joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e4
call fcn.0040cbc0
mov dword [esp + 0x11e4], 0x89248b28
mov dword [esp + 0x11e8], 0x85df87d3
mov dword [esp + 0x11ec], 0x812f83d3
mov dword [esp + 0x11f0], 0x9d309f2c
mov dword [esp + 0x11f4], 0x993e9b3b
mov dword [esp + 0x11f8], 0x953b9733
mov dword [esp + 0x11fc], 0x913c93cf
mov word [esp + 0x1200], 0xef90
mov dword [esp + 0x1202], 0
mov byte [esp + 0x1206], 0
mov eax, 0x5e1b86a3
nop
nop
nop
movzx edi, byte [esp + eax - 0x5e1b74bf]
mov esi, eax
and esi, edi
mov edx, esi
mov ecx, esi
mov ebx, esi
xor edi, eax
lea edi, [edi + esi*2]
and esi, 2
or edx, 0xfffffffd
inc edx
and ecx, 0xfffffffd
imul ecx, edx
or ebx, 2
imul ebx, esi
sub ecx, ebx
mov esi, 0x56
sub esi, edi
sub esi, ecx
add ecx, edi
add ecx, 0x29
and esi, 0x59
and ecx, 0xa6
sub ecx, esi
inc cl
mov byte [esp + eax - 0x5e1b74bf], cl
inc eax
cmp eax, 0x5e1b86c6
jne 0x428020
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x11e4]
push 0
push 0
push 0x20019
push eax
mov dword [esp + 0x10], ecx
push ecx
call fcn.00445850
add esp, 0x14
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x44d114]

Function at 0x429d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x848
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, 0x20219
mov ecx, 1
xor esi, esi
jmp dword [ecx*4 + 0x44d800]
Function at 0x42ac30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x5c], 0x118a1f89
mov dword [esp + 0x60], 0x15f113f7
mov dword [esp + 0x64], 0x9c8178b
mov dword [esp + 0x68], 0xd820bef
mov dword [esp + 0x6c], 0x10e0feb
mov dword [esp + 0x70], 0
mov eax, 0x17ef43c5
mov ecx, 0xd021793a
nop
nop
nop
nop
nop
nop
nop
lea esi, [ecx + 0x2fde8700]
mov edi, esi
and edi, 0x2b
mov edx, eax
and edx, 0x54
or edx, edi
movzx edi, byte [esp + eax - 0x17ef4369]
xor edx, 0x54
or edx, esi
mov ebx, ecx
or ebx, edi
and edx, edi
not ebx
or ebx, edx
add bl, 0x27
mov byte [esp + eax - 0x17ef4369], bl
inc eax
dec ecx
cmp eax, 0x17ef43dd
jne 0x42aca0
lea ebx, [esp + 0x5c]
lea ecx, [esp + 0x38]
push ebx
call fcn.0043e230
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x44d898]
Function at 0x42da20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov dword [esp + 0x14], 0x591d5b3f
mov dword [esp + 0x18], 0x5dee5fe8
mov dword [esp + 0x1c], 0x51f55318
mov dword [esp + 0x20], 0x55f157e4
mov dword [esp + 0x24], 0xa906ab2f
mov dword [esp + 0x28], 0xad1faffa
mov dword [esp + 0x2c], 0xa119a318
mov dword [esp + 0x30], 0xa501a710
mov dword [esp + 0x34], 0xb9c7bb00
mov dword [esp + 0x38], 0xbd12bfc5
mov dword [esp + 0x3c], 0xb109b309
mov dword [esp + 0x40], 0xb503b705
mov dword [esp + 0x44], 0x893b8b0b
mov dword [esp + 0x48], 0x8dfc8f3a
mov dword [esp + 0x4c], 0x81318304
mov dword [esp + 0x50], 0x8586873c
mov eax, 0xaabb7fef
nop
movzx edx, byte [esp + eax + 0x55448025]
xor edx, eax
mov ecx, edx
or ecx, 0x54
add ecx, edx
not edx
or edx, 0x54
add ecx, edx
add cl, 2
mov byte [esp + eax + 0x55448025], cl
inc eax
cmp eax, 0xaabb802f
jne 0x42dab0
lea ebx, [esp + 0x7c]
lea eax, [esp + 0x14]
mov edi, ebx
mov ecx, 0x10
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xbc]
lea eax, [esp + 0x54]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x78]
push edi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x451b40]
mov ebp, dword [esp + 0x78]
test ebp, ebp
jns 0x42db22
mov eax, 0xffffffff
jmp 0x42db29
lea eax, [ebp*2]
push eax
call fcn.0040cc60
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1f
push ebx
push 0
call dword [0x451b40]
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00445110
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44dc38]
Function at 0x431d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx eax, word [esi]
test ax, ax
je 0x431e75
mov edx, dword [esp + 0x18]
dec edx
je 0x431e75
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x431d90
mov byte [ebp], bl
lea eax, [ebp + 1]
jmp 0x431e20
cmp ebx, 0x7ff
ja 0x431dc0
cmp edx, 2
jb 0x431dc0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x431e20
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x431e3a
cmp edx, 4
jb 0x431e3a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
lea eax, [ebp + 4]
mov edi, ecx
or edi, 0x3f
xor ecx, 0xc0
and ecx, edi
add cl, 0x80
mov byte [ebp + 3], cl
mov edi, esi
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x431e75
test edx, edx
jne 0x431d70
jmp 0x431e75
movzx eax, ax
cmp eax, 0xdc00
jne 0x431e48
mov esi, edi
jmp 0x431e28
cmp edx, 3
jb 0x431e71
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x431e20
mov eax, ebp
jmp 0x431e20
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434a40
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x320
mov dword [esp + 0x304], 0x44e5f8
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x448a18
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x448a28
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x300], eax
mov eax, dword [esp + 0x304]
mov ecx, dword [esp + 0x300]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2fc], 0x44e600
mov dword [esp + 0x2f4], 0x44e608
mov dword [esp + 0x2ec], 0x44e610
mov dword [esp + 0x2e4], 0x44e618
mov dword [esp + 0x2dc], 0x44e620
mov dword [esp + 0x2d4], 0x44dd70
mov dword [esp + 0x2d0], 0xb0
mov dword [esp + 0x2cc], 0x44e628
mov dword [esp + 0x2c4], 0x44e630
mov dword [esp + 0x2bc], 0x44e638
mov dword [esp + 0x2b4], 0x44dd70
mov dword [esp + 0x2b0], 0xb7
mov dword [esp + 0x2ac], 0x44e640
mov dword [esp + 0x2a4], 0x44e648
mov dword [esp + 0x29c], 0x44dd70
mov dword [esp + 0x298], 0xb7
mov dword [esp + 0x294], 0x44e650
mov dword [esp + 0x28c], 0x44e658
mov dword [esp + 0x284], 0x44e660
mov dword [esp + 0x27c], 0x44e668
mov dword [esp + 0x274], 0x44dd70
mov dword [esp + 0x270], 0xbc
mov dword [esp + 0x26c], 0x44dd70
mov dword [esp + 0x268], 0xbd
mov dword [esp + 0x264], 0x44dd70
mov dword [esp + 0x260], 0xbe
mov dword [esp + 0x25c], 0x44dd70
mov dword [esp + 0x258], 0xbf
mov dword [esp + 0x254], 0x44dd70
mov dword [esp + 0x250], 0xc0
mov dword [esp + 0x24c], 0x44e670
mov dword [esp + 0x244], 0x44e678
mov dword [esp + 0x23c], 0x44e680
mov dword [esp + 0x234], 0x44e688
mov dword [esp + 0x22c], 0x44e690
mov dword [esp + 0x224], 0x44dd70
mov dword [esp + 0x220], 0xc6
mov dword [esp + 0x21c], 0x44e698
mov dword [esp + 0x214], 0x44e6a0
mov dword [esp + 0x20c], 0x44e6a8
mov dword [esp + 0x204], 0x44dd70
mov dword [esp + 0x200], 0xca
mov dword [esp + 0x1fc], 0x44dd70
mov dword [esp + 0x1f8], 0xcb
mov dword [esp + 0x1f4], 0x44dd70
mov dword [esp + 0x1f0], 0xcc
mov dword [esp + 0x1ec], 0x44e6b0
mov dword [esp + 0x1e4], 0x44e6b8
mov dword [esp + 0x1dc], 0x44dd70
mov dword [esp + 0x1d8], 0xcf
mov dword [esp + 0x1d4], 0x44dd70
mov dword [esp + 0x1d0], 0xd0
mov dword [esp + 0x1cc], 0x44dd70
mov dword [esp + 0x1c8], 0xd1
mov dword [esp + 0x1c4], 0x44e6c0
mov dword [esp + 0x1bc], 0x44e6c8
mov dword [esp + 0x1b4], 0x44dd70
mov dword [esp + 0x1b0], 0xd4
mov dword [esp + 0x1ac], 0x44e6d0
mov dword [esp + 0x1a4], 0x44e6d8
mov dword [esp + 0x19c], 0x44dd70
mov dword [esp + 0x198], 0xac
mov dword [esp + 0x194], 0x44dd70
mov dword [esp + 0x190], 0xb2
mov dword [esp + 0x18c], 0x44dd70
mov dword [esp + 0x188], 0xb5
mov dword [esp + 0x184], 0x44dd70
mov dword [esp + 0x180], 0xb9
mov dword [esp + 0x17c], 0x44dd70
mov dword [esp + 0x178], 0xc1
mov dword [esp + 0x174], 0x44dd70
mov dword [esp + 0x170], 0xc4
mov dword [esp + 0x16c], 0x44dd70
mov dword [esp + 0x168], 0xc7
mov dword [esp + 0x164], 0x44dd70
mov dword [esp + 0x160], 0xd2
mov dword [esp + 0x15c], 0x44dd70
mov dword [esp + 0x158], 0xd6
xor ebx, ebx
jmp eax
Function at 0x436500
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4366af
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
cmp esi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436561
jmp 0x4366a7
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00431cd0
mov edi, eax
cmp edi, 0
setne al
jmp 0x436581
jmp 0x436583
xor ebx, ebx
test al, 1
jne 0x43658e
jmp 0x43669b
mov ebx, edi
add ebx, 1
mov dword [esp], ebx
call fcn.0040cc60
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00431d40
jmp 0x4365b1
jmp 0x4365b3
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x85
mov byte [esp + 0x16], 0x7b
mov byte [esp + 0x17], 0x83
mov byte [esp + 0x18], 0x7e
mov byte [esp + 0x19], 0x8a
mov byte [esp + 0x1a], 0x7f
mov byte [esp + 0x1b], 0x8d
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x4f
mov byte [esp + 0x1e], 0x86
mov byte [esp + 0x1f], 0x83
mov byte [esp + 0x20], 0x98
mov byte [esp + 0x21], 5
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x14
jne 0x436606
xor eax, eax
jmp 0x436617
cmp eax, 0x14
jae 0x43666b
movzx edx, byte [esp + eax + 0x14]
mov ecx, 0x7b
sub ecx, eax
mov ebx, 0x7b
sub ebx, eax
or ecx, ebx
mov ebx, 0x7b
sub ebx, eax
and ecx, ebx
mov ebx, eax
add ebx, 0x53e00284
or ebx, edx
xor edx, 0xffffffff
or ecx, edx
and ebx, ecx
mov ecx, ebx
and ecx, 0x6b
mov edx, ebx
and edx, 0x6b
xor edx, 0xffffffff
add ebx, 0x6c
add ebx, edx
add ecx, ebx
add cl, 1
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x436617
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov ebp, dword [esp + 0x28]
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
call fcn.0040d650
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], ebp
call fcn.0040cc70
jmp 0x436699
jmp 0x43669b
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4366af
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00445850
add esp, 0x14
test eax, eax
js 0x43c446
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00445c70
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43c387
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43c353
mov eax, 0xffffffff
jmp 0x43c35a
lea eax, [eax*2 + 2]
push eax
call fcn.0040cc60
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00446270
add esp, 0x14
test eax, eax
js 0x43c37e
mov esi, edi
jmp 0x43c387
push edi
call fcn.0040cc70
add esp, 4
mov ebp, dword [esp]
mov dword [esp + 4], 0x101f1e1d
mov word [esp + 8], 0
mov ecx, 0xcb1c73a
mov edx, 0xf34e38c5
mov edi, 0x734e38c6
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0xcb1c73f]
mov eax, ecx
or eax, ebx
add eax, edi
add eax, eax
sub ebx, eax
add ebx, edx
mov eax, ebx
and eax, 0x26
add eax, eax
xor ebx, 0xd9
sub eax, ebx
mov byte [esp + edx + 0xcb1c73f], al
dec ecx
inc edx
inc edi
cmp ecx, 0xcb1c734
jne 0x43c3b0
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x43c42a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43c410
inc edi
cmp ecx, edi
jne 0x43c400
jmp 0x43c42a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43c42a
push ebp
push 1
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x10
test esi, esi
jne 0x43c448
lea eax, [esp + 4]
push eax
call fcn.00444f10
add esp, 4
test al, al
je 0x43c446
cmp dword [esp + 4], 1
je 0x43c448
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
xor edx, 0xcb1c73a
mov ecx, eax
or ecx, 5
and ecx, edx
mov edx, eax
and edx, 5
mov esi, ecx
and esi, 2
or ecx, 2
imul ecx, esi
xor esi, 2
imul esi, edx
mov edx, eax
xor edx, 0xc5
add edx, ecx
add edx, esi
xor dl, byte [esp + eax]
add dl, 0x27
mov byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x43e260
mov edi, dword [esp]
mov eax, dword [0x451b44]
test eax, eax
je 0x43e2f6
xor ecx, ecx
mov edx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43e2d0
inc ecx
cmp eax, ecx
jne 0x43e2c0
jmp 0x43e2f6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e2f6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x451b4c]
call fcn.00441940
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x914e4f48
mov dword [esp + 4], 0
mov eax, 0xc5b0006d
mov ecx, 0x92
nop
movzx edx, byte [esp + eax + 0x3a4fff93]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
add esi, 0xde78813a
mov edx, esi
and edx, 0x25
xor esi, 0xa5
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x3a4fff93], dl
inc eax
dec ecx
cmp eax, 0xc5b00075
jne 0x43e310
cmp edi, dword [esp]
jne 0x43e475
mov dword [esp + 0xc], ebp
push dword [esp + 8]
call fcn.0043e0d0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, esi
xor edx, 0xcb1c73a
mov edi, esi
or edi, 5
and edi, edx
mov edx, esi
and edx, 5
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, edx
mov edx, esi
xor edx, 0xc5
add edx, edi
add edx, ebp
xor dl, byte [esp + esi]
add dl, 0x27
mov byte [esp + esi], dl
inc esi
cmp esi, 6
jne 0x43e380
mov edi, dword [esp]
mov edx, dword [0x451b44]
test edx, edx
je 0x43e415
xor ebp, ebp
mov esi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43e3f0
inc ebp
cmp edx, ebp
jne 0x43e3e0
jmp 0x43e415
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43e415
push 0
push ecx
push eax
push 5
push 4
push edx
push dword [0x451b4c]
mov esi, eax
call fcn.00441940
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e46c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43e445
add edi, 2
cmp si, bp
je 0x43e430
cmp si, bp
je 0x43e457
mov esi, dword [ecx]
test esi, esi
jne 0x43e420
mov edi, 0xc0000225
jmp 0x43e46c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e170
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43e4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43e5a0
xor eax, eax
cmp dword [ecx], 0
jne 0x43e5da
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
mov edi, eax
xor edi, 0xcb1c73a
mov esi, eax
or esi, 5
and esi, edi
mov edi, eax
and edi, 5
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
mov ebp, ebx
xor ebp, 2
imul ebp, edi
mov ebx, eax
xor ebx, 0xc5
add ebx, esi
add ebx, ebp
xor bl, byte [esp + eax]
add bl, 0x27
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x43e530
mov eax, dword [esp]
mov esi, dword [0x451b44]
test esi, esi
je 0x43e5da
xor edi, edi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43e5e4
inc edi
cmp esi, edi
jne 0x43e590
jmp 0x43e5da
mov dword [esp + 8], 0xe3222138
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x88
xor cl, byte [esp + eax + 8]
add cl, 0x58
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne 0x43e5c0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e5da
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x451b4c]
call fcn.00441940
add esp, 0x1c
jmp 0x43e5da

Function at 0x43e620
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43e6eb
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
xor edi, 0xcb1c73a
mov esi, edx
or esi, 5
and esi, edi
mov edi, edx
and edi, 5
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
mov ebp, ebx
xor ebp, 2
imul ebp, edi
mov ebx, edx
xor ebx, 0xc5
add ebx, esi
add ebx, ebp
xor bl, byte [esp + edx]
add bl, 0x27
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x43e650
mov edx, dword [0x451b44]
test edx, edx
je 0x43e6de
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43e6c0
inc edi
cmp edx, edi
jne 0x43e6b0
jmp 0x43e6de
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43e6de
push eax
push 1
push edx
push dword [0x451b4c]
mov esi, ecx
call fcn.00441940
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43e7a0
mov eax, dword [ecx]
test eax, eax
je 0x43e7a0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x101f1e1d
mov word [esp + 8], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edi
xor esi, 0xcb1c73a
mov eax, edi
or eax, 5
and eax, esi
mov esi, edi
and esi, 5
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
xor edx, 2
imul edx, esi
mov ebx, edi
xor ebx, 0xc5
add ebx, eax
add ebx, edx
xor bl, byte [esp + edi + 4]
add bl, 0x27
mov byte [esp + edi + 4], bl
inc edi
cmp edi, 6
jne 0x43e730
mov eax, dword [esp + 4]
mov ebx, dword [0x451b44]
test ebx, ebx
je 0x43e819
xor edi, edi
mov esi, dword [0x451b48]
nop
nop
nop
nop
cmp dword [esi + edi*8], 0x2dedf0b8
je 0x43e7f5
inc edi
cmp ebx, edi
jne 0x43e790
jmp 0x43e819
mov dword [esp + 4], 0x94a4b74
mov byte [esp + 8], 0
mov eax, 0x93
mov ecx, 0x6c
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x43
mov edx, eax
and edx, 0x8c
or edx, esi
xor dl, byte [esp + eax - 0x8f]
xor dl, 0x53
add dl, 0x21
mov byte [esp + eax - 0x8f], dl
inc eax
dec ecx
cmp eax, 0x98
jne 0x43e7c0
mov eax, dword [esp + 4]
jmp 0x43e915
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43e819
push dword [ebp + 8]
push dword [esp + 0x10]
push 2
push esi
push dword [0x451b4c]
mov esi, ecx
call fcn.00441940
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43e908
cmp eax, 0xc000010a
jne 0x43e908
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x101f1e1d
mov word [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edi, eax
xor edi, 0xcb1c73a
mov esi, eax
or esi, 5
and esi, edi
mov edi, eax
and edi, 5
mov edx, esi
and edx, 2
or esi, 2
imul esi, edx
xor edx, 2
imul edx, edi
mov ebx, eax
xor ebx, 0xc5
add ebx, esi
add ebx, edx
xor bl, byte [esp + eax + 4]
add bl, 0x27
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 6
jne 0x43e870
mov eax, dword [esp + 4]
mov esi, dword [0x451b44]
test esi, esi
je 0x43e908
xor edi, edi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4e66b5a3
je 0x43e8e0
inc edi
cmp esi, edi
jne 0x43e8d0
jmp 0x43e908
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e908
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 3
push esi
push dword [0x451b4c]
mov esi, ecx
call fcn.00441940
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43e915
mov esi, eax
call fcn.0043e620
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43e920
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e9b0
push 0xbbf966b4
push dword [0x451b38]
call fcn.00444600
add esp, 8
test eax, eax
je 0x43e975
mov ecx, dword [esi]
test ecx, ecx
je 0x43e9ad
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43e989
cmp dword [esp], 0
je 0x43e989
mov dword [esi + 4], 3
jmp 0x43e9ad
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43ea57
lea eax, [esp + 0xc]
push eax
call fcn.00444f10
add esp, 4
test al, al
je 0x43e9ad
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e9aa
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43ea57
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
xor esi, 0xcb1c73a
mov edx, eax
or edx, 5
and edx, esi
mov esi, eax
and esi, 5
mov ebp, edx
and ebp, 2
or edx, 2
imul edx, ebp
xor ebp, 2
imul ebp, esi
mov ebx, eax
xor ebx, 0xc5
add ebx, edx
add ebx, ebp
xor bl, byte [esp + eax]
add bl, 0x27
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x43e9e0
mov eax, dword [esp]
mov edx, dword [0x451b44]
test edx, edx
je 0x43eb07
xor esi, esi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43eae0
inc esi
cmp edx, esi
jne 0x43ea40
jmp 0x43eb07
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
xor esi, 0xcb1c73a
mov edx, eax
or edx, 5
and edx, esi
mov esi, eax
and esi, 5
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
mov ebp, ebx
xor ebp, 2
imul ebp, esi
mov ebx, eax
xor ebx, 0xc5
add ebx, edx
add ebx, ebp
xor bl, byte [esp + eax]
add bl, 0x27
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x43ea70
mov eax, dword [esp]
mov edx, dword [0x451b44]
test edx, edx
je 0x43eb07
xor esi, esi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43eae0
inc esi
cmp edx, esi
jne 0x43ead0
jmp 0x43eb07
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43eb07
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push edi
push dword [esp + 0x18]
push 5
push edx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10