joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e0b5
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x18]
test eax, eax
setns al
cmp edx, 0x100000
setb cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44de44]

Function at 0x42e13b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44de5c]

Function at 0x42e2f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x74]
add eax, 0x1b
push eax
call fcn.0040ca00
add esp, 4
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 0x2c], 0x7c7e7451
mov dword [esp + 0x30], 0x7163797a
mov dword [esp + 0x34], 0x7e5c2174
mov dword [esp + 0x38], 0x286d6078
mov dword [esp + 0x3c], 0x7a6a6a4a
mov dword [esp + 0x40], 0x2c767c6c
mov word [esp + 0x44], 0x222f
mov byte [esp + 0x46], 0x16
mov dword [esp + 0x47], 0
mov eax, 2
mov ecx, 0x7d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0x6e
mov edx, eax
and edx, 0x11
or edx, edi
xor dl, byte [esp + eax + 0x2a]
xor dl, 0x6e
add dl, 0xf6
mov byte [esp + eax + 0x2a], dl
inc eax
dec ecx
cmp eax, 0x21
jne 0x42e370
mov eax, dword [esp + 0x10]
lea ecx, [eax + ebp]
movzx eax, byte [esp + 0x2c]
mov edx, dword [esp + 8]
test al, al
je 0x42e3bb
lea edi, [esp + 0x2d]
mov edx, dword [esp + 8]
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [edi]
inc edi
test al, al
jne 0x42e3b0
mov byte [edx], 0
mov edi, dword [esp + 4]
test edi, edi
je 0x42e407
mov eax, dword [esp + 0x10]
add eax, ebx
sub esi, eax
add esi, 0xfffffff5
mov dword [esp + 0x70], esi
mov esi, edi
and esi, 3
je 0x42e40b
xor eax, eax
nop
nop
mov edi, edx
movzx edx, byte [ecx]
mov byte [esp], dl
cmp byte [esp], 1
sbb ecx, 0xffffffff
movzx edx, byte [esp]
mov byte [edi + eax], dl
mov edx, edi
inc eax
cmp esi, eax
jne 0x42e3e0
add edx, eax
sub dword [esp + 4], eax
mov eax, edx
jmp 0x42e40b
mov eax, edx
jmp 0x42e463
cmp dword [esp + 0x70], 3
mov edi, dword [esp + 4]
mov esi, dword [esp + 0x78]
jb 0x42e463
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], edi
movzx eax, byte [ecx]
cmp al, 1
sbb ecx, 0xffffffff
mov byte [edx], al
movzx eax, byte [ecx]
cmp al, 1
sbb ecx, 0xffffffff
mov byte [edx + 1], al
movzx eax, byte [ecx]
cmp al, 1
sbb ecx, 0xffffffff
mov byte [edx + 2], al
movzx eax, byte [ecx]
cmp al, 1
sbb ecx, 0xffffffff
lea edi, [edx + 4]
mov dword [esp], edi
mov edi, dword [esp + 4]
mov byte [edx + 3], al
mov eax, dword [esp]
mov edx, eax
add edi, 0xfffffffc
jne 0x42e420
mov byte [eax], 0
mov ecx, dword [esp + 0xa0]
push dword [esp + 0x18]
mov edi, dword [esp + 0x80]
push edi
push dword [esp + 0x10]
call fcn.0040d810
jmp dword [0x44de74]

Function at 0x42e720
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
not eax
shr eax, 0x1f
mov dword [esp + 0xc], 0
jmp dword [eax*4 + 0x44ddb4]
Function at 0x434310
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2c0
mov dword [esp + 0x2a4], 0x44e6fc
mov dword [esp + 0xb4], 0
lea eax, [esp + 0xb4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x448aa0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x448ab0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2a0], eax
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x29c], 0x44e704
mov dword [esp + 0x294], 0x44e70c
mov dword [esp + 0x28c], 0x44e714
mov dword [esp + 0x284], 0x44e71c
mov dword [esp + 0x27c], 0x44e724
mov dword [esp + 0x274], 0x44e72c
mov dword [esp + 0x26c], 0x44e734
mov dword [esp + 0x264], 0x44df00
mov dword [esp + 0x260], 0x8f
mov dword [esp + 0x25c], 0x44e73c
mov dword [esp + 0x254], 0x44e744
mov dword [esp + 0x24c], 0x44e74c
mov dword [esp + 0x244], 0x44df00
mov dword [esp + 0x240], 0x96
mov dword [esp + 0x23c], 0x44e754
mov dword [esp + 0x234], 0x44e75c
mov dword [esp + 0x22c], 0x44df00
mov dword [esp + 0x228], 0x96
mov dword [esp + 0x224], 0x44e764
mov dword [esp + 0x21c], 0x44e76c
mov dword [esp + 0x214], 0x44df00
mov dword [esp + 0x210], 0x99
mov dword [esp + 0x20c], 0x44e774
mov dword [esp + 0x204], 0x44e77c
mov dword [esp + 0x1fc], 0x44e784
mov dword [esp + 0x1f4], 0x44df00
mov dword [esp + 0x1f0], 0x9d
mov dword [esp + 0x1ec], 0x44df00
mov dword [esp + 0x1e8], 0x9e
mov dword [esp + 0x1e4], 0x44df00
mov dword [esp + 0x1e0], 0x9f
mov dword [esp + 0x1dc], 0x44e78c
mov dword [esp + 0x1d4], 0x44df00
mov dword [esp + 0x1d0], 0xa1
mov dword [esp + 0x1cc], 0x44df00
mov dword [esp + 0x1c8], 0xa2
mov dword [esp + 0x1c4], 0x44e794
mov dword [esp + 0x1bc], 0x44e79c
mov dword [esp + 0x1b4], 0x44df00
mov dword [esp + 0x1b0], 0xa5
mov dword [esp + 0x1ac], 0x44e7a4
mov dword [esp + 0x1a4], 0x44df00
mov dword [esp + 0x1a0], 0xa7
mov dword [esp + 0x19c], 0x44df00
mov dword [esp + 0x198], 0xa8
mov dword [esp + 0x194], 0x44df00
mov dword [esp + 0x190], 0xa9
mov dword [esp + 0x18c], 0x44df00
mov dword [esp + 0x188], 0xaa
mov dword [esp + 0x184], 0x44df00
mov dword [esp + 0x180], 0x89
mov dword [esp + 0x17c], 0x44df00
mov dword [esp + 0x178], 0x8c
mov dword [esp + 0x174], 0x44df00
mov dword [esp + 0x170], 0x91
mov dword [esp + 0x16c], 0x44df00
mov dword [esp + 0x168], 0x94
mov dword [esp + 0x164], 0x44df00
mov dword [esp + 0x160], 0x9a
mov dword [esp + 0x15c], 0x44df00
mov dword [esp + 0x158], 0xa3
xor ebx, ebx
jmp eax
Function at 0x435df0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
setne al
jmp 0x435e15
jmp 0x435e17
jmp 0x435e19
xor ebx, ebx
test al, 1
jne 0x435e24
jmp 0x435fa5
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
cmp esi, 0
setne al
jmp 0x435e58
jmp 0x435e5a
xor ebx, ebx
test al, 1
jne 0x435e65
jmp 0x435f9f
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.0040cb20
xor ebx, ebx
cmp eax, 0
je 0x435f93
mov dword [esp + 0x2c], esi
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 0x21
mov byte [esp + 0x15], 7
mov byte [esp + 0x16], 5
mov byte [esp + 0x17], 0x19
mov byte [esp + 0x18], 0xe
mov byte [esp + 0x19], 0x1e
mov byte [esp + 0x1a], 9
mov byte [esp + 0x1b], 0x1b
mov byte [esp + 0x1c], 8
mov byte [esp + 0x1d], 0xc1
mov byte [esp + 0x1e], 6
mov byte [esp + 0x1f], 9
mov byte [esp + 0x20], 4
mov byte [esp + 0x21], 0xf7
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x14
jne 0x435edd
xor esi, esi
cmp esi, 0x14
jae 0x435f61
movzx edi, byte [esp + esi + 0x14]
mov ecx, esi
add ecx, 0x1a707327
mov ebx, edi
add ebx, 1
mov dword [esp + 0x28], eax
mov eax, ebp
mov ebp, edi
xor ebp, 0xffffffff
mov edx, ecx
or edx, ebp
add edx, ebx
mov ebx, edx
and ebx, 2
xor ebx, 2
mov ebp, edx
and ebp, 0xfffffffd
imul ebp, ebx
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
add edx, ebp
mov ebp, eax
mov eax, dword [esp + 0x28]
add ecx, edi
sub ecx, edx
mov edi, ecx
add edi, 0x3d
mov edx, 0xc3
sub edx, ecx
or edx, 1
add edx, edi
mov edi, dword [esp + 0x44]
or ecx, 1
add ecx, 0x3c
add edx, ecx
mov byte [esp + esi + 0x14], dl
add esi, 1
jmp 0x435eec
jmp 0x435f63
mov esi, dword [esp + 0x2c]
jmp 0x435f69
lea edx, [esp + 0x14]
mov ecx, edi
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040d810
sub esp, 0xc
mov bl, al
jmp 0x435f86
and bl, 1
jmp 0x435f8b
jmp 0x435f8d
jmp 0x435f8f
jmp 0x435f91
jmp 0x435f93
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bf60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00444ea0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44f374]

Function at 0x43c1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00445530
add esp, 0x14
test eax, eax
js 0x43c326
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004458e0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43c277
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43c243
mov eax, 0xffffffff
jmp 0x43c24a
lea eax, [eax*2 + 2]
push eax
call fcn.0040ca00
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00445ea0
add esp, 0x14
test eax, eax
js 0x43c26e
mov esi, edi
jmp 0x43c277
push edi
call fcn.0040ca10
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0x20272625
mov byte [esp + 8], 0
mov ecx, 9
mov edx, 6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
and edi, 5
mov ebx, ecx
and ebx, 0x1a
or ebx, edi
xor bl, byte [esp + ecx - 5]
xor bl, 0x45
add bl, 0x93
mov byte [esp + ecx - 5], bl
inc ecx
dec edx
cmp ecx, 0xe
jne 0x43c2a0
mov ecx, dword [0x451b4c]
test ecx, ecx
je 0x43c30a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43c2f0
inc edi
cmp ecx, edi
jne 0x43c2e0
jmp 0x43c30a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43c30a
push eax
push 1
push dword [0x451b54]
push ecx
call fcn.00441b10
add esp, 0x10
test esi, esi
jne 0x43c328
lea eax, [esp + 4]
push eax
call fcn.00444cc0
add esp, 4
test al, al
je 0x43c326
cmp dword [esp + 4], 1
je 0x43c328
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov ebx, 0xffffffff
mov esi, ebx
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x43c350
mov eax, ebx
and eax, 3
mov edx, ebx
or edx, 3
imul edx, eax
xor eax, 3
mov ecx, ebx
and ecx, 0xfffffffc
imul ecx, eax
add edx, ecx
shr edx, 2
movzx eax, byte [edi + ebx - 1]
cmp eax, 0x3d
je 0x43c388
cmp eax, 0x2e
jne 0x43c389
dec edx
movzx eax, byte [edi + ebx - 2]
cmp eax, 0x3d
je 0x43c398
cmp eax, 0x2e
jne 0x43c399
dec edx
mov dword [esp + 4], edx
mov edx, 0
test ebx, ebx
je 0x43c4ae
xor esi, esi
mov ebp, 2
mov dword [esp + 0xc], ebx
jmp 0x43c3d4
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
mov ebx, edi
cmp ebp, edi
mov ebp, eax
jae 0x43c4ae
mov edi, dword [esp + 0x44]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00422510
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.00422510
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
mov eax, ecx
and al, bh
add al, al
xor cl, bh
add cl, al
lea edx, [esi + 1]
mov eax, dword [esp + 0x48]
mov dword [esp + 8], esi
mov byte [eax + esi], cl
mov eax, dword [esp + 0xc]
mov edi, eax
cmp ebp, eax
jae 0x43c3c0
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00422510
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43c3c0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov esi, dword [esp + 8]
lea ebx, [esi + 2]
mov edx, dword [esp + 0x48]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, edi
jae 0x43c3b7
mov ecx, dword [esp + 0x44]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.00422510
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x43c3c0
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 8]
mov byte [ecx + edx + 2], al
add edx, 3
jmp 0x43c3c0
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x43c545
mov esi, dword [esp + 0x48]
lea edx, [esi + 0x20]
lea edi, [esp + 0x10]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x30]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x43c541
cmp ebx, 0x21
je 0x43c52b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x43c500
test bl, 1
je 0x43c541
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0x10]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f270
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp], 0xc1c6c714
mov word [esp + 4], 0
mov ecx, 0x1988a4b1
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1988a4b1]
mov edx, ecx
and edx, esi
mov edi, edx
and edi, 0xffffffbd
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, edi
add edx, ebx
add esi, ecx
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
mov esi, edx
or esi, 0x89
and edx, 0x89
add edx, esi
add dl, 2
mov byte [esp + ecx - 0x1988a4b1], dl
inc ecx
cmp ecx, 0x1988a4b7
jne 0x43f290
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x459b68]
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x43f300
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44f814]
Function at 0x43f3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edi, eax
and edi, 2
mov edx, ecx
xor edx, 0xad097a49
add edx, edi
mov edi, edx
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
add dl, 0x93
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x43f3d0
mov edi, dword [esp]
mov eax, dword [0x451b4c]
test eax, eax
je 0x43f446
xor ecx, ecx
mov edx, dword [0x451b50]
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43f420
inc ecx
cmp eax, ecx
jne 0x43f410
jmp 0x43f446
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43f446
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x451b54]
push eax
call fcn.00441b10
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43f565
mov dword [esp + 0x10], ebp
push dword [esp + 8]
call fcn.0043f270
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor ebp, ebp
xor edi, edi
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edi]
mov edx, ebp
and edx, 2
mov ecx, edi
xor ecx, 0xad097a49
add ecx, edx
mov edx, ecx
and edx, esi
add ecx, esi
add edx, edx
sub ecx, edx
add cl, 0x93
mov byte [esp + edi], cl
inc edi
add ebp, 2
cmp edi, 5
jne 0x43f480
mov edi, dword [esp]
mov edx, dword [0x451b4c]
test edx, edx
je 0x43f508
xor ecx, ecx
mov esi, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xc85f7986
je 0x43f4e0
inc ecx
cmp edx, ecx
jne 0x43f4d0
jmp 0x43f508
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x43f508
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x451b54]
push edx
mov esi, eax
call fcn.00441b10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43f55c
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43f535
add edi, 2
cmp si, bp
je 0x43f520
cmp si, bp
je 0x43f547
mov esi, dword [ecx]
test esi, esi
jne 0x43f510
mov edi, 0xc0000225
jmp 0x43f55c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043f300
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43f5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43f670
xor eax, eax
cmp dword [ecx], 0
jne 0x43f6d7
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, eax
and ebp, 2
mov ebx, esi
xor ebx, 0xad097a49
add ebx, ebp
mov ebp, ebx
and ebp, edi
add ebx, edi
add ebp, ebp
sub ebx, ebp
add bl, 0x93
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 5
jne 0x43f610
mov eax, dword [esp]
mov esi, dword [0x451b4c]
test esi, esi
je 0x43f6d7
xor edi, edi
mov ebx, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43f6e1
inc edi
cmp esi, edi
jne 0x43f660
jmp 0x43f6d7
mov dword [esp + 8], 0x89cacb34
mov byte [esp + 0xc], 0
mov eax, 0x12674933
mov ecx, 0x6d98b6cc
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1267492b]
mov esi, ecx
and esi, 0x44109005
mov edi, eax
and edi, 0x1205080a
or edi, esi
xor edi, edx
xor edi, 0x4472d135
add edi, 0xa3fb9200
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [esp + eax - 0x1267492b], dl
inc eax
dec ecx
cmp eax, 0x12674938
jne 0x43f690
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43f6d7
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x451b54]
push esi
call fcn.00441b10
add esp, 0x1c
jmp 0x43f6d7

Function at 0x43f720
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43f7db
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, edx
and ebp, 2
mov ebx, esi
xor ebx, 0xad097a49
add ebx, ebp
mov ebp, ebx
and ebp, edi
add ebx, edi
add ebp, ebp
sub ebx, ebp
add bl, 0x93
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 5
jne 0x43f750
mov edx, dword [0x451b4c]
test edx, edx
je 0x43f7ce
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43f7b0
inc edi
cmp edx, edi
jne 0x43f7a0
jmp 0x43f7ce
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43f7ce
push eax
push 1
push dword [0x451b54]
push edx
mov esi, ecx
call fcn.00441b10
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43fb42
push 0xf8eb88df
push dword [0x451b40]
call fcn.00444480
add esp, 8
test eax, eax
je 0x43fb05
mov ecx, dword [esi]
test ecx, ecx
je 0x43fb3f
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43fb1b
cmp dword [esp], 0
je 0x43fb1b
mov dword [esi + 4], 3
jmp 0x43fb3f
mov ecx, edi
mov edi, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43fbd7
lea eax, [esp + 0xc]
push eax
call fcn.00444cc0
add esp, 4
test al, al
je 0x43fb3f
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43fb3c
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, edi
mov edx, dword [esi]
mov dword [esp + 8], edx
mov edi, ebx
cmp eax, 2
jne 0x43fbd7
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor ebp, ebp
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi]
mov eax, ebp
and eax, 2
mov edx, esi
xor edx, 0xad097a49
add edx, eax
mov eax, edx
and eax, ebx
add edx, ebx
add eax, eax
sub edx, eax
add dl, 0x93
mov byte [esp + esi], dl
inc esi
add ebp, 2
cmp esi, 5
jne 0x43fb70
mov eax, dword [esp]
mov edx, dword [0x451b4c]
test edx, edx
je 0x43fc77
xor esi, esi
mov ebx, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43fc50
inc esi
cmp edx, esi
jne 0x43fbc0
jmp 0x43fc77
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi]
mov ebp, eax
and ebp, 2
mov edx, esi
xor edx, 0xad097a49
add edx, ebp
mov ebp, edx
and ebp, ebx
add edx, ebx
add ebp, ebp
sub edx, ebp
add dl, 0x93
mov byte [esp + esi], dl
inc esi
add eax, 2
cmp esi, 5
jne 0x43fbf0
mov eax, dword [esp]
mov edx, dword [0x451b4c]
test edx, edx
je 0x43fc77
xor esi, esi
mov ebx, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43fc50
inc esi
cmp edx, esi
jne 0x43fc40
jmp 0x43fc77
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43fc77
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push edi
push dword [esp + 0x18]
push 5
push dword [0x451b54]
push edx
call fcn.00441b10
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43ffa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43ffb9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43ffca
cmp eax, 2
je 0x44003c
jmp 0x440069
push 0xf8eb88df
push dword [0x451b40]
call fcn.00444480
add esp, 8
test eax, eax
je 0x440007
mov ecx, dword [esi]
test ecx, ecx
je 0x440034
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x440010
cmp dword [esp], 0
je 0x440010
mov dword [esi + 4], 3
jmp 0x440034
mov dword [esi + 4], 1
jmp 0x440069
lea eax, [esp + 0xc]
push eax
call fcn.00444cc0
add esp, 4
test al, al
je 0x440034
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x440031
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x440069
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x459b60]
call fcn.00444480
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x440107
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor ecx, ecx
xor esi, esi
nop
movzx ebx, byte [esp + esi]
mov eax, ecx
and eax, 2
mov edx, esi
xor edx, 0xad097a49
add edx, eax
mov eax, edx
and eax, ebx
add edx, ebx
add eax, eax
sub edx, eax
add dl, 0x93
mov byte [esp + esi], dl
inc esi
add ecx, 2
cmp esi, 5
jne 0x440080
mov eax, dword [esp]
mov edx, dword [0x451b4c]
test edx, edx
je 0x440107
xor esi, esi
mov ebx, dword [0x451b50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x4400e0
inc esi
cmp edx, esi
jne 0x4400d0
jmp 0x440107
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440107
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push dword [0x451b54]
push edx
call fcn.00441b10
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18