joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [ecx + 8]
test esi, esi
je 0x437330
xor eax, eax
cmp dword [ecx], 0
jne 0x43737b
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], esi
mov dword [esp + 8], ecx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
mov ebx, 0x9971d82
mov esi, 0x7668e27d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebx - 0x9971d82]
lea edi, [ebx - 0x97fffff]
mov edx, edi
or edx, 0xff8b4529
lea ebp, [esi + edx]
and edi, 0x141886
mov eax, ebx
sub eax, edx
and eax, 0x934be76
mov edx, ebp
and edx, 0x36080009
or edx, eax
xor edx, edi
xor edx, 0x4934fe76
and edi, ebp
or edi, edx
xor edi, ecx
xor edi, 0xff8b4529
lea eax, [edi + 0x500c6c70]
mov ecx, edi
and ecx, 1
mov edx, eax
and edx, 0xfe
xor eax, 1
add ecx, edi
add ecx, 0x500c6c70
add ecx, eax
sub ecx, edx
mov byte [esp + ebx - 0x9971d82], cl
inc ebx
dec esi
cmp ebx, 0x9971d88
jne 0x437290
mov eax, dword [esp]
mov esi, dword [0x44a7f4]
test esi, esi
je 0x43737b
xor edi, edi
mov ebx, dword [0x44a7f8]
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x437385
inc edi
cmp esi, edi
jne 0x437320
jmp 0x43737b
mov dword [esp + 0xc], 0x3424148
mov dword [esp + 0x10], 0
mov eax, 0xf3c79990
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc38667c]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x30
mov byte [esp + eax + 0xc38667c], cl
inc eax
cmp eax, 0xf3c79998
jne 0x437350
mov eax, dword [esp + 0xc]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43737b
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
push ecx
push dword [esp + 0x48]
push dword [esp + 0x14]
push 0x10
push esi
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x1c
jmp 0x43737b
Function at 0x4373c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov eax, dword [ecx]
test eax, eax
je 0x4374c7
mov dword [esp + 8], eax
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
mov ebx, 0x9971d82
mov esi, 0x7668e27d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebx - 0x9971d82]
lea edi, [ebx - 0x97fffff]
mov eax, edi
or eax, 0xff8b4529
lea ebp, [esi + eax]
and edi, 0x141886
mov edx, ebx
sub edx, eax
and edx, 0x934be76
mov eax, ebp
and eax, 0x36080009
or eax, edx
xor eax, edi
xor eax, 0x4934fe76
and edi, ebp
or edi, eax
xor edi, ecx
xor edi, 0xff8b4529
lea eax, [edi + 0x500c6c70]
mov ecx, edi
and ecx, 1
mov edx, eax
and edx, 0xfe
xor eax, 1
add ecx, edi
add ecx, 0x500c6c70
add ecx, eax
sub ecx, edx
mov byte [esp + ebx - 0x9971d82], cl
inc ebx
dec esi
cmp ebx, 0x9971d88
jne 0x437400
mov edx, dword [0x44a7f4]
test edx, edx
je 0x4374bd
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a7f8]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4374a0
inc edi
cmp edx, edi
jne 0x437490
jmp 0x4374bd
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4374bd
push dword [esp + 8]
push 4
push edx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x10
mov eax, dword [esp + 0xc]
mov dword [eax], 0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x437b59
lea edi, [esp + 0x18]
mov eax, dword [esi + 4]
test eax, eax
je 0x437b6a
cmp eax, 2
je 0x437be0
jmp 0x437c0d
push 0xbbf966b4
push dword [0x44a7e8]
call fcn.0043cf80
add esp, 8
test eax, eax
je 0x437bab
mov ecx, dword [esi]
test ecx, ecx
je 0x437bd8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x437bb4
cmp dword [esp + 4], 0
je 0x437bb4
mov dword [esi + 4], 3
jmp 0x437bd8
mov dword [esi + 4], 1
jmp 0x437c0d
lea eax, [esp + 0x14]
push eax
call fcn.0043d710
add esp, 4
test al, al
je 0x437bd8
mov eax, dword [esp + 0x14]
mov ecx, 2
cmp eax, 3
je 0x437bd5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x437c0d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x452810]
call fcn.0043cf80
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x437d07
mov dword [esp + 0x10], edi
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
mov edi, 0x9971d82
mov edx, 0x7668e27d
lea esi, [edi - 0x97fffff]
mov ebx, esi
or ebx, 0xff8b4529
lea ecx, [edx + ebx]
mov eax, edi
sub eax, ebx
and eax, 0x934be76
mov ebx, ecx
and ebx, 0x36080009
or ebx, eax
and esi, 0x141886
xor ebx, esi
and esi, ecx
movzx eax, byte [esp + edi - 0x9971d7e]
xor ebx, 0x4934fe76
or esi, ebx
xor esi, eax
xor esi, 0xff8b4529
lea eax, [esi + 0x500c6c70]
mov ecx, esi
and ecx, 1
add ecx, esi
add ecx, 0x500c6c70
mov esi, eax
xor eax, 1
add ecx, eax
and esi, 0xfe
sub ecx, esi
mov byte [esp + edi - 0x9971d7e], cl
inc edi
dec edx
cmp edi, 0x9971d88
jne 0x437c30
mov eax, dword [esp + 4]
mov edx, dword [0x44a7f4]
test edx, edx
je 0x437d07
xor esi, esi
mov ebx, dword [0x44a7f8]
mov edi, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x437ce0
inc esi
cmp edx, esi
jne 0x437cd0
jmp 0x437d07
mov ecx, dword [ebx + esi*8 + 4]
cmp ecx, eax
je 0x437d07
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x1c]
push 0x14
push ecx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x438a70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov dword [esp + 0x2c], 0x118a1f82
mov dword [esp + 0x30], 0x158e1374
mov dword [esp + 0x34], 0x9481788
mov dword [esp + 0x38], 0xd960b6c
mov dword [esp + 0x3c], 0x10e0f90
mov word [esp + 0x40], 0
mov byte [esp + 0x42], 0
lea eax, [esp + 0x2c]
mov ecx, 0x344580fa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x34458000]
and esi, edx
or edx, ecx
not edx
or edx, esi
mov ebx, edx
and ebx, 0x66
add ebx, ebx
xor edx, 0x19
sub ebx, edx
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x344580e3
jne 0x438ac0
lea eax, [esp + 0x2c]
push eax
call fcn.0043cac0
add esp, 4
mov dword [0x452810], eax
mov dword [esp + 8], 0x7c3db231
test eax, eax
je 0x438b0f
mov dword [esp + 8], 0x3090e289
mov ebp, 0x1cea9103
xor eax, eax
cmp ebp, 0xfcd5f776
setl al
mov eax, dword [eax*4 + 0x446e68]
mov ecx, dword [0x446e70]
mov edx, ecx
and edx, 0x37e4bca2
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x481b435e
jmp eax

Function at 0x439ee0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x4473a4]

Function at 0x43ae60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov ebp, dword [esp + 0x4c]
movzx eax, word [ebp]
mov dword [esp + 8], 0x717ed5a3
mov ecx, 0x6df80c95
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x6df80c8d]
xor edx, ecx
lea esi, [edx - 0x25d83eea]
mov edi, edx
and edi, 1
mov ebx, esi
and ebx, 0xfe
xor esi, 1
add edx, edi
add edx, 0xda27c116
add edx, esi
sub edx, ebx
mov byte [esp + ecx - 0x6df80c8d], dl
inc ecx
cmp ecx, 0x6df80c99
jne 0x43ae80
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x447898]
mov ecx, 0x1e08b90f
xor ecx, dword [0x4478a0]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x43b710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov edx, dword [esp + 0x28]
jb 0x43b789
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
not eax
or eax, 0xfffffffc
add eax, ebx
add edx, eax
inc edx
lea esi, [eax + ebp]
inc esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, esi
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43b8ee
and ebx, 2
movzx ecx, byte [esi + ebx]
mov byte [edx + ebx], cl
jmp 0x43b8ee
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, eax
and edx, 5
xor edx, 0x7668e27d
mov esi, eax
and esi, 2
sub esi, edx
xor esi, ecx
mov ecx, esi
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
add cl, 0x70
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43b7a0
mov eax, dword [esp]
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43b82a
xor edx, edx
mov esi, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x89c57e52
je 0x43b800
inc edx
cmp ecx, edx
jne 0x43b7f0
jmp 0x43b82a
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b82a
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x28
test eax, eax
js 0x43b8ee
push 0x732f71fd
push dword [0x452810]
call fcn.0043cf80
add esp, 8
push 0
push 0
push ebx
push dword [esp + 0x34]
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
and edi, 5
xor edi, 0x7668e27d
mov ebx, edx
and ebx, 2
sub ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0x70
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x43b870
mov edx, dword [0x44a7f4]
test edx, edx
je 0x43b8ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43b8d0
inc edi
cmp edx, edi
jne 0x43b8c0
jmp 0x43b8ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b8ee
push ecx
push 4
push edx
push dword [0x44a7fc]
mov esi, eax
call fcn.00439fa0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x43424190
mov word [esp + 8], 0
mov eax, 0x79830090
mov ecx, 0x6f
movzx esi, byte [esp + eax - 0x7983008c]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov edi, 0x5f8f02d0
sub edi, edx
mov esi, edi
or esi, 1
add esi, edx
add esi, 0xa070fd30
mov ebx, esi
and ebx, 2
mov ebp, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and ebp, 0xfffffffd
imul ebp, ebx
add esi, ebp
and edi, 0xe60c03fe
or edx, 0xfffffffe
xor edx, edi
mov edi, esi
and edi, edx
xor edx, esi
lea edx, [edx + edi*2]
mov byte [esp + eax - 0x7983008c], dl
inc eax
dec ecx
cmp eax, 0x79830096
jne 0x43cae0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x447eb4]

Function at 0x43cdea
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xe3e2e1b0
mov dword [esp + 4], 0
mov eax, esp
mov edx, 0x1ac4d4a7
movzx esi, byte [eax]
mov ebx, edx
or ebx, esi
lea edi, [edx - 0x1ac4d400]
and edi, esi
not ebx
or ebx, edi
mov esi, ebx
xor esi, 0x33cd0742
and ebx, 0xcc32f8bd
add ebx, ebx
sub ebx, esi
mov esi, 0xec
sub esi, ebx
add ebx, 0x13
and esi, 0x89
and ebx, 0x76
sub ebx, esi
mov byte [eax], bl
inc eax
dec edx
cmp edx, 0x1ac4d49f
jne 0x43ce00
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447f44]

Function at 0x43ced0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x41464714
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
mov edx, eax
add dl, 0x71
xor dl, byte [esp + eax]
add dl, 0xcb
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne case.default.0x43cf11
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447f64]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x447f6c]
mov eax, dword [esi + 0x28]
xor edi, edi
jmp dword [edi*4 + 0x447f7c]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x447f6c]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x447f74]
mov edi, 1
jmp dword [edi*4 + 0x447f7c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43cf80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x44]
movzx esi, word [ebp]
mov dword [esp], 0x13126b65
mov byte [esp + 4], 0
mov ecx, esp
xor edx, edx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
and al, 0xf8
add al, dl
xor al, byte [ecx]
xor al, 0x84
add al, 0x6c
mov byte [ecx], al
inc ecx
add ebx, 2
inc dl
cmp ebx, 0xa
jne case.default.0x43cfd3
xor ecx, ecx
cmp dword [esp], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447f84]
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + ecx]
mov dword [esp], 0x2126d8d4
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x79
xor bl, byte [esp + edx]
add bl, 0xa3
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne case.default.0x43d01e
xor edx, edx
cmp eax, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x447f8c]
mov esi, dword [ebp + ecx + 0x78]
mov ecx, dword [ebp + ecx + 0x7c]
mov dword [esp + 0x20], ecx
test ecx, ecx
sete cl
test esi, esi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x447f94]
mov eax, dword [ebp + esi + 0x20]
add eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + esi + 0x24]
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + esi + 0x1c]
add eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], esi
mov ecx, dword [ebp + esi + 0x18]
xor esi, esi
mov edi, dword [0x447fb0]
xor eax, eax
mov dword [esp + 0x24], ecx
cmp esi, ecx
setb al
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], edi
jmp dword [eax*4 + 0x447f9c]
mov eax, dword [esp + 0x2c]
mov edi, dword [eax + esi*4]
add edi, ebp
mov edx, 0xffffffff
xor ecx, ecx
mov eax, ecx
cmp byte [edi + edx + 1], 0
lea edx, [edx + 1]
lea ecx, [ecx + 1]
jne 0x43d0b0
mov dword [esp], 0x62666409
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
mov ebx, ecx
add bl, 0x19
xor bl, byte [esp + ecx]
add bl, 0x83
mov byte [esp + ecx], bl
inc ecx
cmp ecx, 5
jne 0x43d0d0
test edx, edx
mov dword [esp + 0xc], esi
je 0x43d110
mov ebp, dword [esp]
mov ecx, ebp
not ecx
cmp edx, 1
jne 0x43d120
mov esi, 0x36c0b43e
test dl, 1
jne 0x43d180
jmp 0x43d19b
mov esi, 0x36c0b43e
jmp 0x43d19b
and eax, 0xfffffffe
mov esi, 0x36c0b43e
mov dword [esp + 8], ecx
nop
nop
nop
nop
movsx ebx, byte [edi]
xor ebx, esi
mov esi, ebx
and esi, dword [esp + 8]
mov ecx, ebx
not ecx
and ecx, ebp
imul ecx, esi
mov esi, ebx
and esi, ebp
or ebx, ebp
imul ebx, esi
add ebx, ecx
movsx esi, byte [edi + 1]
add edi, 2
xor esi, ebx
mov ecx, esi
and ecx, dword [esp + 8]
mov ebx, esi
not ebx
and ebx, ebp
imul ebx, ecx
mov ecx, esi
and ecx, ebp
or esi, ebp
imul esi, ecx
add esi, ebx
add eax, 0xfffffffe
jne 0x43d130
mov ecx, dword [esp + 8]
test dl, 1
je 0x43d19b
movsx eax, byte [edi]
xor esi, eax
and ecx, esi
mov eax, esi
not eax
and eax, ebp
imul eax, ecx
mov ecx, esi
and ecx, ebp
or esi, ebp
imul esi, ecx
add esi, eax
mov edi, dword [esp + 0x28]
nop
jmp edi
mov ecx, dword [esp + 0x1c]
jmp dword [ecx*4 + 0x447fec]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d780
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43d79b
mov eax, 0xffffffff
jmp 0x43d79e
add eax, 0xa
push eax
call fcn.00408230
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43d7e1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43d7d0
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xbcbdbebf
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa0
xor dl, byte [esp + ecx]
add dl, 0xe0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43d840
mov esi, dword [esp]
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43d8bf
xor edx, edx
mov edi, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43d880
inc edx
cmp ecx, edx
jne 0x43d870
jmp 0x43d8bf
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d8bf
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44a7fc]
mov edi, eax
call fcn.00439fa0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408240
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d900
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d91b
mov eax, 0xffffffff
jmp 0x43d91e
add eax, 0xa
push eax
call fcn.00408230
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43d961
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43d950
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xbcbdbebf
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xa0
xor dl, byte [esp + ecx]
add dl, 0xe0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43d9d0
mov esi, dword [esp]
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43da44
xor edx, edx
mov ebx, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43da10
inc edx
cmp ecx, edx
jne 0x43da00
jmp 0x43da44
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43da44
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44a7fc]
mov edi, eax
call fcn.00439fa0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408240
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43da60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43da80
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43da9b
mov eax, 0xffffffff
jmp 0x43da9e
add eax, 0xa
push eax
call fcn.00408230
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43dae1
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43dad0
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xbcbdbebf
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa0
xor dl, byte [esp + ecx + 0x20]
add dl, 0xe0
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 4
jne 0x43db60
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43dbc9
xor edx, edx
mov edi, dword [0x44a7f8]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x43dba0
inc edx
cmp ecx, edx
jne 0x43db90
jmp 0x43dbc9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43dbc9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44a7fc]
mov edi, eax
call fcn.00439fa0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408240
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43dbdf
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43dbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xbcbdbebf
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa0
xor cl, byte [esp + eax]
add cl, 0xe0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43dc10
mov eax, dword [esp]
mov edx, dword [0x44a7f4]
test edx, edx
je 0x43dc78
xor ebx, ebx
mov ecx, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x43dc50
inc ebx
cmp edx, ebx
jne 0x43dc40
jmp 0x43dc78
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43dc78
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x20
test edi, edi
je 0x43dc82
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43dc8e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret