
lea eax, [eax*2 + 2]
push eax
call fcn.004086e0
add esp, 4
push edi
mov edi, eax
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.00441bf0
add esp, 0x14
test eax, eax
js 0x439df4
mov eax, edi
jmp 0x439dff
push edi
call fcn.004086f0
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x4c4d4a4b
mov word [esp + 8], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 4
mov ebx, edx
xor ebx, 0xf2
add ebx, edi
xor bl, byte [esp + edx + 4]
add bl, 0x46
mov byte [esp + edx + 4], bl
inc edx
add esi, 2
cmp edx, 6
jne 0x439e20
mov edx, dword [0x44cd1c]
test edx, edx
je 0x439e8e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439e70
inc edi
cmp edx, edi
jne 0x439e60
jmp 0x439e8e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x439e8e
push ecx
push 4
push edx
push dword [0x44cd24]
mov esi, eax
call fcn.0043e470
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x439ea1
lea eax, [esp + 4]
push eax
call fcn.004407d0
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x43ba10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov dword [esp], 0x313e3f0c
mov word [esp + 4], 0
mov eax, 0xb5b8a48b
mov ecx, 0x75
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x75]
mov edx, ecx
and edx, edi
add edx, edx
sub edx, edi
add edx, eax
mov edi, edx
and edi, 0x4a
add edi, edi
xor edx, 0xb5
sub edx, edi
add dl, 2
mov byte [esp + ecx - 0x75], dl
dec eax
inc ecx
cmp ecx, 0x7b
jne 0x43ba40
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [0x454d40]
jmp dword [0x449654]

Function at 0x43bab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
xor ecx, ecx
cmp dword [esp + 0x1c], 0
setne cl
jmp dword [ecx*4 + 0x449660]
Function at 0x43bb70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov esi, 0xd
sub esi, eax
mov ecx, esi
or ecx, edx
and esi, edx
not ecx
add ecx, esi
add cl, 0x46
mov byte [esp + eax], cl
add eax, 0xc3f96a2f
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 0x3c0695d1
cmp eax, 6
jb 0x43bba0
mov ebp, dword [esp]
mov eax, dword [0x44cd1c]
test eax, eax
je 0x43bc26
xor ecx, ecx
mov edx, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43bc00
inc ecx
cmp eax, ecx
jne 0x43bbf0
jmp 0x43bc26
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x43bc26
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0xd392919c
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x64
xor cl, byte [esp + eax]
add cl, 0xc
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 6
jb 0x43bc40
cmp ebp, dword [esp]
jne 0x43bda4
mov dword [esp + 0x10], edi
push dword [esp + 8]
call fcn.0043ba10
add esp, 4
mov edi, dword [esp + 8]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov ebp, 0xd
sub ebp, edx
mov ecx, ebp
or ecx, esi
and ebp, esi
not ecx
add ecx, ebp
add cl, 0x46
mov byte [esp + edx], cl
add edx, 0xc3f96a2f
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
add edx, 0x3c0695d1
cmp edx, 6
jb 0x43bc90
mov ebp, dword [esp]
mov edx, dword [0x44cd1c]
test edx, edx
je 0x43bd19
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44cd20]
nop
nop
cmp dword [esi + ebp*8], 0x61813e67
je 0x43bcf2
inc ebp
cmp edx, ebp
jne 0x43bce0
mov ebp, ecx
jmp 0x43bd19
mov edx, dword [esi + ebp*8 + 4]
mov ebp, ecx
cmp edx, ecx
je 0x43bd19
push 0
push edi
push eax
push 5
push 0x10
push edx
push dword [0x44cd24]
mov esi, eax
call fcn.0043e470
add esp, 0x1c
mov ebp, eax
mov eax, esi
test ebp, ebp
js 0x43bd9b
mov dword [esp], 0x83c2c325
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xb0
xor dl, byte [esp + ecx]
add dl, 0x90
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne 0x43bd30
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov esi, dword [eax]
mov ecx, eax
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x43bd75
add ebp, 2
cmp si, di
je 0x43bd60
cmp si, di
je 0x43bd86
mov esi, dword [ecx]
test esi, esi
jne 0x43bd50
mov ebp, dword [esp + 0xc]
jmp 0x43bd9b
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.0043bab0
add esp, 4
mov eax, ebp
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43bdd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43bea0
xor eax, eax
cmp dword [ecx], 0
jne 0x43beda
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, 0xd
sub edi, eax
mov ebx, edi
or ebx, esi
and edi, esi
not ebx
add ebx, edi
add bl, 0x46
mov byte [esp + eax], bl
add eax, 0xc3f96a2f
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
add eax, 0x3c0695d1
cmp eax, 6
jb 0x43be40
mov eax, dword [esp]
mov esi, dword [0x44cd1c]
test esi, esi
je 0x43beda
xor edi, edi
mov ebx, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43bee3
inc edi
cmp esi, edi
jne 0x43be90
jmp 0x43beda
mov dword [esp + 8], 0x914e4f44
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xed
xor cl, byte [esp + eax + 8]
add cl, 0x5f
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne 0x43bec0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43beda
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x1c
jmp 0x43beda

Function at 0x43bf10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43bfba
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor edx, edx
movzx esi, byte [esp + edx]
mov edi, 0xd
sub edi, edx
mov ebx, edi
or ebx, esi
and edi, esi
not ebx
add ebx, edi
add bl, 0x46
mov byte [esp + edx], bl
add edx, 0xc3f96a2f
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add edx, 0x3c0695d1
cmp edx, 6
jb 0x43bf30
mov edx, dword [0x44cd1c]
test edx, edx
je 0x43bfae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44cd20]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43bf90
inc edi
cmp edx, edi
jne 0x43bf80
jmp 0x43bfae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43bfae
push eax
push 4
push edx
push dword [0x44cd24]
mov esi, ecx
call fcn.0043e470
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43c240
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov ebp, 0xd
sub ebp, eax
mov edx, ebp
or edx, esi
and ebp, esi
not edx
add edx, ebp
add dl, 0x46
mov byte [esp + eax], dl
add eax, 0xc3f96a2f
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
add eax, 0x3c0695d1
cmp eax, 6
jb 0x43c270
test ebx, ebx
jne 0x43c2ad
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44cd1c]
test ebp, ebp
je 0x43c304
xor edx, edx
mov esi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43c2e0
inc edx
cmp ebp, edx
jne 0x43c2d0
jmp 0x43c304
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43c304
push ebx
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10