joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425d80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
xor ebp, ebp
nop
nop
nop
nop
nop
nop
cmp byte [ebx + ebp], 0
lea ebp, [ebp + 1]
jne 0x425da0
push ebp
call fcn.00408a60
add esp, 4
mov esi, eax
mov dword [esp + 8], edi
mov dword [edi], eax
mov ecx, ebp
shr ecx, 2
mov eax, ebx
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebp
and edx, 0xfffffffc
add esi, edx
add edx, ebx
mov eax, ebp
not eax
or eax, 3
add eax, ebp
inc eax
mov ecx, eax
shr ecx, 1
mov dword [esp + 4], edx
mov dword [esp], esi
mov edi, esi
mov esi, dword [esp + 4]
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test al, 1
je 0x425e03
and eax, 0xfffffffe
movzx ecx, byte [edx + eax]
mov edx, dword [esp]
mov byte [edx + eax], cl
xor edx, edx
cmp ebp, 1
je 0x425ed9
mov eax, 1
sub eax, ebp
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx]
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
not ecx
mov esi, ecx
or esi, 1
sub ecx, esi
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
not ecx
mov edx, ecx
or edx, 1
sub ecx, edx
and ecx, 0xedb88320
mov edx, ecx
xor edx, esi
inc ebx
inc eax
jne 0x425e20
not edx
mov eax, dword [esp + 8]
mov dword [eax + 4], edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42dc80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
call fcn.00413c20
sub esp, 0x10
mov esi, esp
jmp 0x42dc98
call fcn.00413c20
push eax
mov dword [ebp - 0x1c], esp
jmp 0x42dca3
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x42dcbd
xor ebx, ebx
test al, 1
jne 0x42dcc8
jmp 0x42de80
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
jmp 0x42dcfa
jmp 0x42dcfc
xor ebx, ebx
test cl, 1
jne 0x42dd08
jmp 0x42de78
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00428d20
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42de67
mov ecx, eax
and ecx, 1
shl ecx, 1
mov dword [ebp - 0x20], eax
mov ebx, eax
xor ebx, 1
add ebx, ecx
sub esp, 4
mov dword [esp], ebx
call fcn.00408a60
add esp, 4
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00420a10
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov esi, dword [ebp - 0x18]
mov byte [esi], 0x49
mov byte [esi + 1], 0x33
mov byte [esi + 2], 0x2d
mov byte [esi + 3], 0x31
mov byte [esi + 4], 0x22
mov byte [esi + 5], 0x32
mov byte [esi + 6], 0x21
mov byte [esi + 7], 0x3f
mov byte [esi + 8], 0x20
mov byte [esi + 9], 0x79
mov byte [esi + 0xa], 0x32
mov byte [esi + 0xb], 0x31
mov byte [esi + 0xc], 0x34
mov byte [esi + 0xd], 0x8b
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x42ddb4
xor eax, eax
cmp eax, 0x10
jae 0x42de2c
movzx ecx, byte [esi + eax]
mov edx, eax
add edx, 0xaeadcc61
mov esi, edx
and esi, ecx
shl esi, 1
mov ebx, edx
sub ebx, esi
add ebx, ecx
xor ebx, 0xffffffff
mov esi, edx
and esi, ebx
mov ebx, esi
and ebx, 2
xor ebx, 2
mov edi, esi
and edi, 0xfffffffd
imul edi, ebx
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
add esi, edi
mov edi, dword [ebp + 8]
sub esi, edx
mov edx, esi
xor edx, ecx
xor esi, 0xffffffff
and ecx, esi
mov esi, dword [ebp - 0x18]
shl ecx, 1
sub ecx, edx
add cl, 0x1b
mov byte [esi + eax], cl
mov ecx, eax
shl ecx, 1
and ecx, 2
xor eax, 1
add eax, ecx
jmp 0x42ddc2
sub esp, 0xc
mov ecx, edi
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.00409950
mov bl, al
and bl, 1
mov eax, dword [ebp - 0x14]
jmp 0x42de51
jmp 0x42de53
jmp 0x42de55
jmp 0x42de57
sub esp, 4
mov dword [esp], eax
call fcn.00408a70
add esp, 4
jmp 0x42de67
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42de78
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42de80
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043cdc0
add esp, 0x14
test eax, eax
js 0x433c03
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043d1d0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x433b69
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x433b35
mov eax, 0xffffffff
jmp 0x433b3c
lea eax, [eax*2 + 2]
push eax
call fcn.00408a60
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.0043d7e0
add esp, 0x14
test eax, eax
js 0x433b60
mov esi, edi
jmp 0x433b69
push edi
call fcn.00408a70
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp], 0x94959a9b
mov ecx, 0x7d825c66
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x7d825c66]
xor edx, ecx
mov edi, 0xfe
sub edi, edx
not edx
and edx, 1
or edi, 1
sub edx, edi
mov byte [esp + ecx - 0x7d825c66], dl
inc ecx
cmp ecx, 0x7d825c6a
jne 0x433b80
mov ecx, dword [0x449620]
test ecx, ecx
je 0x433bea
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x449624]
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x433bd0
inc edi
cmp ecx, edi
jne 0x433bc0
jmp 0x433bea
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x433bea
push eax
push 1
push ecx
push dword [0x449628]
call fcn.00438b80
add esp, 0x10
test esi, esi
jne 0x433c05
mov eax, esp
push eax
call fcn.0043c4e0
add esp, 4
test al, al
je 0x433c03
cmp dword [esp], 1
je 0x433c05
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4358e0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp], 0xe9eaebd4
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x4cfe5163
movzx edx, byte [esp + ecx - 0x4cfe5163]
lea esi, [ecx - 0x4cfe50bc]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx - 0x4cfe5163], dl
inc ecx
cmp ecx, 0x4cfe516a
jne 0x435900
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x451644]
add esp, 8
pop esi
ret
Function at 0x435a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x94959a9b
mov eax, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 0x40]
and edx, 0x27
mov ecx, eax
and ecx, 0x48
or ecx, edx
xor cl, byte [esp + eax - 0x66]
add cl, 2
mov byte [esp + eax - 0x66], cl
inc eax
cmp eax, 0x6a
jne 0x435a30
mov eax, dword [esp]
mov esi, dword [0x449620]
test esi, esi
je 0x435aa4
xor ecx, ecx
mov edx, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x435a80
inc ecx
cmp esi, ecx
jne 0x435a70
jmp 0x435aa4
mov edx, dword [edx + ecx*8 + 4]
cmp edx, eax
je 0x435aa4
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push edx
push dword [0x449628]
call fcn.00438b80
add esp, 0x1c
mov dword [esp + 0x10], eax
mov dword [esp], 0x591a1b10
mov dword [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov ebp, eax
and ebp, 6
mov edx, ecx
xor edx, 0x50c80e04
sub edx, ebp
xor edx, esi
mov ebp, edx
not ebp
and ebp, 1
mov esi, 1
sub esi, edx
not esi
and edx, 0xfe
mov edi, 0x17
sub edi, edx
or esi, 0xfe
and esi, edi
lea edx, [esi + ebp*2]
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 8
jne 0x435ac0
mov edi, dword [esp + 0x10]
cmp edi, dword [esp]
jne 0x435c15
push dword [esp + 8]
call fcn.004358e0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0x94959a9b
mov esi, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edi, [esi - 0x40]
and edi, 0x27
mov edx, esi
and edx, 0x48
or edx, edi
xor dl, byte [esp + esi - 0x66]
add dl, 2
mov byte [esp + esi - 0x66], dl
inc esi
cmp esi, 0x6a
jne 0x435b40
mov edi, dword [esp]
mov edx, dword [0x449620]
test edx, edx
je 0x435bb5
xor ebp, ebp
mov esi, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x435b90
inc ebp
cmp edx, ebp
jne 0x435b80
jmp 0x435bb5
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x435bb5
push 0
push ecx
push eax
push 5
push 4
push edx
push dword [0x449628]
mov esi, eax
call fcn.00438b80
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x435c0c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x435be5
add edi, 2
cmp si, bp
je 0x435bd0
cmp si, bp
je 0x435bf7
mov esi, dword [ecx]
test esi, esi
jne 0x435bc0
mov edi, 0xc0000225
jmp 0x435c0c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00435950
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x435c50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x435d10
xor eax, eax
cmp dword [ecx], 0
jne 0x435d64
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x94959a9b
mov eax, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 0x40]
and esi, 0x27
mov ebx, eax
and ebx, 0x48
or ebx, esi
xor bl, byte [esp + eax - 0x66]
add bl, 2
mov byte [esp + eax - 0x66], bl
inc eax
cmp eax, 0x6a
jne 0x435cc0
mov eax, dword [esp]
mov esi, dword [0x449620]
test esi, esi
je 0x435d64
xor edi, edi
mov ebx, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x435d6d
inc edi
cmp esi, edi
jne 0x435d00
jmp 0x435d64
mov dword [esp + 4], 0x37767960
mov dword [esp + 8], 0
mov eax, 0x1eb407a7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1eb407a3]
lea edx, [eax - 0x1eb40791]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x1eb407a3], cl
inc eax
cmp eax, 0x1eb407af
jne 0x435d30
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x435d64
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x449628]
call fcn.00438b80
add esp, 0x1c
jmp 0x435d64

Function at 0x435da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x435e3a
push ebx
push edi
push esi
push eax
mov dword [esp], 0x94959a9b
mov edx, 0x66
nop
nop
nop
nop
nop
nop
lea esi, [edx - 0x40]
and esi, 0x27
mov ebx, edx
and ebx, 0x48
or ebx, esi
xor bl, byte [esp + edx - 0x66]
add bl, 2
mov byte [esp + edx - 0x66], bl
inc edx
cmp edx, 0x6a
jne 0x435dc0
mov edx, dword [0x449620]
test edx, edx
je 0x435e2e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x435e10
inc edi
cmp edx, edi
jne 0x435e00
jmp 0x435e2e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x435e2e
push eax
push 1
push edx
push dword [0x449628]
mov esi, ecx
call fcn.00438b80
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x436360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x436379
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x43638a
cmp eax, 2
je 0x4363fc
jmp 0x436429
push 0xbbf966b4
push dword [0x449614]
call fcn.0043bcb0
add esp, 8
test eax, eax
je 0x4363c7
mov ecx, dword [esi]
test ecx, ecx
je 0x4363f4
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x4363d0
cmp dword [esp], 0
je 0x4363d0
mov dword [esi + 4], 3
jmp 0x4363f4
mov dword [esi + 4], 1
jmp 0x436429
lea eax, [esp + 4]
push eax
call fcn.0043c4e0
add esp, 4
test al, al
je 0x4363f4
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x4363f1
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x436429
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x45163c]
call fcn.0043bcb0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x4364b4
mov ecx, dword [esi]
mov dword [esp], 0x94959a9b
mov eax, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 0x40]
and esi, 0x27
mov edx, eax
and edx, 0x48
or edx, esi
xor dl, byte [esp + eax - 0x66]
add dl, 2
mov byte [esp + eax - 0x66], dl
inc eax
cmp eax, 0x6a
jne 0x436440
mov eax, dword [esp]
mov edx, dword [0x449620]
test edx, edx
je 0x4364b4
xor esi, esi
mov ebx, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x436490
inc esi
cmp edx, esi
jne 0x436480
jmp 0x4364b4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x4364b4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push edx
push dword [0x449628]
call fcn.00438b80
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43a3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43a452
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43a57e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43a57e
mov dword [esp], 0x585b5a45
mov dword [esp + 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x8f
xor cl, byte [esp + eax]
add cl, 0x35
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x43a470
mov eax, dword [esp]
mov ecx, dword [0x449620]
test ecx, ecx
je 0x43a4e2
xor edx, edx
mov edi, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43a4b4
inc edx
cmp ecx, edx
jne 0x43a4a0
mov edi, dword [esp + 0x24]
jmp 0x43a4e2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x43a4e2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x449628]
call fcn.00438b80
add esp, 0x28
test eax, eax
js 0x43a57e
push 0x732f71fd
push dword [0x45163c]
call fcn.0043bcb0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x585b5a45
mov dword [esp + 4], 0
xor edx, edx
mov ebx, edx
add bl, 0x8f
xor bl, byte [esp + edx]
add bl, 0x35
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x43a520
mov edx, dword [0x449620]
test edx, edx
je 0x43a57e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x449624]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43a560
inc edi
cmp edx, edi
jne 0x43a550
jmp 0x43a57e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a57e
push ecx
push 1
push edx
push dword [0x449628]
mov esi, eax
call fcn.00438b80
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp], 0x93922b25
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x64
xor dl, byte [esp + ecx]
add dl, 0xc
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne case.default.0x43bcee
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446d84]
mov edx, dword [ebp + 0x3c]
jmp dword [0x446d8c]
mov eax, dword [ebp + edx]
mov dword [esp], 0x292ae0d4
mov dword [esp + 4], 0
mov edi, 0x4ae447f7
mov esi, 0xb51bb808
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x4ae447f7]
mov ecx, edi
and ecx, ebx
add ecx, ecx
sub ecx, ebx
add ecx, esi
and ecx, edi
add cl, cl
sub bl, cl
movzx ecx, bl
add ecx, edi
add cl, 0x2d
mov byte [esp + edi - 0x4ae447f7], cl
inc edi
dec esi
cmp edi, 0x4ae447ff
jne 0x43bef0
jmp dword [0x446d98]
mov dword [esp], 0x292ae0d4
mov dword [esp + 4], 0
mov esi, 0x4ae447f7
mov ecx, 0xb51bb808
movzx ebx, byte [esp + esi - 0x4ae447f7]
mov eax, esi
and eax, ebx
add eax, eax
sub eax, ebx
add eax, ecx
and eax, esi
add al, al
sub bl, al
movzx eax, bl
add eax, esi
add al, 0x2d
mov byte [esp + esi - 0x4ae447f7], al
inc esi
dec ecx
cmp esi, 0x4ae447ff
jne 0x43bf40
jmp case.0x43bcee.1
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c550
sar eax, 1
lea edi, [eax + 4]
and eax, 1
mov ecx, edi
or ecx, 1
add ecx, eax
jns 0x43c573
mov ecx, 0xffffffff
jmp 0x43c575
add ecx, ecx
push ecx
call fcn.00408a60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43c5c1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43c5b0
mov word [ecx], 0
lea ecx, [edi + edi]
mov word [esp + 8], cx
lea ecx, [edi*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov ecx, 0x95408738
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6abf78c8]
xor edx, ecx
mov esi, edx
and esi, 0x67
xor edx, 0xe7
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x6abf78c8], dl
inc ecx
cmp ecx, 0x95408740
jne 0x43c630
mov esi, dword [esp]
mov ecx, dword [0x449620]
test ecx, ecx
je 0x43c6bf
xor edx, edx
mov edi, dword [0x449624]
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43c680
inc edx
cmp ecx, edx
jne 0x43c670
jmp 0x43c6bf
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43c6bf
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0xb
push ecx
push dword [0x449628]
mov edi, eax
call fcn.00438b80
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408a70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c700
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43c71b
mov eax, 0xffffffff
jmp 0x43c71e
add eax, 0xa
push eax
call fcn.00408a60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43c761
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43c750
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov ecx, 0x95408738
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6abf78c8]
xor edx, ecx
mov esi, edx
and esi, 0x67
xor edx, 0xe7
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x6abf78c8], dl
inc ecx
cmp ecx, 0x95408740
jne 0x43c7e0
mov esi, dword [esp]
mov ecx, dword [0x449620]
test ecx, ecx
je 0x43c864
xor edx, edx
mov ebx, dword [0x449624]
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43c830
inc edx
cmp ecx, edx
jne 0x43c820
jmp 0x43c864
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43c864
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x449628]
mov edi, eax
call fcn.00438b80
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408a70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret