joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41a9a5
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x41a8e9
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x41a9a7
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0041d0d0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0041d0d0
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
add cl, bh
lea eax, [esi + 1]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov byte [eax + esi], cl
cmp edi, edx
jae 0x41a8d0
movzx eax, byte [ebp + edi]
push eax
call fcn.0041d0d0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x41a8d0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x41a8d0
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx + edi + 1]
push ecx
mov ebx, eax
call fcn.0041d0d0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x41a8d0
mov ecx, ebx
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
add esi, 3
mov dword [esp], esi
jmp 0x41a8d0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
xor eax, eax
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x420220
lea ecx, [edi + eax]
add ecx, 0xfffffffe
add eax, edi
mov edx, 1
sub edx, eax
and edx, edi
mov eax, edi
not eax
and eax, ecx
sub eax, edx
cmp eax, 0xffffffed
jge 0x42024f
mov eax, 0xffffffff
jmp 0x420252
add eax, 0x12
push eax
call fcn.0040c8c0
add esp, 4
mov esi, eax
mov dword [esp], 0x3e901dc
mov dword [esp + 4], 0x7ff05e1
mov dword [esp + 8], 0xb24093c
mov dword [esp + 0xc], 0xfec0de8
mov dword [esp + 0x10], 0x1110
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, ecx
not edx
mov ebx, eax
xor ebx, 0x3f
or ebx, edx
lea edx, [eax + ebx]
add edx, 0x7fb166c1
add ecx, ebx
inc ecx
or ecx, edx
add ecx, 0x8188fe3f
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x420290
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4202f1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4202e0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420321
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420310
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00441b40
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44801c]
Function at 0x42252a
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp], 0xe33ee1c5
mov dword [esp + 4], 0xe705e51b
mov dword [esp + 8], 0xfb06f919
mov dword [esp + 0xc], 0xff0efd3d
mov dword [esp + 0x10], 0xf336f100
mov dword [esp + 0x14], 0xf702f515
mov dword [esp + 0x18], 0x8baf8969
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x8d8c
mov byte [esp + 0x20], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x28
xor dl, byte [esp + ecx]
add dl, 0x38
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x21
jne 0x422580
lea ebx, [esp + 0x6e]
mov edx, esp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44da98]
mov ebp, dword [esp + 0x50]
test ebp, ebp
jns 0x4225db
mov eax, 0xffffffff
jmp 0x4225e2
lea eax, [ebp*2]
push eax
call fcn.0040c8c0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0xe
push ebx
push 0
call dword [0x44da98]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x42260d
mov eax, 0xffffffff
jmp 0x422614
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c8c0
add esp, 4
mov edi, eax
mov dword [esp], 0x9da0be8
mov dword [esp + 4], 0x5fb07f7
mov dword [esp + 8], 0x1fd03f1
mov dword [esp + 0xc], 0x1de51ff9
mov dword [esp + 0x10], 0x191a1b91
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x43
xor cl, byte [esp + eax]
add cl, 0xb1
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x15
jb 0x422650
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x422691
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422680
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4226c1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4226b0
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.00441b40
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448600]
Function at 0x422533
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp], 0xe33ee1c5
mov dword [esp + 4], 0xe705e51b
mov dword [esp + 8], 0xfb06f919
mov dword [esp + 0xc], 0xff0efd3d
mov dword [esp + 0x10], 0xf336f100
mov dword [esp + 0x14], 0xf702f515
mov dword [esp + 0x18], 0x8baf8969
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x8d8c
mov byte [esp + 0x20], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x28
xor dl, byte [esp + ecx]
add dl, 0x38
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x21
jne 0x422580
lea ebx, [esp + 0x6e]
mov edx, esp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44da98]
mov ebp, dword [esp + 0x50]
test ebp, ebp
jns 0x4225db
mov eax, 0xffffffff
jmp 0x4225e2
lea eax, [ebp*2]
push eax
call fcn.0040c8c0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0xe
push ebx
push 0
call dword [0x44da98]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x42260d
mov eax, 0xffffffff
jmp 0x422614
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c8c0
add esp, 4
mov edi, eax
mov dword [esp], 0x9da0be8
mov dword [esp + 4], 0x5fb07f7
mov dword [esp + 8], 0x1fd03f1
mov dword [esp + 0xc], 0x1de51ff9
mov dword [esp + 0x10], 0x191a1b91
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x43
xor cl, byte [esp + eax]
add cl, 0xb1
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x15
jb 0x422650
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x422691
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422680
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4226c1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4226b0
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.00441b40
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448600]
Function at 0x4257e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x5c], 0x29be2bb1
mov dword [esp + 0x60], 0x2dc92fc3
mov dword [esp + 0x64], 0xd100d3bf
mov dword [esp + 0x68], 0xd54ed73b
mov dword [esp + 0x6c], 0xd9dadb3f
mov byte [esp + 0x70], 0
mov eax, 0xebcd3377
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1432cce5]
mov edx, eax
and edx, ecx
add ecx, eax
add edx, edx
mov esi, ecx
sub esi, edx
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
add cl, 0xac
mov byte [esp + eax + 0x1432cce5], cl
inc eax
cmp eax, 0xebcd338c
jne 0x425850
lea edi, [esp + 0x5c]
lea ecx, [esp + 0x40]
push edi
call fcn.0043a300
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x448d20]
Function at 0x429b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x429bba
cmp edi, 1
je 0x429bba
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x429b91
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x429b90
cmp ecx, 0x20
je 0x429b90
cmp ecx, 0x2b
mov edx, edi
je 0x429bb0
cmp ecx, 0x2d
jne 0x429bcf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x429bd4
xor edi, edi
test eax, eax
je 0x429d8d
mov dword [eax], 0x16
jmp 0x429d8d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x429bfd
cmp edx, 0x10
jne 0x429c15
cmp byte [ebx], 0x30
jne 0x429bf6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x429c17
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x429c17
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x429c70
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x429d28
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x429c97
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x429d58
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x429d58
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x429c50
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x429ce0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x429ce9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x429d0d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x429d3d
test bl, bl
jne 0x429d3d
mov ebx, dword [esp + 0x10]
jmp 0x429c63
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x429c45
mov esi, edi
test bl, bl
jne 0x429d4b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x429c45
mov eax, dword [esp + 0x38]
test eax, eax
je 0x429d66
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x429d74
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x429d84
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x429d8d
cmp byte [esp + 3], 0
jne 0x429d8d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42c970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42cab4
mov eax, dword [esp + 0x18]
mov edx, eax
not edx
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
test edx, edx
je 0x42cab4
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42c9c0
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x42ca60
cmp ebx, 0x7ff
ja 0x42c9f0
cmp edx, 2
jb 0x42c9f0
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x42ca60
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x42ca76
cmp edx, 4
jb 0x42ca76
shl ebx, 0xa
movzx ecx, word [esi + 2]
add esi, 4
lea ebp, [ebx + ecx]
add ebp, 0xfca02400
mov ebx, ebp
shr ebx, 0x12
mov edi, ebp
shr edi, 0x11
and edi, 0xe0
xor ebx, 0xf0
add ebx, edi
mov byte [eax], bl
mov ebx, ebp
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr ebp, 6
mov ebx, ebp
not ebx
or ebx, 0x3f
add ebx, ebp
add bl, 0x81
mov byte [eax + 2], bl
and cl, 0x3f
or cl, 0x80
mov byte [eax + 3], cl
lea ecx, [eax + 4]
mov edi, esi
add edx, eax
sub edx, ecx
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x42c9a0
jmp 0x42cab4
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x42ca85
mov esi, edi
jmp 0x42ca68
cmp edx, 3
jb 0x42cab0
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x42ca60
mov ecx, eax
jmp 0x42ca60
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x437470
lea edi, [ebx - 2]
mov dword [esp + 8], 0x92929063
mov word [esp + 0xc], 0
xor edx, edx
nop
nop
movzx eax, byte [esp + edx + 8]
lea esi, [edx + 0x24]
and esi, eax
add eax, edx
add eax, 0x24
add esi, esi
sub eax, esi
add al, 0x4c
mov byte [esp + edx + 8], al
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 6
jb 0x437490
cmp ebx, 2
je 0x4374e0
mov esi, dword [esp + 8]
mov eax, edi
mov edx, edi
sar edx, 1
mov dword [esp + 4], edx
mov edi, esi
not edi
test al, 2
jne 0x4374e7
mov eax, esi
cmp ebx, 4
jne 0x43751e
jmp 0x437576
mov esi, ebp
jmp 0x437576
dec dword [esp + 4]
mov edx, esi
movzx esi, word [ecx]
add ecx, 2
xor esi, ebp
mov ebp, esi
and ebp, edi
mov dword [esp], ebp
mov ebp, esi
not ebp
and ebp, edx
imul ebp, dword [esp]
mov eax, esi
and eax, edx
mov dword [esp], eax
mov eax, edx
or esi, edx
imul esi, dword [esp]
add esi, ebp
mov ebp, esi
cmp ebx, 4
je 0x437576
mov edx, eax
xor ebx, ebx
mov esi, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, esi
mov eax, ebp
and eax, edi
mov esi, ebp
not esi
and esi, edx
imul esi, eax
mov eax, ebp
and eax, edx
or ebp, edx
imul ebp, eax
add ebp, esi
movzx esi, word [ecx + ebx*2 + 2]
xor esi, ebp
mov eax, esi
and eax, edi
mov ebp, esi
not ebp
and ebp, edx
imul ebp, eax
mov eax, esi
and eax, edx
or esi, edx
imul esi, eax
add esi, ebp
add ebx, 2
cmp dword [esp + 4], ebx
jne 0x437530
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
push eax
mov esi, esp
sub esp, 0x10
mov edi, esp
lea ecx, [ebp - 0x20]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.00441990
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [ebp - 0x18], 0
jmp dword [eax*4 + 0x44a968]

Function at 0x4383e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00442170
add esp, 0x14
test eax, eax
js 0x438546
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004425d0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x438477
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x438443
mov eax, 0xffffffff
jmp 0x43844a
lea eax, [eax*2 + 2]
push eax
call fcn.0040c8c0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00442c80
add esp, 0x14
test eax, eax
js 0x43846e
mov esi, edi
jmp 0x438477
push edi
call fcn.0040c8d0
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0x7c7d7a7b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov ecx, 0xeb
mov edx, 0x99387c15
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0xe7]
lea ebx, [edi + edi]
not ebx
add ebx, edi
lea ebp, [edx + 0x66c78400]
and ebp, edi
and edi, 0xc
and ebx, 0xb9debef3
or ebx, edi
xor ebx, 0xc
mov edi, ebx
and edi, edx
xor ebx, edx
add ebx, edi
add ebx, ecx
or ebx, ebp
add bl, 0x6e
mov byte [esp + ecx - 0xe7], bl
inc ecx
dec edx
cmp ecx, 0xf2
jne 0x4384a0
mov ecx, dword [0x44da9c]
test ecx, ecx
je 0x43852a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x438510
inc edi
cmp ecx, edi
jne 0x438500
jmp 0x43852a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43852a
push eax
push 1
push ecx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x10
test esi, esi
jne 0x438548
lea eax, [esp + 4]
push eax
call fcn.00441770
add esp, 4
test al, al
je 0x438546
cmp dword [esp + 4], 1
je 0x438548
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x13121140
mov dword [esp + 4], 0
mov ecx, 0x42c36384
nop
movzx edi, byte [esp + ecx - 0x42c36384]
lea esi, [ecx - 0x42c36300]
and esi, edi
mov ebx, esi
and ebx, 2
mov ebp, esi
or ebp, 0xfffffffd
inc ebp
mov edx, esi
and edx, 0xffffff8d
imul edx, ebp
or esi, 2
imul esi, ebx
add edx, edi
sub edx, esi
add edx, ecx
mov esi, edx
xor esi, 0x14
mov edi, edx
or edi, 0x6b
and edi, esi
xor edx, 0x6b
lea edx, [edx + edi*2]
inc dl
mov byte [esp + ecx - 0x42c36384], dl
inc ecx
cmp ecx, 0x42c3638c
jne 0x43a190
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x455ac0]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43a200
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44aef8]
Function at 0x43a5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43a6e0
xor eax, eax
cmp dword [ecx], 0
jne 0x43a726
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x7c7d7a7b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
movzx edi, byte [esp + eax]
lea esi, [eax + 0xea]
lea edx, [edi + edi]
not edx
add edx, edi
mov ebp, edi
and ebp, 5
mov ebx, edx
and ebx, 0xfa
or ebx, ebp
xor ebx, edi
xor ebx, 0xfa
not edi
or edi, ebx
mov ebx, edi
not ebx
or ebx, esi
add ebx, edi
mov edi, 0xfe
sub edi, ebx
or edx, esi
and edx, edi
mov bl, 0x6d
sub bl, dl
mov byte [esp + eax], bl
mov edx, eax
and edx, 1
or eax, 0xd8742c21
add eax, edx
add eax, 0x278bd3e0
cmp eax, 7
jb 0x43a650
mov eax, dword [esp]
mov esi, dword [0x44da9c]
test esi, esi
je 0x43a726
xor edi, edi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43a730
inc edi
cmp esi, edi
jne 0x43a6d0
jmp 0x43a726
mov dword [esp + 8], 0x9cacbf4
mov byte [esp + 0xc], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0x53
xor cl, byte [esp + eax + 8]
add cl, 0x61
mov byte [esp + eax + 8], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
lea ecx, [ecx*2 + 2]
mov edx, ecx
and edx, eax
or ecx, eax
xor ecx, 1
add ecx, edx
mov eax, ecx
cmp ecx, 5
jb 0x43a6f0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43a726
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push dword [esp + 0x44]
push ecx
push 4
push esi
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x1c
jmp 0x43a726

Function at 0x43a770
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43a85e
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0x7c7d7a7b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
lea esi, [edx + 0xea]
lea eax, [edi + edi]
not eax
add eax, edi
mov ebp, edi
and ebp, 5
mov ebx, eax
and ebx, 0xfa
or ebx, ebp
xor ebx, edi
xor ebx, 0xfa
not edi
or edi, ebx
mov ebx, edi
not ebx
or ebx, esi
add ebx, edi
mov edi, 0xfe
sub edi, ebx
or eax, esi
and eax, edi
mov bl, 0x6d
sub bl, al
mov byte [esp + edx], bl
mov eax, edx
and eax, 1
or edx, 0xd8742c21
add edx, eax
add edx, 0x278bd3e0
cmp edx, 7
jb 0x43a7a0
mov edx, dword [0x44da9c]
test edx, edx
je 0x43a851
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43a830
inc edi
cmp edx, edi
jne 0x43a820
jmp 0x43a851
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a851
push dword [esp + 8]
push 1
push edx
push dword [0x44daa4]
mov esi, ecx
call fcn.0043e1f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ab10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov edi, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43ab9a
push 0xbbf966b4
push dword [0x44da90]
call fcn.00440ed0
add esp, 8
test eax, eax
je 0x43ab61
mov ecx, dword [esi]
test ecx, ecx
je 0x43ab97
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ab73
cmp dword [esp], 0
je 0x43ab73
mov dword [esi + 4], 3
jmp 0x43ab97
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43ac57
lea eax, [esp + 0xc]
push eax
call fcn.00441770
add esp, 4
test al, al
je 0x43ab97
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43ab94
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
cmp eax, 2
jne 0x43ac57
mov dword [esp], 0x7c7d7a7b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
movzx ebx, byte [esp + eax]
lea esi, [eax + 0xea]
lea ecx, [ebx + ebx]
not ecx
add ecx, ebx
mov ebp, ebx
and ebp, 5
mov edx, ecx
and edx, 0xfa
or edx, ebp
xor edx, ebx
xor edx, 0xfa
not ebx
or ebx, edx
mov edx, ebx
not edx
or edx, esi
add edx, ebx
mov ebx, 0xfe
sub ebx, edx
or ecx, esi
and ecx, ebx
mov dl, 0x6d
sub dl, cl
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 1
or eax, 0xd8742c21
add eax, ecx
add eax, 0x278bd3e0
cmp eax, 7
jb 0x43abc0
mov eax, dword [esp]
mov edx, dword [0x44da9c]
test edx, edx
je 0x43ad2a
xor esi, esi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43ad00
inc esi
cmp edx, esi
jne 0x43ac40
jmp 0x43ad2a
mov dword [esp], 0x7c7d7a7b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
lea esi, [eax + 0xea]
lea edx, [ebx + ebx]
not edx
add edx, ebx
mov ecx, ebx
and ecx, 5
mov ebp, edx
and ebp, 0xfa
or ebp, ecx
xor ebp, ebx
xor ebp, 0xfa
not ebx
or ebx, ebp
mov ecx, ebx
not ecx
or ecx, esi
add ecx, ebx
mov ebx, 0xfe
sub ebx, ecx
or edx, esi
and edx, ebx
mov cl, 0x6d
sub cl, dl
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
or eax, 0xd8742c21
add eax, ecx
add eax, 0x278bd3e0
cmp eax, 7
jb 0x43ac70
mov eax, dword [esp]
mov edx, dword [0x44da9c]
test edx, edx
je 0x43ad2a
xor esi, esi
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43ad00
inc esi
cmp edx, esi
jne 0x43acf0
jmp 0x43ad2a
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ad2a
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push edi
push dword [esp + 0x18]
push 5
push edx
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10