joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0x41b060
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0x41b0e0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41b121
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b110
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x41b151
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b140
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x41b181
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b170
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0x41b1b0
movzx eax, byte [esp + 0x48]
test al, al
je 0x41b22d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b220
jmp 0x41b231
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.0040ae40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x443794]
mov ecx, 0xae6ce794
xor ecx, dword [0x44379c]
add eax, ecx
inc eax
jmp eax
Function at 0x437e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 0xc], 0x200
mov dword [esp + 0x10], 0x100
mov dword [esp + 0x14], 0
xor ebx, ebx
lea edi, [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + ebx + 0xc]
mov ecx, 0x20019
or eax, ecx
push 0
push 0
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
call fcn.0043dbd0
add esp, 0x14
test eax, eax
js 0x437f78
push edi
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
call fcn.0043dfb0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x437ef0
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.00407ff0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push dword [esp + 0x40]
push dword [esp + 0x18]
call fcn.0043e690
add esp, 0x14
test eax, eax
js 0x437ee5
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x437ef0
mov eax, dword [esp + 4]
mov dword [ecx], eax
jmp 0x437ef0
push esi
call fcn.00408000
add esp, 4
xor esi, esi
mov eax, dword [esp + 8]
mov dword [esp], 0x60616263
mov ecx, 0x86ceb5bc
movzx edx, byte [esp + ecx + 0x79314a44]
xor edx, ecx
add edx, 0xc98a521f
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [esp + ecx + 0x79314a44], dl
inc ecx
cmp ecx, 0x86ceb5c0
jne 0x437f00
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x437f70
mov edx, dword [esp]
xor ebp, ebp
mov edi, dword [0x449660]
cmp dword [edi + ebp*8], 0xb430e561
je 0x437f50
inc ebp
cmp ecx, ebp
jne 0x437f40
jmp 0x437f70
mov ecx, dword [edi + ebp*8 + 4]
cmp ecx, edx
je 0x437f70
push eax
push 4
push ecx
push dword [0x449664]
call fcn.0043b480
add esp, 0x10
nop
nop
nop
nop
nop
nop
test esi, esi
lea edi, [esp + 4]
jne 0x437f9c
mov eax, esp
push eax
call fcn.0043d320
add esp, 4
cmp dword [esp], 1
sete cl
xor esi, esi
test al, cl
jne 0x437f9c
add ebx, 4
cmp ebx, 0xc
jne 0x437e60
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x439f10
xor eax, eax
cmp dword [ecx], 0
jne 0x439f3a
mov edx, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x60616263
mov eax, 0x86ceb5bc
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x79314a44]
xor esi, eax
mov edi, esi
and edi, 0x6c01575
xor esi, 0x17d05d75
lea ebx, [esi + edi*2]
mov ebp, 0x60
sub ebp, ebx
lea ebx, [esi + edi*2]
add ebx, 0x1f
and ebp, 0x75
and ebx, 0x8a
or ebx, 1
sub ebx, ebp
mov byte [esp + eax + 0x79314a44], bl
inc eax
cmp eax, 0x86ceb5c0
jne 0x439ea0
mov eax, dword [esp]
mov esi, dword [0x44965c]
test esi, esi
je 0x439f3a
xor edi, edi
mov ebx, dword [0x449660]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x439f44
inc edi
cmp esi, edi
jne 0x439f00
jmp 0x439f3a
mov dword [esp + 4], 0x5807061d
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x6d
xor cl, byte [esp + eax + 4]
add cl, 0x98
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 4
jne 0x439f20
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x439f3a
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x449664]
call fcn.0043b480
add esp, 0x1c
jmp 0x439f3a

Function at 0x439f70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43a02b
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0x60616263
mov edx, 0x86ceb5bc
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x79314a44]
xor esi, edx
mov edi, esi
and edi, 0x6c01575
xor esi, 0x17d05d75
lea ebx, [esi + edi*2]
mov ebp, 0x60
sub ebp, ebx
lea ebx, [esi + edi*2]
add ebx, 0x1f
and ebp, 0x75
and ebx, 0x8a
or ebx, 1
sub ebx, ebp
mov byte [esp + edx + 0x79314a44], bl
inc edx
cmp edx, 0x86ceb5c0
jne 0x439f90
mov edx, dword [0x44965c]
test edx, edx
je 0x43a01e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x449660]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x43a000
inc edi
cmp edx, edi
jne 0x439ff0
jmp 0x43a01e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a01e
push eax
push 4
push edx
push dword [0x449664]
mov esi, ecx
call fcn.0043b480
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ca60
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x43ca80
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret
Function at 0x43cfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ecx + eax + 1], 0
lea eax, [eax + 1]
jne 0x43cff0
mov dword [esp], 0xd1dfdf4e
mov ecx, eax
neg ecx
mov dword [esp + 4], ecx
mov edi, 0x13cf1575
nop
nop
movzx ebx, byte [esp + edi - 0x13cf1575]
lea edx, [edi - 0x13cf1500]
and edx, ebx
or ebx, edi
xor ebx, edx
mov edx, ebx
xor edx, 0x9e78aba8
mov ebp, ebx
or ebp, 0x1871457
and ebp, edx
mov edx, ebx
and edx, 2
mov ecx, ebp
or ebp, 2
imul ebp, edx
xor edx, 2
and ecx, 0xfffffffd
imul ecx, edx
add ebp, ecx
xor ebx, 0x61875457
mov ecx, ebp
and ecx, ebx
xor ebp, ebx
lea ecx, [ecx*2]
add ecx, ebp
and ebx, 1
lea edx, [ebx + ebx]
or ecx, 1
sub edx, ebx
add edx, ecx
mov byte [esp + edi - 0x13cf1575], dl
inc edi
cmp edi, 0x13cf1579
jne 0x43d010
test eax, eax
je 0x43d0cf
mov edi, dword [esp]
mov eax, edi
not eax
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [ebp]
lea eax, [esi + ecx]
and esi, ecx
add esi, esi
sub eax, esi
mov ecx, eax
or ecx, edi
mov edx, eax
and edx, edi
imul edx, ecx
mov ecx, eax
not ecx
and ecx, edi
and eax, dword [esp + 8]
imul eax, ecx
add eax, edx
inc ebp
mov esi, eax
inc ebx
jne 0x43d0a0
jmp 0x43d0d1
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d390
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d3ab
mov eax, 0xffffffff
jmp 0x43d3ae
add eax, 0xa
push eax
call fcn.00407ff0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43d3f1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43d3e0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232ac]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232ac], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43d470
mov esi, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43d502
xor edx, edx
mov edi, dword [0x449660]
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43d4c0
inc edx
cmp ecx, edx
jne 0x43d4b0
jmp 0x43d502
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d502
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x449664]
mov edi, eax
call fcn.0043b480
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408000
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d540
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d55b
mov eax, 0xffffffff
jmp 0x43d55e
add eax, 0xa
push eax
call fcn.00407ff0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43d5a1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43d590
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232ac]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232ac], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43d620
mov esi, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43d6a4
xor edx, edx
mov ebx, dword [0x449660]
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43d670
inc edx
cmp ecx, edx
jne 0x43d660
jmp 0x43d6a4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d6a4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x449664]
mov edi, eax
call fcn.0043b480
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408000
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d6e0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d6fb
mov eax, 0xffffffff
jmp 0x43d6fe
add eax, 0xa
push eax
call fcn.00407ff0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43d741
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43d730
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232cc]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232cc], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43d7c0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43d839
xor edx, edx
mov edi, dword [0x449660]
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43d810
inc edx
cmp ecx, edx
jne 0x43d800
jmp 0x43d839
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d839
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x449664]
mov edi, eax
call fcn.0043b480
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408000
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43d84f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43d880
mov eax, dword [esp]
mov edx, dword [0x44965c]
test edx, edx
je 0x43d8f8
xor ebx, ebx
mov ecx, dword [0x449660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43d8d0
inc ebx
cmp edx, ebx
jne 0x43d8c0
jmp 0x43d8f8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43d8f8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x449664]
call fcn.0043b480
add esp, 0x20
test edi, edi
je 0x43d902
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43d90e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43d920
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xc8c9cacb
mov eax, 0x967dcd54
movzx edi, byte [esp + eax + 0x698232b0]
xor edi, eax
mov ebx, edi
and ebx, 0x5f
add ebx, ebx
xor edi, 0xa0
sub ebx, edi
mov byte [esp + eax + 0x698232b0], bl
inc eax
cmp eax, 0x967dcd58
jne 0x43d940
mov eax, dword [esp + 4]
mov ebx, dword [0x44965c]
test ebx, ebx
je 0x43d9be
xor ebp, ebp
mov edi, dword [0x449660]
nop
nop
cmp dword [edi + ebp*8], 0xe88ddea1
je 0x43d990
inc ebp
cmp ebx, ebp
jne 0x43d980
jmp 0x43d9be
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43d9be
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x449664]
call fcn.0043b480
add esp, 0x30
cmp eax, 0x103
jne 0x43da59
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43d9e0
mov eax, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43da51
xor edx, edx
mov edi, dword [0x449660]
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43da30
inc edx
cmp ecx, edx
jne 0x43da20
jmp 0x43da51
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43da51
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x449664]
call fcn.0043b480
add esp, 0x18
test eax, eax
js 0x43da59
mov eax, dword [esp + 4]
test esi, esi
je 0x43da6c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43da6a
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43da80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xc8c9cacb
mov eax, 0x967dcd54
movzx edi, byte [esp + eax + 0x698232b0]
xor edi, eax
mov ebx, edi
and ebx, 0x5f
add ebx, ebx
xor edi, 0xa0
sub ebx, edi
mov byte [esp + eax + 0x698232b0], bl
inc eax
cmp eax, 0x967dcd58
jne 0x43daa0
mov eax, dword [esp + 4]
mov ebx, dword [0x44965c]
test ebx, ebx
je 0x43db1e
xor ebp, ebp
mov edi, dword [0x449660]
nop
nop
cmp dword [edi + ebp*8], 0x88822328
je 0x43daf0
inc ebp
cmp ebx, ebp
jne 0x43dae0
jmp 0x43db1e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43db1e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x449664]
call fcn.0043b480
add esp, 0x30
cmp eax, 0x103
jne 0x43dbb9
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43db40
mov eax, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43dbb1
xor edx, edx
mov edi, dword [0x449660]
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43db90
inc edx
cmp ecx, edx
jne 0x43db80
jmp 0x43dbb1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43dbb1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x449664]
call fcn.0043b480
add esp, 0x18
test eax, eax
js 0x43dbb9
mov eax, dword [esp + 4]
test esi, esi
je 0x43dbc3
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43dbf0
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x698232ac]
xor ecx, eax
mov ebx, ecx
and ebx, 0x5f
add ebx, ebx
xor ecx, 0xa0
sub ebx, ecx
mov byte [esp + eax + 0x698232ac], bl
inc eax
cmp eax, 0x967dcd58
jne 0x43dc70
mov eax, dword [esp]
mov edi, dword [0x44965c]
test edi, edi
je 0x43dce5
xor ebx, ebx
mov ebp, dword [0x449660]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x43dcc1
inc ebx
cmp edi, ebx
jne 0x43dcb0
jmp 0x43dce5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43dce5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x449664]
call fcn.0043b480
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d8e23
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
ja 0x5d8e2c
push ebx
pop ebx
pop ecx
push eax
push edx
push eax
push edx
push edx
pop edx
rdtsc
jmp 0x5d8e49
pop edx
pop eax
pop edx
mov eax, dword [esp + 4]
jmp 0x5d8e62
mov eax, dword [eax]
je 0x5d8e7c
push eax
push edx
jl 0x5d8e72
rdtsc
jns 0x5d8e7a
pop edx
pop eax
mov dword [esp + 4], eax
jp 0x5d8e98
push ecx
jmp 0x5d8e97
pop ecx
pop eax
mov edi, 0x51f3edcf
push 3
add edx, 0xa345cfc
push 0
xor ecx, dword [ebp + 0x122d29e3]
push 3
mov dword [ebp + 0x122d2756], esi
jns 0x5d8ec2
or dword [ebp + 0x122d2d22], ebx
push 0x58f82c59
jmp 0x5d8eda
add dword [esp], 0x6707d3a7
push 0
push ebx
call 0x5d8eec
and byte [ebx - 0x3d], bl
pop ebx
mov dword [esp + 4], ebx
add dword [esp + 4], 0x18
inc ebx
push ebx
ret