joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d7e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov edi, dword [ebp + 8]
call fcn.0040f9f0
push eax
mov eax, esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov dword [esi + 0x20], esp
mov dword [esi + 0x24], edi
jmp 0x42d80c
jmp 0x42d80e
mov edi, eax
mov byte [esi + 7], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
je 0x42d9b7
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x2c], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x42d85e
mov dword [esi + 0xc], eax
jmp 0x42d863
jmp 0x42d865
mov eax, dword [esi + 0xc]
jmp 0x42d86a
jmp 0x42d86c
jmp 0x42d86e
cmp eax, 0
je 0x42d9ad
jmp 0x42d879
mov eax, dword [esi + 0xc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esi + 0x14], eax
jmp 0x42d88d
mov eax, dword [esi + 0x14]
sub esp, 4
mov dword [esp], eax
call fcn.00409230
add esp, 4
mov dword [edi], eax
mov eax, dword [edi]
jmp 0x42d8a4
cmp eax, 0
setne al
test al, 1
jne 0x42d8b3
jmp 0x42d998
mov eax, dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0x20]
mov al, byte [eax]
mov byte [esi + 0x10], al
mov byte [ebx], 0x23
mov byte [ebx + 1], 0xc5
mov byte [ebx + 2], 0xc3
mov byte [ebx + 3], 0xcb
mov byte [ebx + 4], 0xd8
mov byte [ebx + 5], 0xcc
mov byte [ebx + 6], 0xdf
mov byte [ebx + 7], 0xcd
mov byte [ebx + 8], 0xda
mov byte [ebx + 9], 0xf
mov byte [ebx + 0xa], 0xc4
mov byte [ebx + 0xb], 0xfb
mov byte [ebx + 0xc], 0xc6
mov byte [ebx + 0xd], 0x75
mov eax, ebx
add eax, 0xe
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 6
call fcn.004091a0
add esp, 0xc
jmp 0x42d927
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
cmp eax, 0x14
jae 0x42d976
jmp 0x42d938
mov eax, dword [esi + 8]
mov ecx, dword [esi + 8]
movzx edx, byte [ebx + ecx]
mov ecx, eax
add ecx, edx
add eax, 0xcf
and eax, edx
add eax, eax
sub ecx, eax
add ecx, 0xc9160ccf
mov dword [esi + 0x28], ecx
mov eax, dword [esi + 0x28]
add al, 0x57
mov ecx, dword [esi + 8]
mov byte [ebx + ecx], al
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0x14
jb 0x42d938
jmp 0x42d976
jmp 0x42d978
sub esp, 0xc
mov ecx, dword [esi + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov eax, dword [esi + 0x1c]
mov dword [esp + 8], eax
call fcn.00409ad0
and al, 1
mov byte [esi + 7], al
jmp 0x42d998
mov eax, dword [esi + 0xc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42d9a9
jmp 0x42d9ab
jmp 0x42d9ad
jmp 0x42d9af
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42d9b7
mov al, byte [esi + 7]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432230
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x4322ed
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x432290
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.004355b0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x432280
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x4323e4
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x4323cd
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x432390
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4323e4
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x432435
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.004355b0
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.004355b0
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432ee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov eax, 0xfffffffe
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x432ef0
test eax, eax
je 0x432f13
mov ebx, eax
sar ebx, 1
test al, 2
jne 0x432f1a
mov edx, ebx
cmp ebx, 1
jne 0x432f4f
jmp 0x432fb9
mov eax, edi
jmp 0x432fb9
lea edx, [ebx - 1]
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov esi, eax
and esi, 0x1000193
mov edi, eax
or eax, 0x1000193
imul eax, esi
xor esi, 0x1000193
and edi, 0xfefffe6c
imul edi, esi
add eax, edi
mov edi, eax
cmp ebx, 1
je 0x432fb9
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0x1000193
mov ebx, edi
or edi, 0x1000193
imul edi, eax
xor eax, 0x1000193
and ebx, 0xfefffe6c
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0x1000193
mov ebx, eax
or eax, 0x1000193
imul eax, edi
xor edi, 0x1000193
and ebx, 0xfefffe6c
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x432f60
pop esi
pop edi
pop ebx
ret
Function at 0x439d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 0x10], 0x13101126
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov word [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x439da3
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x3c530e53
add eax, 0x53
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xbb
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x439d60
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x445d98]
mov edx, dword [case.0x439db3.5]
mov esi, dword [eax + 0xc]
mov ecx, dword [esi + 0xc]
add esi, 0xc
mov dword [esp + 4], esi
xor eax, eax
nop
jmp edx
jmp dword [0x445dc4]
mov ebx, dword [edx + 0x30]
xor ecx, ecx
test ebx, ebx
setne cl
mov edi, 1
jmp dword [ecx*4 + 0x445dc8]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [edx]
lea edi, [ecx - 0x41]
cmp di, 0x1a
jae 0x439e1f
or ecx, 0x20
movzx edi, word [ebx]
lea esi, [edi - 0x41]
cmp si, 0x1a
jae 0x439e2e
or edi, 0x20
test cx, cx
je 0x439e3e
add ebx, 2
add edx, 2
cmp cx, di
je 0x439e10
movzx edx, di
mov esi, edx
not esi
movzx ecx, cx
and esi, ecx
add esi, esi
xor edx, ecx
xor ecx, ecx
cmp esi, edx
sete cl
mov esi, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, 1
jmp dword [ecx*4 + 0x445dd0]
jmp dword [edi*4 + 0x445dd8]
mov edx, ecx
xor ecx, ecx
cmp edx, esi
setne cl
jmp dword [ecx*4 + 0x445db0]
mov ecx, dword [0x445e08]
nop
nop
nop
nop
jmp ecx
mov eax, dword [eax + 8]
mov ecx, dword [0x445e1c]
nop
nop
nop
jmp ecx
Function at 0x439e96
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 0x10], 0x13101126
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov word [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x439da3
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x3c530e53
add eax, 0x53
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xbb
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x439d60
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x445d98]
mov edx, dword [case.0x439db3.5]
mov esi, dword [eax + 0xc]
mov ecx, dword [esi + 0xc]
add esi, 0xc
mov dword [esp + 4], esi
xor eax, eax
nop
jmp edx
jmp dword [0x445dc4]
mov ebx, dword [edx + 0x30]
xor ecx, ecx
test ebx, ebx
setne cl
mov edi, 1
jmp dword [ecx*4 + 0x445dc8]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [edx]
lea edi, [ecx - 0x41]
cmp di, 0x1a
jae 0x439e1f
or ecx, 0x20
movzx edi, word [ebx]
lea esi, [edi - 0x41]
cmp si, 0x1a
jae 0x439e2e
or edi, 0x20
test cx, cx
je 0x439e3e
add ebx, 2
add edx, 2
cmp cx, di
je 0x439e10
movzx edx, di
mov esi, edx
not esi
movzx ecx, cx
and esi, ecx
add esi, esi
xor edx, ecx
xor ecx, ecx
cmp esi, edx
sete cl
mov esi, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, 1
jmp dword [ecx*4 + 0x445dd0]
jmp dword [edi*4 + 0x445dd8]
mov edx, ecx
xor ecx, ecx
cmp edx, esi
setne cl
jmp dword [ecx*4 + 0x445db0]
mov ecx, dword [0x445e08]
nop
nop
nop
nop
jmp ecx
mov eax, dword [eax + 8]
mov ecx, dword [0x445e1c]
nop
nop
nop
jmp ecx
Function at 0x43a150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [eax], 0x6b6a6dbc
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [esi + 4], 0
mov ecx, dword [esi + 4]
cmp ecx, 0xb
ja 0x43a1e3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi + 4]
mov edx, dword [esi + 4]
movzx edx, byte [eax + edx]
lea edi, [ecx + 0x12]
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
add ecx, 0xff13812
mov dword [esi + 0x14], ecx
mov ecx, dword [esi + 0x14]
add cl, 0x82
mov edx, dword [esi + 4]
mov byte [eax + edx], cl
mov ecx, dword [esi + 4]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esi + 4], ecx
mov ecx, dword [esi + 4]
cmp ecx, 0xc
jb 0x43a1a0
mov eax, dword [eax]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x445e68]
mov ecx, dword [case.0x43a1f1.0]
mov edx, dword [eax + 8]
mov dword [esi + 0xc], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov eax, dword [eax + 0xc]
add eax, 0xc
mov dword [esi + 8], 0
mov edi, dword [eax]
xor edx, edx
mov dword [esi + 0x10], eax
cmp edi, eax
setne dl
mov ebx, dword [0x445e9c]
mov ecx, dword [0x445ea8]
jmp dword [edx*4 + 0x445e80]
xor edx, edx
mov eax, dword [esi + 0xc]
cmp dword [edi + 0x18], eax
sete dl
jmp dword [edx*4 + 0x445e88]
mov edx, 1
jmp 0x43a270
jmp ebx
jmp ecx
mov eax, dword [esi + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ad90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43adb0
cmp edi, 0xfffffff5
jge 0x43adc7
mov eax, 0xffffffff
jmp 0x43adca
lea eax, [edi + 0xa]
push eax
call fcn.00409080
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43ae11
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43ae00
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xfaf9f887
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x43aedb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0x17f5bf3f
xor eax, 0x97f5bf3f
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x46
and eax, 0x46
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x43ae90
mov edi, dword [esp + 0x10]
mov eax, dword [0x447460]
test eax, eax
je 0x43af3d
xor ecx, ecx
mov edx, dword [0x447464]
cmp dword [edx + ecx*8], 0x7a96736e
je 0x43af00
inc ecx
cmp eax, ecx
jne 0x43aef0
jmp 0x43af3d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43af3d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x447468]
push eax
call fcn.00438760
add esp, 0x38
mov edi, eax
push esi
call fcn.00409090
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43af50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43af70
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43af8b
mov eax, 0xffffffff
jmp 0x43af8e
add eax, 0xa
push eax
call fcn.00409080
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43afd1
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43afc0
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 4], cx
add eax, edx
add eax, 2
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xfaf9f887
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x43b0ab
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0x17f5bf3f
xor eax, 0x97f5bf3f
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x46
and eax, 0x46
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x43b060
mov edi, dword [esp + 0x10]
mov eax, dword [0x447460]
test eax, eax
je 0x43b101
xor ecx, ecx
mov edx, dword [0x447464]
cmp dword [edx + ecx*8], 0x366ceda
je 0x43b0d0
inc ecx
cmp eax, ecx
jne 0x43b0c0
jmp 0x43b101
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b101
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x447468]
push eax
call fcn.00438760
add esp, 0x24
mov edi, eax
push esi
call fcn.00409090
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43b140
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43b15b
mov eax, 0xffffffff
jmp 0x43b15e
add eax, 0xa
push eax
call fcn.00409080
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43b1a1
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43b190
mov word [ecx], 0
mov edx, 3
sub edx, edi
and edx, 2
mov ecx, eax
and ecx, 0xfffd
imul ecx, edx
and edi, 2
or eax, 2
imul eax, edi
lea edx, [eax + ecx]
mov word [esp + 4], dx
add eax, ecx
add eax, 2
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xfaf9f887
mov dword [esp + 0x2c], 0
mov word [esp + 0x30], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x43b27b
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
mov edx, eax
and edx, 0x17f5bf3f
xor eax, 0x97f5bf3f
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x46
and eax, 0x46
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x43b230
mov edi, dword [esp + 0x28]
mov eax, dword [0x447460]
test eax, eax
je 0x43b2c5
xor ecx, ecx
mov edx, dword [0x447464]
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x43b2a0
inc ecx
cmp eax, ecx
jne 0x43b290
jmp 0x43b2c5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b2c5
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x447468]
push eax
call fcn.00438760
add esp, 0x14
mov edi, eax
push esi
call fcn.00409090
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b2db
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xfaf9f887
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 9
ja 0x43b380
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0x17f5bf3f
xor eax, 0x97f5bf3f
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov ecx, eax
xor ecx, 0x46
and eax, 0x46
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xa
jb 0x43b330
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x447460]
test edx, edx
je 0x43b3d8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x447464]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3bebd150
je 0x43b3b0
inc edi
cmp edx, edi
jne 0x43b3a0
jmp 0x43b3d8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43b3d8
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x447468]
push edx
call fcn.00438760
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43b3e5
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x43b3f1
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xfaf9f887
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x43b48b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0x17f5bf3f
xor eax, 0x97f5bf3f
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
xor ecx, 0x46
and eax, 0x46
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x43b440
mov eax, dword [esp + 8]
mov edi, dword [0x447460]
test edi, edi
je 0x43b4ed
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x447464]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xb0852ef6
je 0x43b4c0
inc ebx
cmp edi, ebx
jne 0x43b4b0
jmp 0x43b4ed
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43b4ed
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x447468]
push edi
call fcn.00438760
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43b5d8
mov dword [esp + 8], 0xfaf9f887
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 9
ja 0x43b57e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0x17f5bf3f
xor eax, 0x97f5bf3f
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp], edx
mov eax, dword [esp]
mov ecx, eax
xor ecx, 0x46
and eax, 0x46
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xa
jb 0x43b530
mov eax, dword [esp + 8]
mov ecx, dword [0x447460]
test ecx, ecx
je 0x43b5d0
xor edx, edx
mov esi, dword [0x447464]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x43b5b0
inc edx
cmp ecx, edx
jne 0x43b5a0
jmp 0x43b5d0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b5d0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x447468]
push ecx
call fcn.00438760
add esp, 0x18
test eax, eax
js 0x43b5d8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43b5eb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43b5e9
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret