joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x414cf0
sar esi, 1
lea edi, [esp + 0x94]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x449940]
mov ebx, dword [esp + 0x94]
test ebx, ebx
jns 0x414d25
mov eax, 0xffffffff
jmp 0x414d28
lea eax, [ebx + ebx]
push eax
call fcn.00436470
add esp, 4
push edi
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x449940]
mov dword [esp + 0x30], 0x8bc885fa
mov dword [esp + 0x34], 0x8f1d89ed
mov dword [esp + 0x38], 0xb3ac8d1a
mov dword [esp + 0x3c], 0xb7dbb1c8
mov dword [esp + 0x40], 0xbb21b520
mov dword [esp + 0x44], 0xbf29b9d5
mov dword [esp + 0x48], 0xa3bcbd2c
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov byte [esp + 0x58], 0
mov dword [esp + 0xa8], 0
mov ecx, dword [esp + 0xa8]
cmp ecx, 0x28
ja 0x414e13
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xa8]
movzx esi, byte [esp + edx + 0x30]
lea edx, [ecx + esi]
add edx, 0xb1e9d595
add ecx, 0x95
and ecx, esi
add ecx, ecx
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
add cl, 0xed
mov edx, dword [esp + 0xa8]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0xa8]
mov ecx, dword [esp + 0xa8]
cmp ecx, 0x29
jb 0x414dc0
lea edi, [esp + 0xd0]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xec]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x94]
mov ecx, eax
add ecx, 0xd
jns 0x414e4c
mov eax, 0xffffffff
jmp 0x414e51
add eax, eax
add eax, 0x1a
push eax
call fcn.00436470
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x2c]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x414e91
mov eax, dword [esp + 0x2c]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414e80
mov word [eax], 0
movzx ecx, word [esp + 0xd0]
test cx, cx
je 0x414ec1
lea edx, [esp + 0xd2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414eb0
mov word [eax], 0
lea eax, [esp + 0x78]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043b090
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x44237c]
mov ecx, 0x6e03def2
xor ecx, dword [0x442384]
add eax, ecx
inc eax
jmp eax
Function at 0x41a050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 8]
mov dword [esp + 0x20], 0x8be985fa
mov dword [esp + 0x24], 0x8f1789e1
mov dword [esp + 0x28], 0xb3de8dda
mov dword [esp + 0x2c], 0xb7d6b1d6
lea eax, [esp + 0x30]
mov word [esp + 0x30], 0xb5b6
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x42], 0
mov dword [esp + 0x45], 0
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x28
ja 0x41a10f
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
movzx edx, byte [esp + edx + 0x20]
mov esi, ecx
and esi, 0x31e9d595
xor ecx, 0xb1e9d595
lea esi, [ecx + esi*2]
lea ecx, [esi + edx]
and esi, edx
add esi, esi
sub ecx, esi
add cl, 0xed
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x29
jb 0x41a0d0
lea edi, [esp + 0xc]
lea esi, [esp + 0x20]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x1c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a140
mov edi, esi
cmp eax, 0xffffffed
jge 0x41a159
mov eax, 0xffffffff
jmp 0x41a15c
add eax, 0x12
push eax
call fcn.00436470
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41a191
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41a180
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
je 0x41a1c1
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a1b0
mov word [eax], 0
mov eax, dword [0x442f18]
mov ecx, 0x424a1a43
xor ecx, dword [0x442f1c]
add eax, ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x420010
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x880
xor esi, esi
mov ebx, 0x20219
mov eax, 1
mov dword [esp + 0x10], 0
xor edi, edi
jmp dword [eax*4 + 0x44464c]
Function at 0x42eee0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov byte [esp + 0x17], 0
xor eax, eax
lea eax, [esp + 0x5c]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
sub esp, 8
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42f090
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
setne al
test al, 1
jne 0x42ef51
jmp 0x42f086
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
jmp 0x42ef6b
jmp 0x42ef6d
mov dword [esp], eax
call fcn.00408770
jmp 0x42ef77
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0
setne al
test al, 1
jne 0x42ef8c
jmp 0x42f074
call fcn.00408c70
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov bl, byte [esp + 0x1c]
mov byte [esp + 0x24], bl
mov byte [esp + 0x30], 0x9b
mov byte [esp + 0x31], 0xcd
mov byte [esp + 0x32], 0xb3
mov byte [esp + 0x33], 0xcb
mov byte [esp + 0x34], 0xa6
mov byte [esp + 0x35], 0xd2
mov byte [esp + 0x36], 0xa7
mov byte [esp + 0x37], 0xd5
mov byte [esp + 0x38], 0xac
mov byte [esp + 0x39], 0x97
mov byte [esp + 0x3a], 0xde
mov byte [esp + 0x3b], 0xdb
mov byte [esp + 0x3c], 0xd0
mov byte [esp + 0x3d], 0x4d
mov word [esp + 0x46], 0
mov dword [esp + 0x42], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x18]
cmp esi, 0x18
jae 0x42f055
jmp 0x42f014
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x18]
movzx edi, byte [esp + edi + 0x30]
mov esi, ebx
add esi, 0x150d548c
lea ebx, [ebx + edi + 0x150d548c]
and esi, edi
add esi, esi
sub ebx, esi
add bl, 0x2c
mov esi, dword [esp + 0x18]
mov byte [esp + esi + 0x30], bl
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x18]
cmp esi, 0x18
jb 0x42f014
jmp 0x42f055
lea esi, [esp + 0x30]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.00408e80
sub esp, 0xc
and al, 1
mov byte [esp + 0x17], al
jmp 0x42f074
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42f086
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42f08e
jmp 0x42f090
mov al, byte [esp + 0x17]
jmp 0x42f096
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
mov dword [esi], esp
push eax
mov dword [esi + 4], esp
sub esp, 0x10
mov dword [esi + 8], esp
push eax
mov edx, esp
push eax
mov dword [esi + 0xc], esp
mov dword [esi + 0x30], 0x1bc91925
mov dword [esi + 0x34], 0x17e5159d
mov dword [esi + 0x38], 0x13ef119c
mov dword [esi + 0x3c], 0x2ff22dd9
mov dword [esi + 0x40], 0x2bd329da
mov dword [esi + 0x44], 0x27db25aa
mov dword [esi + 0x48], 0x2322211d
mov dword [esi + 0x4c], 0
mov word [esi + 0x50], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x14]
cmp eax, 0x21
ja 0x434700
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x14]
add al, 0xd4
xor al, byte [esi + ecx + 0x30]
add al, 0x34
mov ecx, dword [esi + 0x14]
mov byte [esi + ecx + 0x30], al
inc dword [esi + 0x14]
mov eax, dword [esi + 0x14]
cmp eax, 0x22
jb 0x4346e0
mov dword [esi + 0x10], edx
lea edx, [esi + 0x4c]
lea edi, [esi + 0x14]
lea eax, [esi + 0x30]
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esi + 0x30]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
push dword [esi]
push 8
lea eax, [esi + 0x30]
push eax
push 0xd
lea eax, [esi + 0x14]
push eax
push 0
call dword [0x449940]
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x447064]
mov ecx, 0xc04d456e
xor ecx, dword [0x44706c]
add eax, ecx
inc eax
jmp eax
Function at 0x4379b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov dword [esp + 0x10], 0x8b108514
mov dword [esp + 0x14], 0x8fe489ee
mov dword [esp + 0x18], 0xb3de8de2
mov dword [esp + 0x1c], 0xb7dcb1d6
mov dword [esp + 0x20], 0xbbb4b5da
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x28
ja 0x437a55
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
add al, 0x95
xor al, byte [esp + ecx + 0x10]
add al, 0xed
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x29
jb 0x437a30
lea esi, [esp + 0x10]
push esi
call fcn.00439be0
add esp, 4
mov ecx, eax
mov dword [0x452970], eax
xor eax, eax
test ecx, ecx
sete al
mov eax, dword [eax*4 + 0x44734c]
mov edx, 0xfae490c
xor edx, dword [0x447354]
add edx, eax
inc edx
xor eax, eax
jmp edx
Function at 0x43aec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43aee0
cmp edi, 0xfffffff5
jge 0x43aef7
mov eax, 0xffffffff
jmp 0x43aefa
lea eax, [edi + 0xa]
push eax
call fcn.00436470
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43af41
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43af30
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 8], ax
add edi, 0xa
mov word [esp + 0xa], di
mov dword [esp + 0xc], esi
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x43b012
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xa79f63a6
add eax, 0xa6
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x76
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x43afd0
mov edi, dword [esp + 0x10]
mov eax, dword [0x44a94c]
test eax, eax
je 0x43b07d
xor ecx, ecx
mov edx, dword [0x44a950]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb1cf12ba
je 0x43b040
inc ecx
cmp eax, ecx
jne 0x43b030
jmp 0x43b07d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b07d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x44a954]
push eax
call fcn.004384a0
add esp, 0x38
mov edi, eax
push esi
call fcn.00408500
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43b0b0
mov ebx, eax
sar ebx, 1
lea edi, [ebx + 4]
and eax, 2
mov ecx, edi
xor ecx, 1
add ecx, eax
jns 0x43b0d5
mov ecx, 0xffffffff
jmp 0x43b0d7
add ecx, ecx
push ecx
call fcn.00436470
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x43b121
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x43b110
mov word [edx], 0
mov edx, 3
sub edx, ebx
and edx, 2
mov ecx, edi
and ecx, 0xfffd
imul ecx, edx
and ebx, 2
or edi, 2
imul edi, ebx
add edi, ecx
mov word [esp + 8], di
mov ecx, edi
and ecx, 2
xor edi, 2
lea ecx, [edi + ecx*2]
mov word [esp + 0xa], cx
mov esi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x43b212
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xa79f63a6
add eax, 0xa6
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x76
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x43b1d0
mov edi, dword [esp + 0x10]
mov eax, dword [0x44a94c]
test eax, eax
je 0x43b271
xor ecx, ecx
mov edx, dword [0x44a950]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x37e2bdc6
je 0x43b240
inc ecx
cmp eax, ecx
jne 0x43b230
jmp 0x43b271
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b271
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44a954]
push eax
call fcn.004384a0
add esp, 0x24
mov edi, eax
push esi
call fcn.00408500
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43b2b0
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43b2cb
mov eax, 0xffffffff
jmp 0x43b2ce
add eax, 0xa
push eax
call fcn.00436470
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43b311
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43b300
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 0x10], cx
add eax, edx
add eax, 2
mov word [esp + 0x12], ax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0x20212e2f
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x14
ja 0x43b402
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x30]
lea edx, [eax + ecx]
add edx, 0xa79f63a6
add eax, 0xa6
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x76
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x15
jb 0x43b3c0
mov edi, dword [esp + 0x30]
mov eax, dword [0x44a94c]
test eax, eax
je 0x43b455
xor ecx, ecx
mov edx, dword [0x44a950]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x6a34d54b
je 0x43b430
inc ecx
cmp eax, ecx
jne 0x43b420
jmp 0x43b455
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b455
lea ecx, [esp + 0x30]
lea edx, [esp + 0x18]
push ecx
push edx
push 2
push dword [0x44a954]
push eax
call fcn.004384a0
add esp, 0x14
mov edi, eax
push esi
call fcn.00408500
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b46b
mov eax, dword [esp + 0x50]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x14
ja 0x43b512
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xa79f63a6
add eax, 0xa6
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x76
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x15
jb 0x43b4d0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x44a94c]
test edx, edx
je 0x43b574
xor edi, edi
mov ebx, dword [0x44a950]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x904d52bc
je 0x43b54a
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, edx
jb 0x43b530
jmp 0x43b574
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43b574
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x44a954]
push edx
call fcn.004384a0
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43b581
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x43b58d
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x14
ja 0x43b632
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xa79f63a6
add eax, 0xa6
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x76
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x15
jb 0x43b5f0
mov eax, dword [esp + 0x10]
mov edi, dword [0x44a94c]
test edi, edi
je 0x43b68d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x44a950]
nop
nop
cmp dword [esi + ebx*8], 0xcdf6794a
je 0x43b660
inc ebx
cmp edi, ebx
jne 0x43b650
jmp 0x43b68d
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43b68d
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x44a954]
push edi
call fcn.004384a0
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43b778
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x43b722
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xa79f63a6
add eax, 0xa6
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x76
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x43b6e0
mov eax, dword [esp + 0x10]
mov ecx, dword [0x44a94c]
test ecx, ecx
je 0x43b770
xor edx, edx
mov esi, dword [0x44a950]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x7a1a689f
je 0x43b750
inc edx
cmp ecx, edx
jne 0x43b740
jmp 0x43b770
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b770
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x44a954]
push ecx
call fcn.004384a0
add esp, 0x18
test eax, eax
js 0x43b778
mov eax, dword [esp + 8]
test edi, edi
je 0x43b78b
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43b789
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret