joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41ef20
cmp eax, 0xffffffed
jge 0x41ef37
mov eax, 0xffffffff
jmp 0x41ef3a
add eax, 0x12
push eax
call fcn.0040c880
add esp, 4
mov esi, eax
mov dword [esp], 0x21b32740
mov dword [esp + 4], 0x5da923bf
mov dword [esp + 8], 0x59085f10
mov dword [esp + 0xc], 0x55385bc4
mov word [esp + 0x10], 0x5754
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x2b1d16b9
nop
nop
nop
movzx ecx, byte [esp + eax - 0x2b1d16b9]
xor ecx, eax
mov edx, ecx
xor edx, 0xd791719e
and ecx, 0x280c0661
add ecx, ecx
sub ecx, edx
mov edx, ecx
and edx, 1
mov ebx, ecx
or ebx, 0xfe
not ecx
or ecx, 1
and ecx, ebx
not ecx
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x2b1d16b9], cl
inc eax
cmp eax, 0x2b1d16d0
jne 0x41ef80
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41eff1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41efe0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41f021
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41f010
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043dcd0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x443f98]
Function at 0x427e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x427e7a
cmp edi, 1
je 0x427e7a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x427e51
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x427e50
cmp ecx, 0x20
je 0x427e50
cmp ecx, 0x2b
mov edx, edi
je 0x427e70
cmp ecx, 0x2d
jne 0x427e8f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x427e94
xor edi, edi
test eax, eax
je 0x42804d
mov dword [eax], 0x16
jmp 0x42804d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x427ebd
cmp edx, 0x10
jne 0x427ed5
cmp byte [ebx], 0x30
jne 0x427eb6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x427ed7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x427ed7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x427f30
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x427fe8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x427f57
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x428018
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x428018
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x427f10
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x427fa0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x427fa9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x427fcd
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x427ffd
test bl, bl
jne 0x427ffd
mov ebx, dword [esp + 0x10]
jmp 0x427f23
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x427f05
mov esi, edi
test bl, bl
jne 0x42800b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x427f05
mov eax, dword [esp + 0x38]
test eax, eax
je 0x428026
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x428034
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x428044
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42804d
cmp byte [esp + 3], 0
jne 0x42804d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ad70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42aea1
mov eax, dword [esp + 0x18]
mov edx, eax
not edx
lea edx, [edx + eax*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test edx, edx
je 0x42aea1
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42adc0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x42ae50
cmp ebx, 0x7ff
ja 0x42adf0
cmp edx, 2
jb 0x42adf0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x42ae50
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x42ae66
cmp edx, 4
jb 0x42ae66
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
mov edi, ebx
or edi, 0x3f
xor ebx, 0xc0
and ebx, edi
add bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
jne 0x42ada0
jmp 0x42aea1
movzx eax, ax
cmp eax, 0xdc00
jne 0x42ae74
mov esi, edi
jmp 0x42ae58
cmp edx, 3
jb 0x42ae9d
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x42ae50
mov eax, ebp
jmp 0x42ae50
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42fdf0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x42fe16
xor ebx, ebx
test al, 1
jne 0x42fe21
jmp 0x42ffe5
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x42fe4d
cmp eax, 0
setne cl
jmp 0x42fe55
xor ebx, ebx
test cl, 1
jne 0x42fe61
jmp 0x42ffdf
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042ad00
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42ffd0
mov dword [ebp - 0x2c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040c880
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042ad70
add esp, 0xc
mov al, byte [edi]
mov byte [ebp - 0x10], al
mov byte [ebp - 0x24], 0xdf
mov byte [ebp - 0x23], 0xb5
mov byte [ebp - 0x22], 0xb7
mov byte [ebp - 0x21], 0xaf
mov byte [ebp - 0x20], 0xba
mov byte [ebp - 0x1f], 0xae
mov byte [ebp - 0x1e], 0x43
mov byte [ebp - 0x1d], 0x55
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x13
mov byte [ebp - 0x1a], 0x52
mov byte [ebp - 0x19], 0x5f
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x17], 0xe5
mov eax, 0xe
mov byte [ebp + eax - 0x24], 0
add eax, 1
cmp eax, 0x13
jne 0x42fef9
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x13
jae 0x42ff9b
movzx esi, byte [ebp + eax - 0x24]
mov edx, eax
add edx, 0x7a
and edx, esi
mov edi, edx
and edi, 0xfd
mov ecx, edx
and ecx, 2
xor ecx, 2
imul ecx, edi
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
add edx, ecx
mov ebx, eax
add ebx, 0xb732377a
add ebx, esi
mov esi, ebx
xor esi, 0xffffffff
mov edi, edx
and edi, esi
xor edx, 0xffffffff
and ebx, edx
sub ebx, edi
mov edi, ebx
shl edi, 1
and edi, 0xd809d53a
mov esi, ebx
xor esi, 0x6c04ea9d
mov edx, esi
add edx, edi
shl esi, 1
and esi, 2
and ebx, 1
mov edi, edx
and edi, 0xfe
or ebx, edi
and edx, esi
shl edx, 1
xor ebx, esi
mov ecx, dword [ebp + 8]
add ebx, edx
mov byte [ebp + eax - 0x24], bl
add eax, 0x1fa92e57
jmp 0x42ff0b
lea eax, [ebp - 0x24]
sub esp, 0xc
mov dword [esp], eax
mov esi, dword [ebp - 0x28]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
call fcn.0040d260
mov bl, al
and bl, 1
jmp 0x42ffbe
sub esp, 4
mov dword [esp], esi
call fcn.0040c890
add esp, 4
jmp 0x42ffce
jmp 0x42ffd0
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435280
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043e260
add esp, 0x14
test eax, eax
js 0x4353e5
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043e650
add esp, 0x24
xor esi, esi
mov edi, 0
test eax, eax
js 0x435321
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
add ecx, 0x8081ab7f
jns 0x4352ef
mov eax, 0xffffffff
jmp 0x4352f6
lea eax, [eax*2 + 0x10356fe]
push eax
call fcn.0040c880
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.0043ec50
add esp, 0x14
test eax, eax
jns 0x435321
push edi
call fcn.0040c890
add esp, 4
xor edi, edi
mov dword [esp + 8], edi
mov eax, dword [esp + 4]
mov dword [esp], 0x282b2a25
mov ecx, esp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx]
mov edi, esi
and edi, 0x2f32cf72
mov edx, ebp
xor edx, 0xe8669846
sub edx, edi
inc edx
mov edi, ebx
and edi, edx
add edi, edi
sub edx, edi
add dl, bl
add dl, 0x9d
mov byte [ecx], dl
inc ecx
dec ebp
add esi, 0xfffffffe
cmp ebp, 0xfffffffc
jne 0x435340
mov ecx, dword [0x448e64]
test ecx, ecx
je 0x4353c4
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x448e68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4353aa
mov esi, edi
and esi, 1
xor edi, 1
lea edi, [edi + esi*2]
cmp edi, ecx
jb 0x435390
jmp 0x4353c4
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4353c4
push eax
push 1
push ecx
push dword [0x448e6c]
call fcn.0043a3b0
add esp, 0x10
mov eax, dword [esp + 8]
test eax, eax
jne 0x4353e7
mov esi, eax
mov eax, esp
push eax
call fcn.0043d910
add esp, 4
test al, al
je 0x4353e5
mov eax, esi
cmp dword [esp], 1
je 0x4353e7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436f00
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp], 0x41464794
mov dword [esp + 4], 0
mov ecx, 0xb47b9091
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x4b846f6f]
xor edx, ecx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0xd6
mov byte [esp + ecx + 0x4b846f6f], dl
inc ecx
cmp ecx, 0xb47b9099
jne 0x436f20
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x450e88]
add esp, 8
pop esi
ret
Function at 0x437230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x437330
xor eax, eax
cmp dword [ecx], 0
jne 0x43736a
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x282b2a25
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
mov edx, eax
xor edx, 0xe8669847
lea esi, [edx + eax*2]
mov edi, ebx
and edi, esi
mov edx, edi
and edx, 2
mov ebp, edi
or edi, 2
imul edi, edx
xor edx, 2
and ebp, 0x4d
imul ebp, edx
add edi, ebp
mov edx, edi
xor edx, esi
not esi
and esi, edi
add esi, esi
sub edx, esi
add dl, bl
add dl, 0x79
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
mov esi, eax
and esi, 2
mov edi, eax
xor edi, 1
add edi, eax
mov eax, edi
sub eax, esi
and edi, edx
or eax, edx
add eax, edi
cmp eax, 4
jb 0x4372a0
mov eax, dword [esp]
mov esi, dword [0x448e64]
test esi, esi
je 0x43736a
xor edx, edx
mov edi, dword [0x448e68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xef01f5a1
je 0x437374
inc edx
cmp esi, edx
jne 0x437320
jmp 0x43736a
mov dword [esp + 4], 0xa166677c
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x69
xor cl, byte [esp + eax + 4]
add cl, 0xf3
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne 0x437350
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [edi + edx*8 + 4]
cmp esi, eax
je 0x43736a
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push dword [esp + 0x40]
push ecx
push 4
push esi
push dword [0x448e6c]
call fcn.0043a3b0
add esp, 0x1c
jmp 0x43736a

Function at 0x4373b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43748e
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x282b2a25
xor edx, edx
nop
nop
movzx ebx, byte [esp + edx]
mov eax, edx
xor eax, 0xe8669847
lea esi, [eax + edx*2]
mov edi, ebx
and edi, esi
mov eax, edi
and eax, 2
mov ebp, edi
or edi, 2
imul edi, eax
xor eax, 2
and ebp, 0x4d
imul ebp, eax
add edi, ebp
mov eax, edi
xor eax, esi
not esi
and esi, edi
add esi, esi
sub eax, esi
add al, bl
add al, 0x79
mov byte [esp + edx], al
mov eax, edx
and eax, 1
mov esi, edx
and esi, 2
mov edi, edx
xor edi, 1
add edi, edx
mov edx, edi
sub edx, esi
and edi, eax
or edx, eax
add edx, edi
cmp edx, 4
jb 0x4373d0
mov edx, dword [0x448e64]
test edx, edx
je 0x437481
mov esi, dword [esp]
xor eax, eax
mov edi, dword [0x448e68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + eax*8], 0xb62b8d10
je 0x437460
inc eax
cmp edx, eax
jne 0x437450
jmp 0x437481
mov eax, dword [edi + eax*8 + 4]
cmp eax, esi
je 0x437481
push dword [esp + 4]
push 1
push eax
push dword [0x448e6c]
mov esi, ecx
call fcn.0043a3b0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437720
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebp, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4377aa
push 0xbbf966b4
push dword [0x448e58]
call fcn.0043cfb0
add esp, 8
test eax, eax
je 0x437771
mov ecx, dword [esi]
test ecx, ecx
je 0x4377a7
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x437783
cmp dword [esp], 0
je 0x437783
mov dword [esi + 4], 3
jmp 0x4377a7
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jmp 0x437867
lea eax, [esp + 8]
push eax
call fcn.0043d910
add esp, 4
test al, al
je 0x4377a7
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x4377a4
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 4], ecx
cmp eax, 2
jne 0x437867
mov dword [esp], 0x282b2a25
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
mov ecx, eax
xor ecx, 0xe8669847
lea esi, [ecx + eax*2]
mov edx, ebx
and edx, esi
mov ecx, edx
and ecx, 2
mov edi, edx
or edx, 2
imul edx, ecx
xor ecx, 2
and edi, 0x4d
imul edi, ecx
add edx, edi
mov ecx, edx
xor ecx, esi
not esi
and esi, edx
add esi, esi
sub ecx, esi
add cl, bl
add cl, 0x79
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
mov edx, eax
and edx, 2
mov esi, eax
xor esi, 1
add esi, eax
mov eax, esi
sub eax, edx
and esi, ecx
or eax, ecx
add eax, esi
cmp eax, 4
jb 0x4377d0
mov eax, dword [esp]
mov edx, dword [0x448e64]
test edx, edx
je 0x43792a
xor ecx, ecx
mov esi, dword [0x448e68]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xc3cdc4a6
je 0x437900
inc ecx
cmp edx, ecx
jne 0x437850
jmp 0x43792a
mov dword [esp], 0x282b2a25
xor eax, eax
movzx edx, byte [esp + eax]
mov ecx, eax
xor ecx, 0xe8669847
lea esi, [ecx + eax*2]
mov ebx, edx
and ebx, esi
mov ecx, ebx
and ecx, 2
mov edi, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and edi, 0x4d
imul edi, ecx
add ebx, edi
mov ecx, ebx
xor ecx, esi
not esi
and esi, ebx
add esi, esi
sub ecx, esi
add cl, dl
add cl, 0x79
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
mov edx, eax
and edx, 2
mov esi, eax
xor esi, 1
add esi, eax
mov eax, esi
sub eax, edx
and esi, ecx
or eax, ecx
add eax, esi
cmp eax, 4
jb 0x437870
mov eax, dword [esp]
mov edx, dword [0x448e64]
test edx, edx
je 0x43792a
xor ecx, ecx
mov esi, dword [0x448e68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xae6e2b0b
je 0x437900
inc ecx
cmp edx, ecx
jne 0x4378f0
jmp 0x43792a
mov edx, dword [esi + ecx*8 + 4]
cmp edx, eax
je 0x43792a
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x14]
push 5
push edx
push dword [0x448e6c]
call fcn.0043a3b0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x437ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x437cf9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x437d0a
cmp eax, 2
je 0x437d7c
jmp 0x437da9
push 0xbbf966b4
push dword [0x448e58]
call fcn.0043cfb0
add esp, 8
test eax, eax
je 0x437d47
mov ecx, dword [esi]
test ecx, ecx
je 0x437d74
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x437d50
cmp dword [esp], 0
je 0x437d50
mov dword [esi + 4], 3
jmp 0x437d74
mov dword [esi + 4], 1
jmp 0x437da9
lea eax, [esp + 0xc]
push eax
call fcn.0043d910
add esp, 4
test al, al
je 0x437d74
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x437d71
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x437da9
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x450e80]
call fcn.0043cfb0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x437e77
mov dword [esp + 8], edi
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp], 0x282b2a25
xor eax, eax
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
mov ecx, eax
xor ecx, 0xe8669847
lea esi, [ecx + eax*2]
mov edx, ebx
and edx, esi
mov edi, edx
and edi, 2
mov ecx, edx
or edx, 2
imul edx, edi
xor edi, 2
and ecx, 0x4d
imul ecx, edi
add edx, ecx
mov ecx, edx
xor ecx, esi
not esi
and esi, edx
add esi, esi
sub ecx, esi
add cl, bl
add cl, 0x79
mov byte [esp + eax], cl
mov ecx, eax
mov edx, eax
and edx, 2
mov esi, eax
xor esi, 1
add esi, eax
mov eax, esi
sub eax, edx
and ecx, 1
and esi, ecx
or eax, ecx
add eax, esi
cmp eax, 4
jb 0x437dc0
mov eax, dword [esp]
mov edx, dword [0x448e64]
test edx, edx
je 0x437e77
xor ecx, ecx
mov esi, dword [0x448e68]
mov edi, dword [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xfd743ac4
je 0x437e50
inc ecx
cmp edx, ecx
jne 0x437e40
jmp 0x437e77
mov ecx, dword [esi + ecx*8 + 4]
cmp ecx, eax
je 0x437e77
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x14]
push 5
push ecx
push dword [0x448e6c]
call fcn.0043a3b0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43adbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
movzx eax, word [ebp]
mov dword [esp + 8], 0xe9ea3537
mov dword [esp + 0xc], 0
mov ecx, 0x8cba7973
mov edx, 0x8c
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x73458695]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov esi, edi
and esi, 0x3c
xor edi, 0xbc
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + ecx + 0x73458695], bl
inc ecx
dec edx
cmp ecx, 0x8cba797b
jne 0x43adc0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x447190]
mov ecx, 0x8fd0f5c9
xor ecx, dword [0x447198]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x43b660
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
mov ecx, ebp
add ecx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43b6dc
mov ecx, ebp
shr ecx, 2
mov edx, edi
mov ebx, edi
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add esi, edx
add edx, ebx
mov ecx, ebp
not ecx
or ecx, 3
lea ebx, [ecx + ebp]
inc ebx
mov ecx, ebx
shr ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x43b82e
and ebx, 0xfffffffe
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43b82e
mov dword [esp], 0x282b2a25
mov eax, 7
mov ecx, 0xb8
nop
nop
nop
mov edi, ecx
and edi, 0xb1
mov edx, eax
and edx, 0xe
or edx, edi
xor dl, byte [esp + eax - 7]
xor dl, 0xf1
add dl, 0x9d
mov byte [esp + eax - 7], dl
inc eax
dec ecx
cmp eax, 0xb
jne 0x43b6f0
mov eax, dword [esp]
mov ecx, dword [0x448e64]
test ecx, ecx
je 0x43b774
xor edx, edx
mov edi, dword [0x448e68]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43b74a
mov ebx, edx
and ebx, 1
xor edx, 1
lea edx, [edx + ebx*2]
cmp edx, ecx
jb 0x43b730
jmp 0x43b774
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43b774
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x448e6c]
call fcn.0043a3b0
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x20]
js 0x43b82e
push 0x732f71fd
push dword [0x450e80]
call fcn.0043cfb0
add esp, 8
push 0
push 0
push ebp
push esi
push dword [esp + 0x34]
push edi
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x282b2a25
mov edx, 7
mov esi, 0xb8
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0xb1
mov ebx, edx
and ebx, 0xe
or ebx, edi
xor bl, byte [esp + edx - 3]
xor bl, 0xf1
add bl, 0x9d
mov byte [esp + edx - 3], bl
inc edx
dec esi
cmp edx, 0xb
jne 0x43b7c0
mov edx, dword [0x448e64]
test edx, edx
je 0x43b82e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x448e68]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43b810
inc edi
cmp edx, edi
jne 0x43b800
jmp 0x43b82e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b82e
push ecx
push 1
push edx
push dword [0x448e6c]
mov esi, eax