joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433990
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x290
mov dword [esp + 0x264], 0x44c208
mov dword [esp + 0xb8], 0
lea eax, [esp + 0xb8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x446a18
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x446a28
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x260], eax
mov eax, dword [esp + 0x264]
mov ecx, dword [esp + 0x260]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x25c], 0x44c210
mov dword [esp + 0x254], 0x44b980
mov dword [esp + 0x250], 0xb9
mov dword [esp + 0x24c], 0x44b980
mov dword [esp + 0x248], 0xba
mov dword [esp + 0x244], 0x44c218
mov dword [esp + 0x23c], 0x44c220
mov dword [esp + 0x234], 0x44c228
mov dword [esp + 0x22c], 0x44c230
mov dword [esp + 0x224], 0x44b980
mov dword [esp + 0x220], 0xbf
mov dword [esp + 0x21c], 0x44c238
mov dword [esp + 0x214], 0x44b980
mov dword [esp + 0x210], 0xc2
mov dword [esp + 0x20c], 0x44b980
mov dword [esp + 0x208], 0xc2
mov dword [esp + 0x204], 0x44c240
mov dword [esp + 0x1fc], 0x44c248
mov dword [esp + 0x1f4], 0x44b980
mov dword [esp + 0x1f0], 0xc5
mov dword [esp + 0x1ec], 0x44c250
mov dword [esp + 0x1e4], 0x44c258
mov dword [esp + 0x1dc], 0x44b980
mov dword [esp + 0x1d8], 0xc8
mov dword [esp + 0x1d4], 0x44b980
mov dword [esp + 0x1d0], 0xc9
mov dword [esp + 0x1cc], 0x44c260
mov dword [esp + 0x1c4], 0x44b980
mov dword [esp + 0x1c0], 0xcb
mov dword [esp + 0x1bc], 0x44c268
mov dword [esp + 0x1b4], 0x44c270
mov dword [esp + 0x1ac], 0x44c278
mov dword [esp + 0x1a4], 0x44b980
mov dword [esp + 0x1a0], 0xcf
mov dword [esp + 0x19c], 0x44b980
mov dword [esp + 0x198], 0xd0
mov dword [esp + 0x194], 0x44b980
mov dword [esp + 0x190], 0xd1
mov dword [esp + 0x18c], 0x44c280
mov dword [esp + 0x184], 0x44b980
mov dword [esp + 0x180], 0xd3
mov dword [esp + 0x17c], 0x44b980
mov dword [esp + 0x178], 0xd4
mov dword [esp + 0x174], 0x44c288
mov dword [esp + 0x16c], 0x44c290
mov dword [esp + 0x164], 0x44b980
mov dword [esp + 0x160], 0xd7
mov dword [esp + 0x15c], 0x44b980
mov dword [esp + 0x158], 0xd8
mov dword [esp + 0x154], 0x44b980
mov dword [esp + 0x150], 0xbd
mov dword [esp + 0x14c], 0x44b980
mov dword [esp + 0x148], 0xc6
mov dword [esp + 0x144], 0x44b980
mov dword [esp + 0x140], 0xcd
mov dword [esp + 0x13c], 0x44b980
mov dword [esp + 0x138], 0xd5
xor ebx, ebx
jmp eax
Function at 0x434fc0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [esp + 0x44]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x435162
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
jmp 0x43501c
xor ebx, ebx
test al, 1
jne 0x435027
jmp 0x43515c
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.004308a0
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x43504f
jmp 0x435150
mov dword [esp + 0x2c], eax
mov ebx, eax
add ebx, 1
mov dword [esp], ebx
call fcn.0040c6f0
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00429720
mov al, byte [esp + 0x1c]
mov byte [esp + 0x20], al
mov byte [esp + 0xc], 0xcf
mov byte [esp + 0xd], 0xf5
mov byte [esp + 0xe], 0xf7
mov byte [esp + 0xf], 0xff
mov byte [esp + 0x10], 0xea
mov byte [esp + 0x11], 0xfe
mov byte [esp + 0x12], 0xe3
mov byte [esp + 0x13], 0xf5
mov byte [esp + 0x14], 0xe4
mov byte [esp + 0x15], 0x33
mov byte [esp + 0x16], 0xf2
mov byte [esp + 0x17], 0x8f
mov byte [esp + 0x18], 0xf0
mov byte [esp + 0x19], 5
mov eax, 0xe
mov byte [esp + eax + 0xc], 0
add eax, 1
cmp eax, 0x10
jne 0x4350c7
xor eax, eax
cmp eax, 0x10
jae 0x43511e
mov cl, byte [esp + eax + 0xc]
movzx edx, cl
mov dword [esp + 0x24], edx
mov ebp, eax
shl ebp, 1
and ebp, 0x2baf2d84
mov edx, eax
xor edx, 0x95d796c2
mov ebx, esi
mov esi, edx
and esi, ebp
shl esi, 1
xor edx, ebp
add edx, esi
mov esi, edx
and esi, dword [esp + 0x24]
shl esi, 1
sub edx, esi
mov esi, ebx
add dl, cl
add dl, 0x36
mov byte [esp + eax + 0xc], dl
add eax, 1
jmp 0x4350d6
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp], eax
mov esi, dword [esp + 0x28]
mov dword [esp + 4], esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0040d2e0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x435146
mov dword [esp], esi
call fcn.0040c700
jmp 0x435150
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435170
Capabilities:
Capture screenshot

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
mov dword [esp + 0x10], eax
push 0x4d
call esi
mov dword [esp + 0xc], eax
push 7
push ebx
call dword [sym.imp.GDI32.dll_GetCurrentObject]
mov edi, eax
lea eax, [esp + 0x38]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov esi, dword [esp + 0x40]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
push esi
mov edi, dword [esp + 0xc]
push edi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x14], eax
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x20], eax
push 0xcc0020
push dword [esp + 0x10]
push dword [esp + 0x18]
mov dword [esp + 0x24], ebx
push ebx
push esi
push edi
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [esp + 0x24], esi
xor esi, 0xfffffffd
or esi, edi
mov dword [esp + 4], 0x2341208e
jg 0x435223
mov dword [esp + 4], 0xc9837a1b
mov ecx, 0xb344672f
xor eax, eax
cmp ecx, 0xe7f735d4
setl al
mov edi, dword [esp + 0x20]
jmp dword [eax*4 + 0x44c298]
Function at 0x4397b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4397d0
mov dword [esp], 0xb6b68837
mov dword [esp + 4], 0
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, 0x28303761
sub ebx, esi
and ebx, 0x28003513
mov ebp, 0xa8303761
sub ebp, esi
and ebp, 0x8030026c
or ebp, ebx
xor ebp, edi
mov edi, ebp
not edi
and edi, 0xc8f114e9
xor ebp, 0xb70eeb16
lea edi, [edi*2]
add edi, ebp
mov ebx, edi
xor ebx, 0xfe
or edi, 1
and ebx, edi
add ebx, edi
mov byte [esp + esi], bl
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
cmp esi, 8
jb 0x4397f0
test edx, edx
je 0x4398be
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x439881
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x439870
cmp edi, 3
jb 0x4398be
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x439890
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x439c40
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x44f6f8]
mov dword [esp + 4], 0x9670b37
mov dword [esp + 8], 0x58b078f
mov dword [esp + 0xc], 0x1790388
mov dword [esp + 0x10], 0x1d421f73
mov dword [esp + 0x14], 0x196d1b92
mov dword [esp + 0x18], 0x156d1792
mov dword [esp + 0x1c], 0x1112132f
mov ecx, 0x7ce28783
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x7ce2877f]
xor edx, ecx
mov esi, edx
and esi, 1
xor edx, 1
add edx, 0x70
or edx, esi
add edx, esi
mov byte [esp + ecx - 0x7ce2877f], dl
inc ecx
cmp ecx, 0x7ce2879f
jne 0x439ca0
lea ecx, [esp + 0x54]
lea esi, [esp + 0x84]
lea edi, [esp + 4]
push ecx
push 8
push esi
push 0xd
push edi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cc10]
Function at 0x43a5b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x30]
call fcn.00443240
add esp, 0x14
test eax, eax
js 0x43a6ed
lea edi, [esp + 8]
lea eax, [esp + 0xc]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.004436a0
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43a64c
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x43a616
mov eax, 0xffffffff
jmp 0x43a61d
lea eax, [eax*2 + 2]
push eax
call fcn.0040c6f0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x14]
call fcn.00443d50
add esp, 0x14
test eax, eax
js 0x43a641
mov eax, esi
jmp 0x43a64c
push esi
call fcn.0040c700
add esp, 4
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [esp], 0xb08f8e8d
mov edx, 0x5d
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x5d]
lea edi, [edx - 0x27da3200]
mov ebx, edx
and ebx, esi
or edi, esi
lea esi, [ebx + ebx]
not esi
add esi, ebx
and esi, edi
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x2e
mov byte [esp + edx - 0x5d], bl
inc edx
cmp edx, 0x61
jne 0x43a660
mov edx, dword [0x44f6fc]
test edx, edx
je 0x43a6de
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43a6c0
inc edi
cmp edx, edi
jne 0x43a6b0
jmp 0x43a6de
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a6de
push ecx
push 1
push dword [0x44f704]
push edx
mov esi, eax
call fcn.0043f170
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43a6ef
mov eax, esp
push eax
call fcn.004427e0
add esp, 4
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43a700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov ebp, 0xffffffff
mov ecx, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ebp
add ecx, 3
cmp byte [edx + ebp + 1], 0
lea ebp, [ebp + 1]
jne 0x43a720
shr ecx, 2
movzx eax, byte [edx + ebp - 1]
cmp eax, 0x3d
je 0x43a741
cmp eax, 0x2e
jne 0x43a742
dec ecx
movzx eax, byte [edx + ebp - 2]
cmp eax, 0x3d
je 0x43a751
cmp eax, 0x2e
jne 0x43a752
dec ecx
mov dword [esp], ecx
mov edx, 0
test ebp, ebp
je 0x43a844
xor ecx, ecx
mov edi, 2
jmp 0x43a782
lea eax, [edi + 4]
add edi, 2
mov ecx, edx
cmp edi, ebp
mov edi, eax
jae 0x43a844
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x40]
mov esi, ebp
mov ebp, eax
movzx eax, byte [eax + edi - 2]
push eax
call fcn.00420e60
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi - 1]
mov ebp, esi
mov esi, dword [esp + 8]
push eax
call fcn.00420e60
add esp, 4
mov bh, al
shr al, 4
and al, 3
shl bl, 2
or bl, al
lea edx, [esi + 1]
mov eax, dword [esp + 0x44]
mov byte [eax + esi], bl
cmp edi, ebp
jae 0x43a770
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + edi]
push eax
mov dword [esp + 8], edx
call fcn.00420e60
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x43a770
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 1], al
lea eax, [edi + 1]
cmp eax, ebp
jae 0x43a770
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + edi + 1]
push eax
mov dword [esp + 8], edx
call fcn.00420e60
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x43a770
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x43a770
mov ecx, dword [esp]
cmp edx, ecx
mov eax, 0
jne 0x43a8f7
mov ebp, dword [esp + 0x44]
lea eax, [ebp + 0x20]
mov dword [esp + 8], eax
mov esi, ecx
xor esi, 0x20
lea edx, [ecx + ecx]
and edx, 0xffffffbe
lea edi, [esp + 0xc]
mov eax, ebp
mov dword [esp], ecx
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esp + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, edx
sub eax, esi
je 0x43a8f2
neg edx
mov ecx, dword [esp]
xor ecx, edx
cmp ecx, 0xffffffdf
je 0x43a8dc
mov ecx, eax
and ecx, 0xfffffffe
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [ebp + ebx + 0x20]
mov byte [ebp + ebx], dl
lea edx, [ebx + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [ebp + ebx + 0x21]
mov byte [ebp + ebx + 1], dl
add ebx, 2
cmp ecx, ebx
jne 0x43a8b0
test al, 1
je 0x43a8f2
mov ecx, ebx
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [ebp + ebx + 0x20]
mov byte [ebp + ebx], cl
mov byte [ebp + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 4], 0
mov dword [esp], 0xb08f8e8d
xor eax, eax
movzx edx, byte [esp + eax]
mov ecx, eax
and ecx, 1
mov esi, eax
or esi, 0xd825ce5d
add esi, ecx
xor esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0x2e
mov byte [esp + eax], dl
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43c560
mov edi, dword [esp]
mov eax, dword [0x44f6fc]
test eax, eax
je 0x43c5e6
xor ecx, ecx
mov edx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43c5c0
inc ecx
cmp eax, ecx
jne 0x43c5b0
jmp 0x43c5e6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c5e6
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f704]
push eax
call fcn.0043f170
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x995a5b40
mov eax, 0x6f
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x6f]
mov esi, ecx
and esi, 7
mov ebp, eax
and ebp, 0x78
or ebp, esi
xor ebp, 0xf8
and ebp, edx
lea esi, [ecx - 0x1bfef370]
or esi, edx
not esi
or esi, ebp
add esi, 0xa455a9d7
mov edx, esi
and edx, 0x54
xor esi, 0xd4
lea edx, [esi + edx*2]
add dl, 0x2a
mov byte [esp + eax - 0x6f], dl
inc eax
dec ecx
cmp eax, 0x73
jne 0x43c600
cmp edi, dword [esp]
jne 0x43c755
push dword [esp + 4]
call fcn.0043c430
add esp, 4
mov ecx, dword [esp + 4]
mov dword [esp + 8], ecx
mov dword [esp], 0xb08f8e8d
xor edx, edx
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
and edi, 1
mov ebp, edx
or ebp, 0xd825ce5d
add ebp, edi
xor ebp, esi
mov esi, ebp
and esi, 1
xor ebp, 1
lea ecx, [esi*2]
add ecx, ebp
add cl, 0x2e
mov byte [esp + edx], cl
xor edx, 1
lea edx, [edx + edi*2]
cmp edx, 4
jb 0x43c670
mov edi, dword [esp]
mov edx, dword [0x44f6fc]
test edx, edx
je 0x43c6f8
xor ebp, ebp
mov esi, dword [0x44f700]
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43c6d0
inc ebp
cmp edx, ebp
jne 0x43c6c0
jmp 0x43c6f8
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43c6f8
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x44f704]
push edx
mov esi, eax
call fcn.0043f170
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43c74c
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43c725
add edi, 2
cmp si, bp
je 0x43c710
cmp si, bp
je 0x43c737
mov esi, dword [ecx]
test esi, esi
jne 0x43c700
mov edi, 0xc0000225
jmp 0x43c74c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043c4c0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43c7a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43c870
xor eax, eax
cmp dword [ecx], 0
jne 0x43c8b8
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xb08f8e8d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
mov esi, eax
and esi, 1
mov ebx, eax
or ebx, 0xd825ce5d
add ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
add bl, 0x2e
mov byte [esp + eax], bl
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 4
jb 0x43c810
mov eax, dword [esp]
mov esi, dword [0x44f6fc]
test esi, esi
je 0x43c8b8
xor edi, edi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43c8c1
inc edi
cmp esi, edi
jne 0x43c860
jmp 0x43c8b8
mov dword [esp + 4], 0x81c6c7cc
mov word [esp + 8], 0
mov eax, 0x11
mov ecx, 0xce
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x8d
mov edx, eax
and edx, 0x12
or edx, esi
xor dl, byte [esp + eax - 0xd]
xor dl, 0xad
add dl, 0xb
mov byte [esp + eax - 0xd], dl
inc eax
dec ecx
cmp eax, 0x17
jne 0x43c890
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c8b8
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f704]
push esi
call fcn.0043f170
add esp, 0x1c
jmp 0x43c8b8

Function at 0x43c900
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c9aa
push ebx
push edi
push esi
push eax
mov dword [esp], 0xb08f8e8d
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov esi, edx
and esi, 1
mov ebx, edx
or ebx, 0xd825ce5d
add ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
add bl, 0x2e
mov byte [esp + edx], bl
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 4
jb 0x43c920
mov edx, dword [0x44f6fc]
test edx, edx
je 0x43c99e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43c980
inc edi
cmp edx, edi
jne 0x43c970
jmp 0x43c99e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c99e
push eax
push 1
push dword [0x44f704]
push edx
mov esi, ecx
call fcn.0043f170
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43c9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43ca40
mov eax, dword [ecx]
test eax, eax
je 0x43ca40
mov dword [esp + 0xc], eax
mov dword [esp], 0xb08f8e8d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov ebx, eax
and ebx, 1
mov edi, eax
or edi, 0xd825ce5d
add edi, ebx
xor edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea edx, [edi + esi*2]
add dl, 0x2e
mov byte [esp + eax], dl
xor eax, 1
lea eax, [eax + ebx*2]
cmp eax, 4
jb 0x43c9e0
mov eax, dword [esp]
mov ebx, dword [0x44f6fc]
test ebx, ebx
je 0x43caa9
xor edi, edi
mov esi, dword [0x44f700]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0x2dedf0b8
je 0x43ca85
inc edi
cmp ebx, edi
jne 0x43ca30
jmp 0x43caa9
mov dword [esp], 0xc186878c
mov eax, 0x5533e761
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5533e761]
xor ecx, eax
mov edx, ecx
xor edx, 0x65
mov esi, ecx
or esi, 0x1a
and esi, edx
xor ecx, 0x1a
lea ecx, [ecx + esi*2]
inc cl
mov byte [esp + eax - 0x5533e761], cl
inc eax
cmp eax, 0x5533e765
jne 0x43ca50
mov eax, dword [esp]
jmp 0x43cb9d
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43caa9
push dword [ebp + 8]
push dword [esp + 0x10]
push 2
push dword [0x44f704]
push esi
mov esi, ecx
call fcn.0043f170
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43cb90
cmp eax, 0xc000010a
jne 0x43cb90
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp], eax
mov dword [esp + 4], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0xb08f8e8d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x10]
mov esi, eax
and esi, 1
mov ebx, eax
or ebx, 0xd825ce5d
add ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
add bl, 0x2e
mov byte [esp + eax + 0x10], bl
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 4
jb 0x43cb00
mov eax, dword [esp + 0x10]
mov esi, dword [0x44f6fc]
test esi, esi
je 0x43cb90
xor edi, edi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4e66b5a3
je 0x43cb6a
mov edx, edi
and edx, 1
xor edi, 1
lea edi, [edi + edx*2]
cmp edi, esi
jb 0x43cb50
jmp 0x43cb90
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43cb90
mov eax, esp
push eax
push 0
push dword [esp + 0x14]
push 3
push dword [0x44f704]
push esi
mov esi, ecx
call fcn.0043f170
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43cb9d
mov esi, eax
call fcn.0043c900
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43cc44
push 0xbbf966b4
push dword [0x44f6f0]
call fcn.00441f60
add esp, 8
test eax, eax
je 0x43cc09
mov ecx, dword [esi]
test ecx, ecx
je 0x43cc41
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43cc1d
cmp dword [esp], 0
je 0x43cc1d
mov dword [esi + 4], 3
jmp 0x43cc41
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jmp 0x43ccc3
lea eax, [esp + 8]
push eax
call fcn.004427e0
add esp, 4
test al, al
je 0x43cc41
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43cc3e
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 4], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43ccc3
mov dword [esp], 0xb08f8e8d
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edx, eax
and edx, 1
mov ebx, eax
or ebx, 0xd825ce5d
add ebx, edx
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0x2e
mov byte [esp + eax], bl
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 4
jb 0x43cc60
mov eax, dword [esp]
mov edx, dword [0x44f6fc]
test edx, edx
je 0x43cd54
xor esi, esi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43cd30
inc esi
cmp edx, esi
jne 0x43ccb0
jmp 0x43cd54
mov dword [esp], 0xb08f8e8d
xor eax, eax
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edx, eax
and edx, 1
mov ebx, eax
or ebx, 0xd825ce5d
add ebx, edx
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0x2e
mov byte [esp + eax], bl
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 4
jb 0x43ccd0
mov eax, dword [esp]
mov edx, dword [0x44f6fc]
test edx, edx
je 0x43cd54
xor esi, esi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43cd30
inc esi
cmp edx, esi
jne 0x43cd20
jmp 0x43cd54
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43cd54
push ecx
push ebp
push edi
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 5
push dword [0x44f704]
push edx
call fcn.0043f170
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10