joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043d5b0
add esp, 0x14
test eax, eax
js 0x434456
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043d9e0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x4343aa
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x434378
mov eax, 0xffffffff
jmp 0x43437f
lea eax, [eax*2 + 2]
push eax
call fcn.00408210
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043e060
add esp, 0x14
test eax, eax
jns 0x4343aa
push esi
call fcn.00408220
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
nop
nop
nop
nop
movzx edx, byte [esp + edi + 4]
lea ebx, [edi + 4]
mov ecx, 0xfb
sub ecx, edi
xor ecx, ebx
and ecx, edx
xor ecx, ebx
add cl, 0xec
mov byte [esp + edi + 4], cl
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, 6
jb 0x4343c0
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43443a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x434420
inc edi
cmp ecx, edi
jne 0x434410
jmp 0x43443a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43443a
push eax
push 4
push ecx
push dword [0x44a898]
call fcn.00439540
add esp, 0x10
test esi, esi
jne 0x434458
lea eax, [esp + 4]
push eax
call fcn.0043cc10
add esp, 4
test al, al
je 0x434456
cmp dword [esp + 4], 1
je 0x434458
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436070
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0x595a5b74
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx - 0x3a4550f1]
xor edx, esi
lea esi, [edx + edx]
mov edi, esi
and edi, 0x68
xor edx, 0xb4
add edx, edi
and esi, 2
xor edx, 1
add edx, esi
mov byte [esp + ecx], dl
add ecx, 0x79
and ecx, 0x87
cmp ecx, 6
jb 0x436090
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov edx, dword [0x446b7c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx

Function at 0x436100
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446b94]
Function at 0x4361c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x14151617
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 4
xor cl, byte [esp + eax]
add cl, 0xec
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x4361f0
mov edi, dword [esp]
mov eax, dword [0x44a890]
test eax, eax
je 0x436256
xor ecx, ecx
mov edx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436230
inc ecx
cmp eax, ecx
jne 0x436220
jmp 0x436256
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436256
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44a898]
call fcn.00439540
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x57161924
mov eax, 0xc547067d
mov ecx, 0x8a8e0cfa
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x8c
mov edx, eax
xor edx, 0x46
add edx, esi
add dl, 0x83
xor dl, byte [esp + eax + 0x3ab8f983]
add dl, 0xa2
mov byte [esp + eax + 0x3ab8f983], dl
inc eax
add ecx, 2
cmp eax, 0xc5470681
jne 0x436270
cmp edi, dword [esp]
jne 0x4363a5
push dword [esp + 0xc]
call fcn.00436070
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x14151617
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 4
xor cl, byte [esp + edx]
add cl, 0xec
mov byte [esp + edx], cl
inc edx
cmp edx, 6
jne 0x4362d0
mov edi, dword [esp]
mov edx, dword [0x44a890]
test edx, edx
je 0x43633c
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44a894]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x436312
inc ebp
cmp edx, ebp
jne 0x436300
mov ebp, ecx
jmp 0x43633c
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43633c
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x44a898]
mov esi, eax
call fcn.00439540
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43639c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x436375
add edi, 2
cmp si, bp
je 0x436360
cmp si, bp
je 0x436387
mov esi, dword [ecx]
test esi, esi
jne 0x436350
mov edi, 0xc0000225
jmp 0x43639c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00436100
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4363e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x436490
xor eax, eax
cmp dword [ecx], 0
jne 0x4364e4
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x14151617
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 4
xor bl, byte [esp + eax]
add bl, 0xec
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x436450
mov eax, dword [esp]
mov esi, dword [0x44a890]
test esi, esi
je 0x4364e4
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x4364ed
inc edi
cmp esi, edi
jne 0x436480
jmp 0x4364e4
mov dword [esp + 8], 0x73323138
mov dword [esp + 0xc], 0
lea eax, [esp + 8]
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0xfffffff8
add edi, edx
movzx esi, byte [eax]
xor esi, edi
mov edi, esi
not edi
xor esi, 0xf4
add esi, 0x3b
and edi, 1
or esi, 1
xor esi, edi
lea ebx, [esi + edi*2]
mov byte [eax], bl
inc edx
inc eax
add ecx, 2
cmp ecx, 0x10
jne 0x4364b0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4364e4
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44a898]
call fcn.00439540
add esp, 0x1c
jmp 0x4364e4

Function at 0x436520
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4365aa
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x14151617
mov word [esp + 4], 0
xor edx, edx
mov ebx, edx
add bl, 4
xor bl, byte [esp + edx]
add bl, 0xec
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x436540
mov edx, dword [0x44a890]
test edx, edx
je 0x43659e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436580
inc edi
cmp edx, edi
jne 0x436570
jmp 0x43659e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43659e
push eax
push 4
push edx
push dword [0x44a898]
mov esi, ecx
call fcn.00439540
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x4365b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x436623
mov edx, dword [ecx]
test edx, edx
je 0x436623
mov edi, dword [ebp + 0x10]
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
mov ebx, eax
add bl, 4
xor bl, byte [esp + eax + 4]
add bl, 0xec
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 6
jne 0x4365e0
mov eax, dword [esp + 4]
mov ebx, dword [0x44a890]
test ebx, ebx
je 0x436684
xor edi, edi
mov esi, dword [0x44a894]
cmp dword [esi + edi*8], 0x2dedf0b8
je 0x436660
inc edi
cmp ebx, edi
jne 0x436610
mov edi, dword [ebp + 0x10]
jmp 0x436684
mov dword [esp + 4], 0xf7363920
xor eax, eax
nop
nop
nop
mov edx, eax
xor edx, 0xca
lea ecx, [eax + eax]
and ecx, 2
mov ebx, ecx
sub ebx, edx
xor bl, byte [esp + eax + 4]
add bl, 0xf2
mov byte [esp + eax + 4], bl
xor eax, 1
add eax, ecx
cmp eax, 4
jb 0x436630
mov eax, dword [esp + 4]
jmp 0x4367cb
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x436684
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x44a898]
mov esi, ecx
call fcn.00439540
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x436735
cmp eax, 0xc000010a
jne 0x436735
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
xor eax, eax
nop
nop
mov ebx, eax
add bl, 4
xor bl, byte [esp + eax + 4]
add bl, 0xec
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 6
jne 0x4366d0
mov eax, dword [esp + 4]
mov esi, dword [0x44a890]
test esi, esi
je 0x436735
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4e66b5a3
je 0x436710
inc edi
cmp esi, edi
jne 0x436700
jmp 0x436735
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436735
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 0xc
push esi
push dword [0x44a898]
mov esi, ecx
call fcn.00439540
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x4367cb
mov edx, dword [ecx]
test edx, edx
je 0x4367cb
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
xor ebx, ebx
nop
nop
nop
nop
mov edx, ebx
add dl, 4
xor dl, byte [esp + ebx + 4]
add dl, 0xec
mov byte [esp + ebx + 4], dl
inc ebx
cmp ebx, 6
jne 0x436760
mov esi, dword [0x44a890]
test esi, esi
je 0x4367c5
mov edx, dword [esp + 4]
xor ebx, ebx
mov edi, dword [0x44a894]
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0xb62b8d10
je 0x4367a0
inc ebx
cmp esi, ebx
jne 0x436790
jmp 0x4367c5
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x4367c5
push dword [esp + 0xc]
push 4
push esi
push dword [0x44a898]
mov esi, ecx
mov edi, eax
call fcn.00439540
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x436ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x436ad9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x436aea
cmp eax, 2
je 0x436b60
jmp 0x436b8a
push 0xbbf966b4
push dword [0x44a884]
call fcn.0043c420
add esp, 8
test eax, eax
je 0x436b2b
mov ecx, dword [esi]
test ecx, ecx
je 0x436b58
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x436b34
cmp dword [esp + 4], 0
je 0x436b34
mov dword [esi + 4], 3
jmp 0x436b58
mov dword [esi + 4], 1
jmp 0x436b8a
lea eax, [esp + 0xc]
push eax
call fcn.0043cc10
add esp, 4
test al, al
je 0x436b58
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x436b55
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x436b8a
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x4528ac]
call fcn.0043c420
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x436c04
mov ecx, dword [esi]
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
xor eax, eax
nop
nop
nop
mov edx, eax
add dl, 4
xor dl, byte [esp + eax + 4]
add dl, 0xec
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 6
jne 0x436ba0
mov eax, dword [esp + 4]
mov edx, dword [0x44a890]
test edx, edx
je 0x436c04
xor esi, esi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x436be0
inc esi
cmp edx, esi
jne 0x436bd0
jmp 0x436c04
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x436c04
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 0x14
push edx
push dword [0x44a898]
call fcn.00439540
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x439450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x4472d8]

Function at 0x43a260
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp + 8], 0x1716ffed
mov ecx, 0x1cb2c346
mov edx, 0xb9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1cb2c33e]
mov edi, ecx
or edi, esi
not esi
or esi, edx
and esi, edi
mov ebx, esi
and ebx, 0x21
add ebx, ebx
xor esi, 0x5e
sub ebx, esi
mov byte [esp + ecx - 0x1cb2c33e], bl
inc ecx
dec edx
cmp ecx, 0x1cb2c34a
jne 0x43a290
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x447784]
mov ecx, 0xfca53413
xor ecx, dword [0x44778c]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x43ac00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43ac72
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43ad8e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43ad8e
mov dword [esp], 0xf8fbfafd
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xab
xor cl, byte [esp + eax]
add cl, 0xa9
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43ac80
mov eax, dword [esp]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43acf2
xor edx, edx
mov edi, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43acc4
inc edx
cmp ecx, edx
jne 0x43acb0
mov edi, dword [esp + 0x24]
jmp 0x43acf2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x43acf2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x44a898]
call fcn.00439540
add esp, 0x28
test eax, eax
js 0x43ad8e
push 0x732f71fd
push dword [0x4528ac]
call fcn.0043c420
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0xf8fbfafd
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xab
xor bl, byte [esp + edx + 4]
add bl, 0xa9
mov byte [esp + edx + 4], bl
inc edx
cmp edx, 4
jne 0x43ad30
mov edx, dword [0x44a890]
test edx, edx
je 0x43ad8e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43ad70
inc edi
cmp edx, edi
jne 0x43ad60
jmp 0x43ad8e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ad8e
push ecx
push 4
push edx
push dword [0x44a898]
mov esi, eax
call fcn.00439540
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], 0x818687f4
mov eax, 0x9b57e8a1
mov edx, 0x5e
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x64a81763]
mov esi, edx
xor esi, eax
and esi, ecx
xor esi, eax
mov ecx, esi
and ecx, 0x934060d8
mov edi, esi
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, ecx
or ecx, 2
imul ecx, edi
add ecx, ebx
mov edi, esi
xor edi, 0xf74874da
mov ebx, ecx
and ebx, edi
xor edi, ecx
lea ecx, [edi + ebx*2]
and esi, 1
xor ecx, 1
lea ecx, [ecx + esi*2]
mov byte [esp + eax + 0x64a81763], cl
inc eax
dec edx
cmp eax, 0x9b57e8a5
jne 0x43c2e0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x1c], 0
sete cl
jmp dword [ecx*4 + 0x447fb0]

Function at 0x43c420
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0x393a9d8f
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
lea esi, [ecx - 0x3095b0b5]
xor esi, edx
mov edx, esi
xor edx, 0x77
or esi, 0x88
and edx, esi
add edx, esi
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb case.default.0x43c47a
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448020]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + ecx]
mov dword [esp], 0x23226450
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xb8
xor bl, byte [esp + edx]
add bl, 0x68
mov byte [esp + edx], bl
inc edx
cmp edx, 4
jne case.default.0x43c4be
xor edx, edx
cmp eax, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x448028]
mov edx, dword [esp + 0x40]
mov esi, dword [edx + ecx + 0x78]
mov ecx, dword [edx + ecx + 0x7c]
mov dword [esp + 0x20], ecx
test ecx, ecx
sete cl
test esi, esi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x448030]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + esi + 0x20]
add ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + esi + 0x24]
add ecx, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + esi + 0x1c]
add ecx, eax
mov dword [esp + 0x14], ecx
mov eax, dword [eax + esi + 0x18]
xor edi, edi
xor edx, edx
mov dword [esp + 0x24], eax
cmp edi, eax
setb dl
mov ecx, 1
mov dword [esp + 0x1c], esi
jmp dword [edx*4 + 0x448048]
jmp dword [0x448044]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cc60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cc70
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43cc8b
mov eax, 0xffffffff
jmp 0x43cc8e
add eax, 0xa
push eax
call fcn.00408210
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43ccd1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43ccc0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x504f4e4d
mov ecx, esp
mov edx, 0x9618f2
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
mov edi, edx
and edi, 0x8210d7
lea ebx, [edx - 0x5a000000]
and ebx, 0xa6140828
or ebx, edi
mov edi, esi
xor edi, 0xd7
mov ebp, ebx
xor ebp, 0x28
or ebp, edi
xor esi, 8
xor ebx, 0xd7
or ebx, esi
and ebx, ebp
add bl, 0xbf
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x9618ee
jne 0x43cd50
mov esi, dword [esp]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43ce05
xor edx, edx
mov edi, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43cdc0
inc edx
cmp ecx, edx
jne 0x43cdb0
jmp 0x43ce05
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43ce05
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44a898]
mov edi, eax
call fcn.00439540
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408220
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ce20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ce30
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43ce4b
mov eax, 0xffffffff
jmp 0x43ce4e
add eax, 0xa
push eax
call fcn.00408210
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43ce91
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43ce80
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x504f4e4d
mov ecx, esp
mov edx, 0x9618f2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
mov ebp, edx
and ebp, 0x8210d7
lea ebx, [edx - 0x5a000000]
and ebx, 0xa6140828
or ebx, ebp
mov ebp, esi
xor ebp, 0xd7
mov edi, ebx
xor edi, 0x28
or edi, ebp
xor esi, 8
xor ebx, 0xd7
or ebx, esi
and ebx, edi
add bl, 0xbf
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x9618ee
jne 0x43cf10
mov esi, dword [esp]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43cfb7
xor edx, edx
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43cf80
inc edx
cmp ecx, edx
jne 0x43cf70
jmp 0x43cfb7
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43cfb7
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44a898]
mov edi, eax
call fcn.00439540
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408220
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret