joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424870
cmp eax, 0xffffffed
jge 0x424887
mov eax, 0xffffffff
jmp 0x42488a
add eax, 0x12
push eax
call fcn.0040c8b0
add esp, 4
mov esi, eax
mov dword [esp], 0x2399218c
mov dword [esp + 4], 0x27af2581
mov dword [esp + 8], 0x3bc439cc
mov dword [esp + 0xc], 0x3f9c3d98
mov dword [esp + 0x10], 0x3130
mov eax, 0x605d86df
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x605d86df]
lea edx, [eax - 0x605d8697]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x605d86df], cl
inc eax
cmp eax, 0x605d86f3
jne 0x4248d0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424921
add edi, 2
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424910
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424951
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424940
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00443f40
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44b9a8]

Function at 0x424990
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
movzx eax, byte [esp + 0x5c]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44bab0]
Function at 0x4279a0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x23632145
mov dword [esp + 8], 0x27962594
mov dword [esp + 0xc], 0x3b9b397c
mov dword [esp + 0x10], 0x3f9f3d88
mov dword [esp + 0x14], 0x339e3155
mov dword [esp + 0x18], 0x378e3560
mov dword [esp + 0x1c], 0xbb409bd
mov dword [esp + 0x20], 0xfab0da8
mov dword [esp + 0x24], 0x3a001b2
mov dword [esp + 0x28], 0x7b405bd
mov dword [esp + 0x2c], 0x1bb619bc
mov dword [esp + 0x30], 0x1fac1d4c
mov dword [esp + 0x34], 0x13b411af
mov dword [esp + 0x38], 0x17aa15ad
mov dword [esp + 0x3c], 0x6bd969cd
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x6d6c
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov ecx, 0x88
mov edx, 0xec70b877
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x84]
mov ebx, ecx
xor ebx, edx
and ebx, esi
xor ebx, edx
mov esi, ebx
not esi
mov edi, esi
and edi, 0x57
xor ebx, 0xa8
add ebx, esi
and esi, 0xa8
sub ebx, esi
add ebx, edi
inc bl
mov byte [esp + ecx - 0x84], bl
inc ecx
dec edx
cmp ecx, 0xcc
jne 0x427a50
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x4504d4]
mov ebp, dword [esp]
test ebp, ebp
jns 0x427ad4
mov eax, 0xffffffff
jmp 0x427adb
lea eax, [ebp*2]
push eax
call fcn.0040c8b0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x4504d4]
mov dword [esp + 4], 0x3ea01d4
mov dword [esp + 8], 0x7e805f1
mov dword [esp + 0xc], 0xbef09ec
mov dword [esp + 0x10], 0xfec0dfe
mov dword [esp + 0x14], 0x13e011f9
mov dword [esp + 0x18], 0x171615f0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x40
xor cl, byte [esp + eax + 4]
add cl, 0xc0
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x18
jne 0x427b30
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.00422c40
add esp, 0x14
mov ecx, dword [0x44c164]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x429d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
mov dword [esp], 0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
xor ebp, ebp
jmp dword [ecx*4 + 0x44c75c]
Function at 0x42aa40
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042aa60
add esp, 4
test al, al
je 0x42b100
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xd8
mov dword [esp + 0x98], 0x813087cf
mov dword [esp + 0x9c], 0x8d3e833d
mov dword [esp + 0xa0], 0x893a8f2f
mov dword [esp + 0xa4], 0x95da8b3c
mov dword [esp + 0xa8], 0x912a9737
mov dword [esp + 0xac], 0x9d929338
mov word [esp + 0xb0], 0
mov eax, 0xa1
mov ecx, 0x1e
mov esi, ecx
and esi, 0x1b
mov edx, eax
and edx, 0xe4
or edx, esi
xor dl, byte [esp + eax - 9]
xor dl, 0x1b
add dl, 0xdb
mov byte [esp + eax - 9], dl
inc eax
dec ecx
cmp eax, 0xbb
jne 0x42b160
mov dword [esp + 0x20], 0x8fd88924
mov dword [esp + 0x24], 0x83d98dc9
mov dword [esp + 0x28], 0x87d181d9
mov dword [esp + 0x2c], 0x9bcc85d0
mov dword [esp + 0x30], 0x9f329931
mov dword [esp + 0x34], 0x93d39dc1
mov dword [esp + 0x38], 0x97ce91d7
mov dword [esp + 0x3c], 0xebb895cd
mov dword [esp + 0x40], 0xef42e9ad
mov dword [esp + 0x44], 0xe3b1edbb
mov dword [esp + 0x48], 0xe7b2e1ba
mov dword [esp + 0x4c], 0xfbbbe54f
mov dword [esp + 0x50], 0xffbbf9ae
mov dword [esp + 0x54], 0xf358fd50
mov dword [esp + 0x58], 0xf74af151
mov dword [esp + 0x5c], 0xcb6ff57e
mov dword [esp + 0x60], 0xcf99c964
mov dword [esp + 0x64], 0xc367cd78
mov dword [esp + 0x68], 0xc77bc161
mov dword [esp + 0x6c], 0xc5c4
mov eax, 0x36fb1522
mov ecx, 0x4904eadd
movzx edx, byte [esp + eax - 0x36fb1502]
mov esi, eax
xor esi, edx
or esi, ecx
not esi
add esi, esi
lea edi, [ecx - 0x80000000]
and edi, esi
not esi
and esi, eax
not edi
add edi, edx
mov ebx, 0xfffffffe
sub ebx, edi
sub ebx, esi
add edi, esi
inc edi
mov esi, edi
and esi, 0x55
mov edx, ebx
not edx
and ebx, 0x3e
and edi, 0xc1
or edi, ebx
xor edi, 0x6b
and edx, 0x55
or edx, edi
add edx, esi
inc dl
mov byte [esp + eax - 0x36fb1502], dl
inc eax
dec ecx
cmp eax, 0x36fb1572
jne 0x42b230
lea eax, [esp + 0x98]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0043b170
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x44c86c]

Function at 0x42aa60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x23962193
mov dword [esp + 0x58], 0x27872581
mov dword [esp + 0x5c], 0x3bc43985
mov dword [esp + 0x60], 0x3fb63d99
mov dword [esp + 0x64], 0x33323195
mov eax, 0xe7e89e48
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1817620c]
xor ecx, eax
add ecx, 0x7874e897
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x1817620c], cl
inc eax
cmp eax, 0xe7e89e5c
jne 0x42aac0
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043dce0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44c7e4]
Function at 0x42d360
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov dword [esp + 0x20], 0x89558b77
mov dword [esp + 0x24], 0x85368738
mov dword [esp + 0x28], 0x813d8358
mov dword [esp + 0x2c], 0x9d219f0c
mov dword [esp + 0x30], 0x993e9b67
mov dword [esp + 0x34], 0x9527974a
mov dword [esp + 0x38], 0x91299318
mov dword [esp + 0x3c], 0x6dd16f20
mov dword [esp + 0x40], 0x699f6bd0
mov dword [esp + 0x44], 0x65c2679d
mov dword [esp + 0x48], 0x61d963e9
mov dword [esp + 0x4c], 0x7df37fed
mov dword [esp + 0x50], 0x79cb7bcb
mov dword [esp + 0x54], 0x758477ca
mov dword [esp + 0x58], 0x71c173fc
mov dword [esp + 0x5c], 0x4d4e4fc4
xor eax, eax
xor ecx, ecx
nop
nop
movzx edx, byte [esp + ecx + 0x20]
mov esi, ecx
xor esi, 0x1fc6521d
mov edi, eax
and edi, 0x44
sub edi, esi
xor edi, edx
add edi, 0x5689250b
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
add dl, 0x85
mov byte [esp + ecx + 0x20], dl
inc ecx
add eax, 2
cmp ecx, 0x40
jne 0x42d3f0
lea ebx, [esp + 0x80]
lea eax, [esp + 0x20]
mov edi, ebx
mov ecx, 0x10
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xc0]
lea eax, [esp + 0x60]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x7c]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x4504d4]
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x42d472
mov eax, 0xffffffff
jmp 0x42d475
lea eax, [edi + edi]
push eax
call fcn.0040c8b0
add esp, 4
push esi
push edi
push eax
push 0x1f
push ebx
mov ebx, eax
push 0
call dword [0x4504d4]
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00443da0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cab4]
Function at 0x433950
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2b0
mov dword [esp + 0x284], 0x44d44c
mov dword [esp + 0x98], 0
lea eax, [esp + 0x98]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x447a18
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x447a28
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x280], eax
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x280]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x27c], 0x44d454
mov dword [esp + 0x274], 0x44d45c
mov dword [esp + 0x26c], 0x44d464
mov dword [esp + 0x264], 0x44cbf0
mov dword [esp + 0x260], 0xa8
mov dword [esp + 0x25c], 0x44d46c
mov dword [esp + 0x254], 0x44d474
mov dword [esp + 0x24c], 0x44d47c
mov dword [esp + 0x244], 0x44d484
mov dword [esp + 0x23c], 0x44d48c
mov dword [esp + 0x234], 0x44cbf0
mov dword [esp + 0x230], 0xaf
mov dword [esp + 0x22c], 0x44cbf0
mov dword [esp + 0x228], 0xaf
mov dword [esp + 0x224], 0x44d494
mov dword [esp + 0x21c], 0x44d49c
mov dword [esp + 0x214], 0x44d4a4
mov dword [esp + 0x20c], 0x44d4ac
mov dword [esp + 0x204], 0x44cbf0
mov dword [esp + 0x200], 0xb4
mov dword [esp + 0x1fc], 0x44d4b4
mov dword [esp + 0x1f4], 0x44cbf0
mov dword [esp + 0x1f0], 0xb6
mov dword [esp + 0x1ec], 0x44d4bc
mov dword [esp + 0x1e4], 0x44d4c4
mov dword [esp + 0x1dc], 0x44cbf0
mov dword [esp + 0x1d8], 0xb9
mov dword [esp + 0x1d4], 0x44cbf0
mov dword [esp + 0x1d0], 0xba
mov dword [esp + 0x1cc], 0x44d4cc
mov dword [esp + 0x1c4], 0x44cbf0
mov dword [esp + 0x1c0], 0xbc
mov dword [esp + 0x1bc], 0x44cbf0
mov dword [esp + 0x1b8], 0xbd
mov dword [esp + 0x1b4], 0x44cbf0
mov dword [esp + 0x1b0], 0xbe
mov dword [esp + 0x1ac], 0x44d4d4
mov dword [esp + 0x1a4], 0x44cbf0
mov dword [esp + 0x1a0], 0xc0
mov dword [esp + 0x19c], 0x44d4dc
mov dword [esp + 0x194], 0x44d4e4
mov dword [esp + 0x18c], 0x44cbf0
mov dword [esp + 0x188], 0xc3
mov dword [esp + 0x184], 0x44d4ec
mov dword [esp + 0x17c], 0x44d4f4
mov dword [esp + 0x174], 0x44cbf0
mov dword [esp + 0x170], 0xc6
mov dword [esp + 0x16c], 0x44cbf0
mov dword [esp + 0x168], 0xc7
mov dword [esp + 0x164], 0x44cbf0
mov dword [esp + 0x160], 0xa9
mov dword [esp + 0x15c], 0x44cbf0
mov dword [esp + 0x158], 0xac
mov dword [esp + 0x154], 0x44cbf0
mov dword [esp + 0x150], 0xb2
mov dword [esp + 0x14c], 0x44cbf0
mov dword [esp + 0x148], 0xb7
mov dword [esp + 0x144], 0x44cbf0
mov dword [esp + 0x140], 0xc1
mov dword [esp + 0x13c], 0x44cbf0
mov dword [esp + 0x138], 0xc4
xor edi, edi
jmp eax
Function at 0x435210
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
setne al
jmp 0x435231
xor ebx, ebx
test al, 1
jne 0x43523c
jmp 0x4353a4
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435279
jmp 0x43539e
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00430d90
mov esi, eax
cmp esi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4352a2
jmp 0x435392
mov ebx, esi
add ebx, 1
mov dword [esp], ebx
call fcn.0040c8b0
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.0042a570
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x71
mov byte [esp + 0x15], 0x5f
mov byte [esp + 0x16], 0x5d
mov byte [esp + 0x17], 0x59
mov byte [esp + 0x18], 0x56
mov byte [esp + 0x19], 0x56
mov byte [esp + 0x1a], 0x59
mov byte [esp + 0x1b], 0x4b
mov byte [esp + 0x1c], 0x58
mov byte [esp + 0x1d], 0x11
mov byte [esp + 0x1e], 0x4e
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x4c
mov byte [esp + 0x21], 0xbf
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x12
jne 0x435316
xor eax, eax
cmp eax, 0x12
jae 0x435362
mov dl, byte [esp + eax + 0x14]
mov ecx, 0x4c
sub ecx, eax
and ecx, 0x4d
mov ebx, eax
add ebx, 0xb4
mov ebp, 0x4c
sub ebp, eax
or ebp, 0xb2
add ebp, ebx
or ecx, ebp
xor cl, dl
xor cl, 0xcd
add cl, 1
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x435325
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov ebp, dword [esp + 0x28]
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
call fcn.0040d480
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], ebp
call fcn.0040c8c0
jmp 0x435390
jmp 0x435392
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43a1f0
mov dword [esp], 0xc2c6c479
mov esi, esp
mov edi, 0x10afdc2e
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi]
mov ebx, edi
or ebx, ecx
lea ebp, [edi - 0x10afdc00]
and ebp, ecx
not ebx
or ebx, ebp
mov ecx, ebx
and ecx, 0x6a
mov ebp, ebx
xor ebp, 0xea
lea ecx, [ecx*2]
add ecx, ebp
and ebx, 1
or ecx, 1
add ecx, ebx
mov byte [esi], cl
inc esi
dec edi
cmp edi, 0x10afdc2a
jne 0x43a210
test edx, edx
je 0x43a2ce
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43a288
mov ebp, eax
mov ecx, dword [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x43a270
cmp edi, 3
jae 0x43a291
jmp 0x43a2ce
mov ecx, dword [esp + 0x18]
cmp edi, 3
jb 0x43a2ce
mov ebx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edi*2]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [ebx + edi*2 + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 6]
xor eax, ecx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43a2a0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00444500
add esp, 0x14
test eax, eax
js 0x43b2dd
lea edi, [esp + 8]
lea eax, [esp + 0xc]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00444920
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43b20d
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x43b1d7
mov eax, 0xffffffff
jmp 0x43b1de
lea eax, [eax*2 + 2]
push eax
call fcn.0040c8b0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x14]
call fcn.00444f90
add esp, 0x14
test eax, eax
js 0x43b202
mov eax, esi
jmp 0x43b20d
push esi
call fcn.0040c8c0
add esp, 4
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [esp], 0x34353a3b
mov edx, 0x59a22fb6
mov esi, 0x265dd049
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x59a22fb6]
mov ebp, esi
and ebp, 2
mov edi, edx
and edi, 0x5000090d
or edi, ebp
xor edi, ebx
mov ebx, edi
xor ebx, 0x89a226b2
mov ebp, ebx
and ebp, 0x99800171
xor edi, 0x367737c3
add edi, ebx
and ebx, 0x40222e8e
sub edi, ebx
add edi, ebp
mov ebx, edi
and ebx, 1
xor edi, 1
lea ebx, [edi + ebx*2]
mov byte [esp + edx - 0x59a22fb6], bl
inc edx
dec esi
cmp edx, 0x59a22fba
jne 0x43b230
mov edx, dword [0x4504d8]
test edx, edx
je 0x43b2ce
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4504dc]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43b2b0
inc edi
cmp edx, edi
jne 0x43b2a0
jmp 0x43b2ce
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b2ce
push ecx
push 1
push dword [0x4504e0]
push edx
mov esi, eax
call fcn.00440d90
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43b2df
mov eax, esp
push eax
call fcn.00443bb0
add esp, 4
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x14]
mov dword [esp], 0x37363908
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov edi, eax
and edi, 4
mov ebx, ecx
xor ebx, 0xcff9ef76
add ebx, edi
mov edi, edx
and edi, ebx
add edi, edi
sub ebx, edi
add bl, dl
add bl, 0xb2
mov byte [esp + ecx], bl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x43dbd0
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [0x4584fc]
mov eax, dword [0x44e410]
jmp eax

Function at 0x43dc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
xor ecx, ecx
cmp dword [esp + 0x1c], 0
setne cl
jmp dword [ecx*4 + 0x44e424]
Function at 0x43dfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43e0b0
xor eax, eax
cmp dword [ecx], 0
jne 0x43e0f4
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x34353a3b
mov eax, 0x9a22fb6
mov esi, 0x65dd049
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x9a22fb6]
mov ebx, esi
and ebx, 0x608904b
mov edi, eax
and edi, 0x8000084
or edi, ebx
xor edi, edx
xor edi, 0x28554084
mov ebp, 0xbfd51170
sub ebp, edi
mov ebx, ebp
and ebx, 1
add edi, 0x402aee8f
mov edx, edi
not edx
and edi, 0x1e
and ebp, 0xe1
or ebp, edi
xor ebp, 0x1f
and edx, 1
or edx, ebp
add edx, ebx
mov byte [esp + eax - 0x9a22fb6], dl
inc eax
dec esi
cmp eax, 0x9a22fba
jne 0x43e020
mov eax, dword [esp]
mov edx, dword [0x4504d8]
test edx, edx
je 0x43e0f4
xor esi, esi
mov edi, dword [0x4504dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xef01f5a1
je 0x43e0fe
inc esi
cmp edx, esi
jne 0x43e0a0
jmp 0x43e0f4
mov dword [esp + 4], 0xa3e2e1f8
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
mov ecx, 0xd7
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 4]
mov esi, eax
or esi, edx
or esi, 0x28
not edx
or edx, ecx
and edx, esi
add dl, 0x38
mov byte [esp + eax + 4], dl
inc eax
dec ecx
cmp eax, 7
jne 0x43e0d0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [edi + esi*8 + 4]
cmp esi, eax
je 0x43e0f4
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push dword [esp + 0x40]
push ecx
push 4
push dword [0x4504e0]
push esi
call fcn.00440d90
add esp, 0x1c
jmp 0x43e0f4

Function at 0x43e140
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43e22e
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x34353a3b
mov edx, 0x9a22fb6
mov esi, 0x65dd049
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x9a22fb6]
mov ebx, esi
and ebx, 0x608904b
mov edi, edx
and edi, 0x8000084
or edi, ebx
xor edi, eax
xor edi, 0x28554084
mov ebp, 0xbfd51170
sub ebp, edi
mov ebx, ebp
and ebx, 1
add edi, 0x402aee8f
mov eax, edi
not eax
and edi, 0x1e
and ebp, 0xe1
or ebp, edi
xor ebp, 0x1f
and eax, 1
or eax, ebp
add eax, ebx
mov byte [esp + edx - 0x9a22fb6], al
inc edx
dec esi
cmp edx, 0x9a22fba
jne 0x43e170
mov edx, dword [0x4504d8]
test edx, edx
je 0x43e221
mov esi, dword [esp]
xor eax, eax
mov edi, dword [0x4504dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + eax*8], 0xb62b8d10
je 0x43e200
inc eax
cmp edx, eax
jne 0x43e1f0
jmp 0x43e221
mov eax, dword [edi + eax*8 + 4]
cmp eax, esi
je 0x43e221
push dword [esp + 4]
push 1
push dword [0x4504e0]
push eax
mov esi, ecx
call fcn.00440d90
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e55a
push 0xbbf966b4
push dword [0x4504cc]
call fcn.004433b0
add esp, 8
test eax, eax
je 0x43e521
mov ecx, dword [esi]
test ecx, ecx
je 0x43e557
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43e533
cmp dword [esp], 0
je 0x43e533
mov dword [esi + 4], 3
jmp 0x43e557
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jmp 0x43e617
lea eax, [esp + 8]
push eax
call fcn.00443bb0
add esp, 4
test al, al
je 0x43e557
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43e554
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 4], ecx
cmp eax, 2
jne 0x43e617
mov dword [esp], 0x34353a3b
mov eax, 0x9a22fb6
mov edx, 0x65dd049
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x9a22fb6]
mov ebx, edx
and ebx, 0x608904b
mov esi, eax
and esi, 0x8000084
or esi, ebx
xor esi, ecx
xor esi, 0x28554084
mov ebx, 0xbfd51170
sub ebx, esi
mov ebp, ebx
and ebp, 1
add esi, 0x402aee8f
mov ecx, esi
not ecx
and esi, 0x1e
and ebx, 0xe1
or ebx, esi
xor ebx, 0x1f
and ecx, 1
or ecx, ebx
add ecx, ebp
mov byte [esp + eax - 0x9a22fb6], cl
inc eax
dec edx
cmp eax, 0x9a22fba
jne 0x43e580
mov eax, dword [esp]
mov ecx, dword [0x4504d8]
test ecx, ecx
je 0x43e6ea
xor edx, edx
mov esi, dword [0x4504dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xc3cdc4a6
je 0x43e6c0
inc edx
cmp ecx, edx
jne 0x43e600
jmp 0x43e6ea
mov dword [esp], 0x34353a3b
mov eax, 0x9a22fb6
mov edx, 0x65dd049
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x9a22fb6]
mov ebx, edx
and ebx, 0x608904b
mov esi, eax
and esi, 0x8000084
or esi, ebx
xor esi, ecx
xor esi, 0x28554084
mov ebp, 0xbfd51170
sub ebp, esi
mov ebx, ebp
and ebx, 1
add esi, 0x402aee8f
mov ecx, esi
not ecx
and esi, 0x1e
and ebp, 0xe1
or ebp, esi
xor ebp, 0x1f
and ecx, 1
or ecx, ebp
add ecx, ebx
mov byte [esp + eax - 0x9a22fb6], cl
inc eax
dec edx
cmp eax, 0x9a22fba
jne 0x43e630
mov eax, dword [esp]
mov ecx, dword [0x4504d8]
test ecx, ecx
je 0x43e6ea
xor edx, edx
mov esi, dword [0x4504dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xae6e2b0b
je 0x43e6c0
inc edx
cmp ecx, edx
jne 0x43e6b0
jmp 0x43e6ea
mov edx, dword [esi + edx*8 + 4]
cmp edx, eax
je 0x43e6ea
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push dword [esp + 0x14]
push 5
push dword [0x4504e0]
push edx
call fcn.00440d90
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10