joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4234a0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x452df0]
mov edi, dword [esp]
test edi, edi
jns 0x4234cc
mov eax, 0xffffffff
jmp 0x4234cf
lea eax, [edi + edi]
push eax
call fcn.0040c7f0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x452df0]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00445ef0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44dba4]

Function at 0x425750
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425760
cmp eax, 0xffffffed
jge 0x425777
mov eax, 0xffffffff
jmp 0x42577a
add eax, 0x12
push eax
call fcn.0040c7f0
add esp, 4
mov esi, eax
mov dword [esp], 0x93399134
mov dword [esp + 4], 0x9f079d31
mov dword [esp + 8], 0x9b4c9944
mov dword [esp + 0xc], 0x87248528
mov word [esp + 0x10], 0x8180
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe4
xor cl, byte [esp + eax]
add cl, 0x8c
mov byte [esp + eax], cl
inc eax
cmp eax, 0x18
jne 0x4257c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425801
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4257f0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425831
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425820
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445ef0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44dc9c]
Function at 0x4283c0
Capabilities:
Encode data using xor
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov eax, dword [0x452df0]
mov dword [esp], 0x9de0b37
mov dword [esp + 4], 0x5fb07f9
mov dword [esp + 8], 0x1f603fb
mov dword [esp + 0xc], 0x1dee1fdf
mov dword [esp + 0x10], 0x19c61bec
mov dword [esp + 0x14], 0x159a17e7
mov dword [esp + 0x18], 0x112913eb
mov word [esp + 0x1c], 0x2f10
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
mov ecx, 0x6e11ae43
nop
nop
movzx edx, byte [esp + ecx - 0x6e11ae43]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xb1
mov byte [esp + ecx - 0x6e11ae43], dl
inc ecx
cmp ecx, 0x6e11ae67
jne 0x428420
lea edi, [esp + 0x50]
mov ecx, esp
push edi
push 0
push 0
push 0xe
push ecx
push 0
call eax
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x428469
mov eax, 0xffffffff
jmp 0x42846c
lea eax, [ebx + ebx]
push eax
call fcn.0040c7f0
add esp, 4
mov dword [esp + 0x54], eax
mov eax, dword [0x452df0]
mov dword [esp], 0x398e3bd7
mov dword [esp + 4], 0x258b27a9
mov dword [esp + 8], 0x21b6238b
mov dword [esp + 0xc], 0x2dbe2fef
mov dword [esp + 0x10], 0x29e62bbc
mov dword [esp + 0x14], 0x158a1787
mov dword [esp + 0x18], 0x11f913bb
mov word [esp + 0x1c], 0x1f10
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edx, ecx
and edx, 0xb
mov ebp, ecx
and ebp, 0x34
xor ebp, 0x3922da35
sub edx, ebp
mov ebp, esi
not ebp
or ebp, edx
add ebp, esi
or edx, esi
lea esi, [ebp*2 + 2]
not esi
add esi, ebp
inc esi
and esi, edx
mov edx, esi
and edx, 0x2f
xor esi, 0xaf
lea edx, [esi + edx*2]
add dl, 0x5a
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x24
jne 0x4284d0
push edi
push ebx
mov edi, dword [esp + 0x5c]
push edi
push 0xe
lea ebx, [esp + 0x10]
push ebx
push 0
call eax
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x42853c
mov eax, 0xffffffff
jmp 0x428543
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c7f0
add esp, 4
mov ebp, eax
mov dword [esp], 0xcf7ec964
mov dword [esp + 4], 0xc365cd6d
mov dword [esp + 8], 0xc767c15f
mov dword [esp + 0xc], 0xbb1fc55f
mov dword [esp + 0x10], 0xbfbeb92f
mov eax, 0x32
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x32]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 6
mov byte [esp + eax - 0x32], cl
inc eax
cmp eax, 0x46
jne 0x428580
movzx ecx, word [edi]
mov eax, ebp
test cx, cx
je 0x4285c1
lea edx, [edi + 2]
mov eax, ebp
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4285b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4285f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4285e0
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push ebp
call fcn.00445ef0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e30c]
Function at 0x428a90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x452df0]
mov dword [esp], 0x599d5b7f
mov dword [esp + 4], 0x5dae5fa8
mov dword [esp + 8], 0x51b55398
mov dword [esp + 0xc], 0x55b157a4
mov dword [esp + 0x10], 0x69866b6f
mov dword [esp + 0x14], 0x6d966fbc
mov dword [esp + 0x18], 0x619063e7
mov dword [esp + 0x1c], 0x659d6784
mov dword [esp + 0x20], 0x799c7b92
mov dword [esp + 0x24], 0x7d887f87
mov dword [esp + 0x28], 0x719e7398
mov dword [esp + 0x2c], 0x758077a0
mov dword [esp + 0x30], 0x9f00b85
mov dword [esp + 0x34], 0xdf20ff7
mov dword [esp + 0x38], 0x1f703f7
mov word [esp + 0x3c], 0x700
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x8f
xor dl, byte [esp + ecx]
add dl, 0x35
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x43
jne 0x428b30
lea ebp, [esp + 0x44]
mov ebx, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call eax
mov edi, dword [esp + 0x44]
test edi, edi
jns 0x428b65
mov eax, 0xffffffff
jmp 0x428b68
lea eax, [edi + edi]
push eax
call fcn.0040c7f0
add esp, 4
mov esi, eax
mov eax, dword [0x452df0]
mov dword [esp], 0x9550b37
mov dword [esp + 4], 0x5760778
mov dword [esp + 8], 0x17d0358
mov dword [esp + 0xc], 0x1d611f8c
mov dword [esp + 0x10], 0x197e1b27
mov dword [esp + 0x14], 0x156e1774
mov dword [esp + 0x18], 0x1160139f
mov dword [esp + 0x1c], 0x2d552f6c
mov dword [esp + 0x20], 0x29542ba2
mov dword [esp + 0x24], 0x25a8275f
mov dword [esp + 0x28], 0x21462358
mov dword [esp + 0x2c], 0x3db03f70
mov dword [esp + 0x30], 0x39403b4d
mov dword [esp + 0x34], 0x3542374f
mov dword [esp + 0x38], 0x31bf334f
mov word [esp + 0x3c], 0x4f30
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x83
xor dl, byte [esp + ecx]
add dl, 0x71
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x44
jne 0x428c10
push ebp
push edi
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp], 0x970e9934
mov dword [esp + 4], 0x93009519
mov dword [esp + 8], 0x8f13910c
mov dword [esp + 0xc], 0x8b148d02
mov dword [esp + 0x10], 0x87088911
mov dword [esp + 0x14], 0x83828518
mov eax, 0x48231dd9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx]
lea edi, [eax - 0x80000000]
and edi, 0x88201467
mov edx, eax
and edx, 0x40030998
or edx, edi
mov edi, ecx
and edi, 0xffffff98
mov ebp, ecx
and ebp, 0x42
or ebp, 0x8818
xor ebp, edi
and ecx, 0x25
or ecx, ebp
xor ecx, edx
mov edx, ecx
xor edx, 0xffff77e7
lea edi, [edx - 0x17506abf]
or ecx, edi
and ecx, 1
mov ebp, 0x17506abe
sub ebp, edx
mov edx, ebp
not edx
and ebp, 0x9245359f
and edi, 0x6dbaca60
or edi, ebp
and edx, 1
or edx, edi
mov edi, edx
and edi, ecx
or edx, ecx
xor edx, 0x9e
add edx, edi
mov byte [ebx], dl
inc ebx
dec eax
cmp eax, 0x48231dc1
jne 0x428c70
mov eax, esp
push 0
push 0
push eax
push esi
push dword [esp + 0x6c]
call fcn.00423490
add esp, 0x14
jmp dword [0x44e354]
Function at 0x42b7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x930e9103
mov dword [esp + 0x58], 0x9f3f9d31
mov dword [esp + 0x5c], 0x9b4c990d
mov dword [esp + 0x60], 0x871e8529
mov dword [esp + 0x64], 0x8382812d
mov dword [esp + 0x68], 0
mov eax, 0x3cb71be4
mov ecx, 0x1b
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3cb71b90]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
add esi, 0xd06c748b
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax - 0x3cb71b90], dl
inc eax
dec ecx
cmp eax, 0x3cb71bfc
jne 0x42b810
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043fca0
shr eax, 0x1f
xor edx, edx
jmp dword [eax*4 + 0x44ea7c]
Function at 0x42e3e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov eax, dword [0x452df0]
mov dword [esp + 0xc], 0x43034125
mov dword [esp + 0x10], 0x47d645d4
mov dword [esp + 0x14], 0x4beb490c
mov dword [esp + 0x18], 0x4fef4dd8
mov dword [esp + 0x1c], 0xb30eb1d5
mov dword [esp + 0x20], 0xb719b5fa
mov dword [esp + 0x24], 0xbb1fb92c
mov dword [esp + 0x28], 0xbf1fbd2c
mov dword [esp + 0x2c], 0xa3c9a104
mov dword [esp + 0x30], 0xa71aa5cf
mov dword [esp + 0x34], 0xab0fa93b
mov dword [esp + 0x38], 0xaf3dad3f
mov dword [esp + 0x3c], 0x933d9139
mov dword [esp + 0x40], 0x97f8953a
mov dword [esp + 0x44], 0x9b379900
mov dword [esp + 0x48], 0x9f9e9d30
mov byte [esp + 0x4c], 0
lea ecx, [esp + 0xc]
mov edx, 0x8f
nop
nop
nop
movzx esi, byte [ecx]
lea edi, [edx - 0x2c865f00]
or edi, esi
and esi, edx
xor esi, edi
lea ebx, [esi + esi]
not ebx
add ebx, esi
add bl, 0xd0
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x4e
jne 0x42e480
lea esi, [esp + 0x80]
lea ecx, [esp + 0xc]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x80]
test edi, edi
jns 0x42e4cb
mov eax, 0xffffffff
jmp 0x42e4ce
lea eax, [edi + edi]
push eax
call fcn.0040c7f0
add esp, 4
mov dword [esp + 0x6c], eax
mov eax, dword [0x452df0]
mov dword [esp + 0xc], 0x793d7b5f
mov dword [esp + 0x10], 0x7dee7fe8
mov dword [esp + 0x14], 0x71d57338
mov dword [esp + 0x18], 0x75d177e4
mov dword [esp + 0x1c], 0x69c66b2f
mov dword [esp + 0x20], 0x6dff6fda
mov dword [esp + 0x24], 0x61f963f8
mov dword [esp + 0x28], 0x65c167f0
mov dword [esp + 0x2c], 0x59075bc0
mov dword [esp + 0x30], 0x5df25f05
mov dword [esp + 0x34], 0x51c953c9
mov dword [esp + 0x38], 0x55c357c5
mov dword [esp + 0x3c], 0x49db4bcb
mov dword [esp + 0x40], 0x4d1c4fda
mov dword [esp + 0x44], 0x41d143c4
mov dword [esp + 0x48], 0x454647dc
mov ecx, 0x3f
mov edx, 0xc0
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ecx - 0x33]
mov ebx, edx
xor ebx, ecx
and ebx, ebp
xor ebx, ecx
add bl, 0xc5
mov byte [esp + ecx - 0x33], bl
inc ecx
dec edx
cmp ecx, 0x7f
jne case.default.0x42e5b9
push esi
push edi
mov esi, dword [esp + 0x74]
push esi
push 0x1f
lea ecx, [esp + 0x1c]
push ecx
push 0
call eax
lea eax, [esp + 0x64]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00445d50
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ed7c]
in eax, 0x42
add bl, ah
in eax, 0x42
add byte [esi + 0x42], dl
add byte [edx], cl
out 0x42, al
add byte [edx - 0x1a], al
inc edx
add al, ah
out 0x42, al
add byte [esi - 0x14], ah
inc edx
add al, dl
jmp 0x44eddd
call 0xe86aee24
inc edx
add byte [edx], dl
call 0xe872ee2c
inc edx
add dl, dh
ljmp 0x42
Function at 0x436290
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x40]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436442
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x43643c
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.0040c920
xor ebx, ebx
cmp eax, 0
je 0x436430
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 9
mov byte [esp + 0x15], 0xe3
mov byte [esp + 0x16], 0xe5
mov byte [esp + 0x17], 0xe1
mov byte [esp + 0x18], 0xf2
mov byte [esp + 0x19], 0xe2
mov byte [esp + 0x1a], 0xf1
mov byte [esp + 0x1b], 0xe7
mov byte [esp + 0x1c], 0xf0
mov byte [esp + 0x1d], 0x39
mov byte [esp + 0x1e], 0xe2
mov byte [esp + 0x1f], 0xe1
mov byte [esp + 0x20], 0xec
mov byte [esp + 0x21], 0x5b
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x13
jne 0x436363
jmp 0x436372
xor ecx, ecx
jmp 0x436376
cmp ecx, 0x13
jae 0x43640e
movzx ebx, byte [esp + ecx + 0x14]
mov edx, 0xd2698a92
sub edx, ecx
mov esi, 0xd2698a92
sub esi, ecx
mov dword [esp + 0x28], eax
mov eax, ebp
mov ebp, 0xd2698a92
sub ebp, ecx
or esi, ebp
mov ebp, 0xd2698a92
sub ebp, ecx
or edx, ebp
and edx, esi
mov esi, edx
xor esi, ebx
xor esi, 0xffffffff
mov ebp, ebx
xor ebp, 0xffffffff
and edx, ebp
mov ebp, eax
mov eax, dword [esp + 0x28]
or edx, esi
mov esi, edx
shl esi, 1
xor esi, 0xffffffff
add edx, esi
mov esi, ebx
shl esi, 1
xor esi, 0xffffffff
add esi, ebx
mov ebx, 0xd2698a92
sub ebx, ecx
and esi, ebx
or edx, esi
mov ebx, 0x9bb5e8bb
sub ebx, edx
mov esi, ebx
shl esi, 1
and esi, 0x44
mov edx, ebx
xor edx, 0x22
add edx, esi
mov esi, dword [esp + 0x40]
shl ebx, 1
and ebx, 2
xor edx, 1
add edx, ebx
mov byte [esp + ecx + 0x14], dl
add ecx, 1
jmp 0x436376
lea edx, [esp + 0x14]
mov ecx, esi
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040d630
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x43642e
jmp 0x436430
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x72
xor cl, byte [esp + eax]
add cl, 0xc6
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43c2a0
mov eax, dword [esp]
mov ecx, dword [0x452df4]
test ecx, ecx
je 0x43c302
xor edx, edx
mov esi, dword [0x452df8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xd518dba1
je 0x43c2e0
inc edx
cmp ecx, edx
jne 0x43c2d0
jmp 0x43c302
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43c302
lea eax, [esp + 0xc]
push eax
push 8
push 0xffffffffffffffff
push 3
push dword [0x452dfc]
push ecx
call fcn.00442cc0
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x43c3de
mov ecx, dword [esp + 0xc]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
nop
nop
mov eax, ebx
add al, 0x72
xor al, byte [esp + ebx]
add al, 0xc6
mov byte [esp + ebx], al
inc ebx
cmp ebx, 6
jne 0x43c320
mov eax, dword [esp]
mov edx, dword [0x452df4]
test edx, edx
je 0x43c368
xor esi, esi
mov edi, dword [0x452df8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xd1a85eee
je 0x43c360
inc esi
cmp edx, esi
jne 0x43c350
jmp 0x43c368
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43c3e7
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x72
xor bl, byte [esp + edx]
add bl, 0xc6
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x43c380
test eax, eax
setns bl
mov eax, dword [0x452df4]
test eax, eax
je 0x43c3da
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x452df8]
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x43c3c0
inc esi
cmp eax, esi
jne 0x43c3b0
jmp 0x43c3da
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x43c3da
push ecx
push 1
push dword [0x452dfc]
push eax
call fcn.00442cc0
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
ret
mov eax, esp
lea esi, [esp + 0x10]
push eax
push 4
push esi
push 0x14
push ecx
push 5
push dword [0x452dfc]
push edx
call fcn.00442cc0
add esp, 0x20
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
setne byte [esp + 0xb]
jmp 0x43c368
Function at 0x43cad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00445d50
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4504a0]

Function at 0x43ccf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.004464b0
add esp, 0x14
test eax, eax
js 0x43ce26
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004468b0
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43cd8f
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43cd62
mov eax, 0xffffffff
jmp 0x43cd64
add eax, eax
push eax
call fcn.0040c7f0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00446ee0
add esp, 0x14
test eax, eax
jns 0x43cd8f
push esi
call fcn.0040c800
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x4c4d4a4b
mov word [esp + 8], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x72
xor cl, byte [esp + ebx + 4]
add cl, 0xc6
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 6
jne 0x43cdb0
mov ecx, dword [0x452df4]
test ecx, ecx
je 0x43ce0a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x452df8]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43cdf0
inc edi
cmp ecx, edi
jne 0x43cde0
jmp 0x43ce0a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43ce0a
push eax
push 1
push dword [0x452dfc]
push ecx
call fcn.00442cc0
add esp, 0x10
test esi, esi
jne 0x43ce28
lea eax, [esp + 4]
push eax
call fcn.00445b20
add esp, 4
test al, al
je 0x43ce26
cmp dword [esp + 4], 1
je 0x43ce28
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fba0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]

Function at 0x43fca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x72
xor cl, byte [esp + eax]
add cl, 0xc6
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43fcd0
mov edi, dword [esp]
mov eax, dword [0x452df4]
test eax, eax
je 0x43fd36
xor ecx, ecx
mov edx, dword [0x452df8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43fd10
inc ecx
cmp eax, ecx
jne 0x43fd00
jmp 0x43fd36
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43fd36
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x452dfc]
push eax
call fcn.00442cc0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43fe45
push dword [esp + 0xc]
call fcn.0043fba0
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0x72
xor cl, byte [esp + edx]
add cl, 0xc6
mov byte [esp + edx], cl
inc edx
cmp edx, 6
jne 0x43fd70
mov edi, dword [esp]
mov edx, dword [0x452df4]
test edx, edx
je 0x43fddc
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x452df8]
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43fdb2
inc ebp
cmp edx, ebp
jne 0x43fda0
mov ebp, ecx
jmp 0x43fddc
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43fddc
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x452dfc]
push edx
mov esi, eax
call fcn.00442cc0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43fe3c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43fe15
add edi, 2
cmp si, bp
je 0x43fe00
cmp si, bp
je 0x43fe27
mov esi, dword [ecx]
test esi, esi
jne 0x43fdf0
mov edi, 0xc0000225
jmp 0x43fe3c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043fc00
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43fe80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43ff37
xor eax, eax
cmp dword [ecx], 0
jne 0x43ffb0
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x72
xor bl, byte [esp + eax]
add bl, 0xc6
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x43fef0
mov eax, dword [esp]
mov esi, dword [0x452df4]
test esi, esi
je 0x43ffb0
xor edi, edi
mov ebx, dword [0x452df8]
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43ffb9
inc edi
cmp esi, edi
jne 0x43ff20
jmp 0x43ffb0
mov dword [esp + 8], 0xe92a2b2c
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
lea ecx, [eax + eax]
mov esi, eax
xor esi, 0x4119d707
lea esi, [esi + eax*2]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, 0x49f35d74
and edx, 0xffffff8b
or edx, edi
mov edi, esi
not edi
or edi, 0xb60ca28b
lea ebx, [edi + esi]
inc ebx
and esi, 0x14
xor esi, 0x8e20874
or ebx, esi
mov esi, edx
and esi, ebx
add ebx, edx
add esi, esi
sub ebx, esi
add bl, 0xdd
mov byte [esp + eax + 8], bl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 8
jb 0x43ff50
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ffb0
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x452dfc]
push esi
call fcn.00442cc0
add esp, 0x1c
jmp 0x43ffb0

Function at 0x43fff0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x44007a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor edx, edx
mov ebx, edx
add bl, 0x72
xor bl, byte [esp + edx]
add bl, 0xc6
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x440010
mov edx, dword [0x452df4]
test edx, edx
je 0x44006e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x452df8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x440050
inc edi
cmp edx, edi
jne 0x440040
jmp 0x44006e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44006e
push eax
push 1
push dword [0x452dfc]
push edx
mov esi, ecx
call fcn.00442cc0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret