joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433c10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x433c30
test edx, edx
je 0x433caa
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x433c65
xor ebx, ebx
nop
nop
nop
movzx ebp, word [ecx]
add ecx, 2
xor ebp, eax
imul eax, ebp, 0x1000193
inc ebx
cmp edi, ebx
jne 0x433c50
sub edx, ebx
cmp esi, 3
jb 0x433caa
xor esi, esi
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x433c70
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4343e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4344e0
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x434429
mov ecx, dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, ecx
mov edi, edx
mov ebp, dword [esp + 0x18]
jae 0x4344e2
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004187c0
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004187c0
mov ecx, dword [esp + 0x20]
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
mov byte [edx + esi], al
cmp edi, ecx
jae 0x434410
movzx eax, byte [ebp + edi]
push eax
call fcn.004187c0
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x434410
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
lea eax, [edi + 1]
cmp eax, ecx
jae 0x434410
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004187c0
add esp, 4
cmp al, 0x40
je 0x4343fe
shl bl, 6
add al, bl
mov ecx, esi
and ecx, 1
mov edx, dword [esp]
xor edx, 1
lea edx, [edx + ecx*2]
mov dword [esp], edx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
jmp 0x4343fe
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x32353437
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x437b2a
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0xe60798f9
xor eax, 0xe60798f9
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x31
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x437ae0
mov ebx, dword [esp + 0x10]
mov eax, dword [0x4476a0]
test eax, eax
je 0x437b76
xor ecx, ecx
mov edx, dword [0x4476a4]
nop
cmp dword [edx + ecx*8], 0xe4aa2089
je 0x437b50
inc ecx
cmp eax, ecx
jne 0x437b40
jmp 0x437b76
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x437b76
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x4476a8]
push eax
call fcn.00439650
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x437cd8
push dword [esp + 8]
call fcn.00437910
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], 0x32353437
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x437c0c
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
mov esi, ecx
and esi, 0xe60798f9
xor ecx, 0xe60798f9
lea ecx, [ecx + esi*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x31
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x437bc0
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x4476a0]
test ecx, ecx
je 0x437c64
xor edx, edx
mov esi, dword [0x4476a4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe4aa2089
je 0x437c40
inc edx
cmp ecx, edx
jne 0x437c30
jmp 0x437c64
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, ebx
je 0x437c64
push 0
push eax
push dword [esp + 0xc]
push 5
push 4
push dword [0x4476a8]
push ecx
call fcn.00439650
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x437ccc
mov dword [esp + 0x20], edi
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 4]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebx]
movzx edi, word [eax + ebx]
test si, si
je 0x437ca5
add ebx, 2
cmp si, di
je 0x437c90
cmp si, di
je 0x437cb7
mov esi, dword [ecx]
test esi, esi
jne 0x437c80
mov ebx, 0xc0000225
jmp 0x437ccc
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.004379b0
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x437d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x437e20
xor eax, eax
cmp dword [ecx], 0
jne 0x437e25
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x437dea
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, eax
and esi, 0xe60798f9
xor eax, 0xe60798f9
lea eax, [eax + esi*2]
lea esi, [eax + edx]
and eax, edx
add eax, eax
mov edx, eax
xor edx, esi
not eax
and eax, esi
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x31
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x437da0
mov eax, dword [esp + 8]
mov esi, dword [0x4476a0]
test esi, esi
je 0x437e25
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x4476a4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x437e2f
inc edi
cmp esi, edi
jne 0x437e10
jmp 0x437e25
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x437e25
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x4476a8]
push esi
call fcn.00439650
add esp, 0x1c
jmp 0x437e25

Function at 0x437e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x437f47
mov esi, ecx
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x437eec
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
and edi, 0xe60798f9
xor ecx, 0xe60798f9
lea ecx, [ecx + edi*2]
lea edi, [ecx + edx]
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x31
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x437ea0
mov ecx, dword [0x4476a0]
test ecx, ecx
je 0x437f3a
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x4476a4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0x437f20
inc edi
cmp ecx, edi
jne 0x437f10
jmp 0x437f3a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x437f3a
push eax
push 1
push dword [0x4476a8]
push ecx
call fcn.00439650
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43815e
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43815e
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x437fec
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
and edi, 0xe60798f9
xor ecx, 0xe60798f9
lea ecx, [ecx + edi*2]
lea edi, [ecx + edx]
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0x31
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x437fa0
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0x4476a0]
test edx, edx
je 0x438045
xor ecx, ecx
mov ebx, dword [0x4476a4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0xac3673b8
je 0x438023
inc ecx
cmp edx, ecx
jne 0x438010
mov ebx, dword [ebp + 0x10]
jmp 0x438045
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x438045
push dword [ebp + 8]
push eax
push 2
push dword [0x4476a8]
push ecx
call fcn.00439650
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x438153
cmp edi, 0xc000010a
jne 0x438153
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 8
ja 0x4380ff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
and edi, 0xe60798f9
xor ecx, 0xe60798f9
lea ecx, [ecx + edi*2]
lea edi, [ecx + edx]
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x31
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 9
jb 0x4380b0
mov edi, dword [esp + 8]
mov ecx, dword [0x4476a0]
test ecx, ecx
je 0x438153
xor edx, edx
mov ebx, dword [0x4476a4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xb33e16a3
je 0x438130
inc edx
cmp ecx, edx
jne 0x438120
jmp 0x438153
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x438153
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0x4476a8]
push ecx
call fcn.00439650
add esp, 0x18
mov edi, eax
test edi, edi
js 0x43815e
mov ecx, esi
call fcn.00437e60
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x438170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x438187
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x4381fa
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, eax
and edi, 0xe60798f9
xor eax, 0xe60798f9
lea eax, [eax + edi*2]
lea edi, [eax + esi]
and eax, esi
add eax, eax
mov esi, eax
xor esi, edi
not eax
and eax, edi
add eax, eax
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x31
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x4381b0
mov eax, dword [esp + 8]
mov esi, dword [0x4476a0]
test esi, esi
je 0x438244
xor edi, edi
mov ebx, dword [0x4476a4]
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x438220
inc edi
cmp esi, edi
jne 0x438210
jmp 0x438244
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438244
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x4476a8]
push esi
call fcn.00439650
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x439690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x278
push dword [0x44f6b8]
call fcn.0043a2f0
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x44584c]

Function at 0x43a2f0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
sub esp, 0x18
mov dword [esi + 0x38], esp
sub esp, 8
mov dword [esi + 0x48], esp
movzx eax, word [ebx]
mov dword [esi + 0x20], 0x302e3f1
mov dword [esi + 0x24], 0
mov dword [esi + 0x27], 0
mov dword [esi + 4], 0
mov ecx, dword [esi + 4]
cmp ecx, 0xa
ja 0x43a378
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi + 4]
mov edx, dword [esi + 4]
movzx edx, byte [esi + edx + 0x20]
lea edi, [ecx + 0x60551d6]
add ecx, 0xd6
and ecx, edx
or edi, edx
sub edi, ecx
mov dword [esi + 0x18], edi
mov ecx, dword [esi + 0x18]
add cl, 0x26
mov edx, dword [esi + 4]
mov byte [esi + edx + 0x20], cl
inc dword [esi + 4]
mov ecx, dword [esi + 4]
cmp ecx, 0xb
jb 0x43a340
xor ecx, ecx
cmp dword [esi + 0x20], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4459fc]
jmp dword [0x445a08]
jmp dword [0x445a2c]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + ecx]
mov dword [esi + 8], eax
mov dword [esi + 0x20], 0x7372283c
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [esi + 4], 0
mov edx, dword [esi + 4]
cmp edx, 8
ja 0x43a94f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esi + 4]
mov edi, dword [esi + 4]
movzx eax, byte [esi + edi + 0x20]
lea edi, [edx - 0x7985792]
mov ebx, eax
not ebx
or ebx, edi
and edi, eax
add edi, ebx
neg edi
lea eax, [edx + edi]
add eax, 0xf867a86d
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x18]
add al, 0xfe
mov edx, dword [esi + 4]
mov byte [esi + edx + 0x20], al
inc dword [esi + 4]
mov eax, dword [esi + 4]
cmp eax, 9
jb 0x43a910
mov ebx, dword [ebp + 8]
jmp dword [0x445a10]
mov dword [esi + 0x20], 0x7372283c
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
cmp eax, 8
ja case.0x43a382.3
nop
nop
nop
mov eax, dword [esi + 4]
mov ecx, dword [esi + 4]
movzx edx, byte [esi + ecx + 0x20]
lea ecx, [eax - 0x7985792]
mov edi, edx
not edi
or edi, ecx
and ecx, edx
add ecx, edi
neg ecx
add eax, ecx
add eax, 0xf867a86d
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x18]
add al, 0xfe
mov ecx, dword [esi + 4]
mov byte [esi + ecx + 0x20], al
inc dword [esi + 4]
mov eax, dword [esi + 4]
cmp eax, 9
jb 0x43a980
jmp case.0x43a382.3
xor edx, edx
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0x20]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x445a14]
mov edi, dword [ebx + ecx + 0x78]
xor edx, edx
cmp dword [ebx + ecx + 0x7c], 0
sete dl
xor eax, eax
jmp dword [edx*4 + 0x445a1c]
mov ecx, dword [0x445b60]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x43ae10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, esp
mov ecx, dword [ebp + 8]
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [eax], 0xdbdad9e8
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [esi], 0
mov edx, dword [esi]
cmp edx, 9
ja 0x43ae91
nop
nop
nop
nop
mov edx, dword [esi]
mov edi, dword [esi]
movzx edi, byte [eax + edi]
lea ebx, [edx + edi]
add ebx, 0xe5a73adc
add edx, 0xe5a73adc
and edx, edi
add edx, edx
sub ebx, edx
mov dword [esi + 4], ebx
mov edx, dword [esi + 4]
add dl, 0xfc
mov edi, dword [esi]
mov byte [eax + edi], dl
mov edx, dword [esi]
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov dword [esi], edx
mov edx, dword [esi]
cmp edx, 0xa
jb 0x43ae50
mov eax, dword [eax]
mov eax, dword fs:[eax]
mov edx, dword [0x446164]
nop
nop
nop
nop
jmp edx
Function at 0x43b060
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 8], 0x9390cbc1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xb
ja 0x43b0e3
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea esi, [edx - 0x4915616d]
mov edi, ecx
not edi
or edi, esi
and esi, ecx
add esi, edi
neg esi
lea ecx, [edx + esi]
add ecx, 0xb6ea9e92
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xfb
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xc
jb 0x43b0a0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446208]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov esi, dword [ecx + edx]
mov dword [esp + 8], 0x6364aed6
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xd
ja 0x43b173
nop
nop
nop
nop
mov ecx, dword [esp]
mov edi, dword [esp]
movzx ebx, byte [esp + edi + 8]
lea edi, [ecx + 0x11]
and edi, ebx
add ecx, ebx
add ecx, 0xfa33c811
add edi, edi
mov ebx, edi
xor ebx, ecx
not edi
and edi, ecx
add edi, edi
sub edi, ebx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0x89
mov edi, dword [esp]
mov byte [esp + edi + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xe
jb 0x43b130
xor ecx, ecx
cmp esi, dword [esp + 8]
setne cl
jmp dword [ecx*4 + 0x446210]
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + edx + 0x7c]
mov edx, dword [ecx + edx + 0x78]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x446218]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x446220]
mov dword [esp + 0x1c], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + edx + 0x20]
add eax, esi
mov dword [esp + 0x28], eax
mov eax, dword [case.0x43b17c.8]
mov ecx, dword [esi + edx + 0x24]
add ecx, esi
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + edx + 0x1c]
add ecx, esi
mov dword [esp + 0x20], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor ebx, ebx
mov eax, dword [case.0x43b17c.12]
mov dword [esp + 0x18], edx
nop
nop
nop
jmp eax
xor eax, eax
cmp ebx, dword [esi + edx + 0x18]
setb al
mov ecx, 1
jmp dword [eax*4 + 0x446248]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b1f2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 8], 0x9390cbc1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xb
ja 0x43b0e3
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea esi, [edx - 0x4915616d]
mov edi, ecx
not edi
or edi, esi
and esi, ecx
add esi, edi
neg esi
lea ecx, [edx + esi]
add ecx, 0xb6ea9e92
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xfb
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xc
jb 0x43b0a0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446208]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov esi, dword [ecx + edx]
mov dword [esp + 8], 0x6364aed6
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xd
ja 0x43b173
nop
nop
nop
nop
mov ecx, dword [esp]
mov edi, dword [esp]
movzx ebx, byte [esp + edi + 8]
lea edi, [ecx + 0x11]
and edi, ebx
add ecx, ebx
add ecx, 0xfa33c811
add edi, edi
mov ebx, edi
xor ebx, ecx
not edi
and edi, ecx
add edi, edi
sub edi, ebx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0x89
mov edi, dword [esp]
mov byte [esp + edi + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xe
jb 0x43b130
xor ecx, ecx
cmp esi, dword [esp + 8]
setne cl
jmp dword [ecx*4 + 0x446210]
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + edx + 0x7c]
mov edx, dword [ecx + edx + 0x78]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x446218]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x446220]
mov dword [esp + 0x1c], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + edx + 0x20]
add eax, esi
mov dword [esp + 0x28], eax
mov eax, dword [case.0x43b17c.8]
mov ecx, dword [esi + edx + 0x24]
add ecx, esi
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + edx + 0x1c]
add ecx, esi
mov dword [esp + 0x20], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor ebx, ebx
mov eax, dword [case.0x43b17c.12]
mov dword [esp + 0x18], edx
nop
nop
nop
jmp eax
xor eax, eax
cmp ebx, dword [esi + edx + 0x18]
setb al
mov ecx, 1
jmp dword [eax*4 + 0x446248]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x798e1c3c
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..pdata_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x108d4f45
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0xf1e0755
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x32f30979
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219