joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e428
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x412c7c]
cmp dword [eax], 2
jne 0x40e490
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40e44b
xor eax, eax
jmp 0x40e49f
lea eax, [esp + 8]
push eax
push 0x40e4a4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40e490
xor eax, eax
jmp 0x40e49f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x40e4cc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40e526
inc esi
xor edi, edi
cmp edi, 1
jne 0x40e4f2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x40e500
cmp edi, 1
jle 0x40e500
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040e058
test eax, eax
jne 0x40e526
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40e526
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40e526
inc edi
dec esi
jne 0x40e4e2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40e530
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e554
mov eax, dword [ebp - 4]
jmp 0x40e557
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x402e80
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402eba
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x402ec1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x402ea0
jmp 0x402ec3
mov eax, 0x1505
jmp 0x402ec3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x403610
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4037b6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4037af
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4036a5
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4037af
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x403743
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 7]
mov edi, eax
and edi, esi
xor eax, esi
lea edi, [eax + edi*2]
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4036d0
add ebp, eax
mov esi, dword [esp + 4]
mov eax, ebx
sub eax, edx
jae 0x40366d
mov dword [esp + 8], eax
mov esi, edx
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x40376c
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x403760
cmp dword [esp + 8], 0xfffffffc
ja 0x403660
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x403780
jmp 0x403660
shl ecx, 0x10
or ecx, edi
jmp 0x4037bb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4037d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4037fe
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40389c
not eax
test bl, 1
jne 0x403805
mov edx, ebx
cmp ebx, 1
jne 0x403836
jmp 0x40389a
xor eax, eax
jmp 0x40389c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43e80c]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x43e80c]
cmp ebx, 1
je 0x40389a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43e80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43e80c]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43e80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43e80c]
add esi, 2
cmp edx, esi
jne 0x403840
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4087b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4087cb
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x4087d3
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40886b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x408819
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40887a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x40882e
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408840
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x408800
jmp 0x408849
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x408800
cmp edi, ebx
jge 0x408860
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x408804
jmp 0x408864
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x40880d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x408902
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x408902
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x4088b4
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x4088a0
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x408902
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x4088c0
dec eax
mov ecx, 1
xor esi, esi
jmp 0x40891c
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x4087cb
test edx, edx
mov dword [esp], ecx
js 0x408950
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408960
inc ebp
dec edx
cmp edi, ebp
jne 0x408930
mov edx, 0xffffffff
jmp 0x408962
xor edi, edi
jmp 0x408965
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x408910
and ebp, 3
je 0x408998
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408980
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40899a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x408910
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x4089b0
jmp 0x408910
Function at 0x4092c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x445fa0]
cmp eax, 0x270
jne 0x40931f
mov eax, 0xfffff640
mov edx, dword [0x445fa4]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x446968]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x446f98]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x447324], esi
add eax, 4
jne 0x4092e0
mov eax, 0x270
jmp 0x409335
cmp eax, 0x4e0
jb 0x409335
mov ecx, 0x445fa0
call fcn.00409580
mov eax, dword [0x445fa0]
lea ecx, [eax + 1]
mov dword [0x445fa0], ecx
mov eax, dword [eax*4 + 0x445fa4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x447324]
xor ecx, eax
mov eax, ecx
shl eax, 7
mov edx, eax
xor edx, 0x62d3a97f
or eax, 0x9d2c5680
and eax, edx
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret

Function at 0x409580
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
mov edx, edi
xor edx, 0x7fffffff
or edi, 0x80000000
and edi, edx
mov edx, dword [ecx + eax*4 - 0x630]
mov esi, edx
and esi, 0x7fffffff
or esi, edi
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, edi
mov edi, dword [ecx + eax*4]
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
mov edi, edx
cmp eax, 0x4e1
jne 0x409590
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x4095f0
mov edx, dword [ecx + 0x1380]
mov esi, edx
not esi
or esi, 0x80000000
mov eax, 0x7fffffff
and eax, dword [ecx + 4]
add edx, esi
inc edx
or eax, edx
mov edx, eax
shr edx, 1
and eax, 1
neg eax
xor edx, dword [ecx + 0x634]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x40b270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
mov dword [esp], eax
test bl, bl
je 0x40b51f
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
dec ebp
mov dword [esp], eax
nop
nop
nop
nop
nop
nop
nop
test edi, edi
je 0x40b2ac
cmp edx, edi
jae 0x40b51f
test ebp, ebp
je 0x40b51f
mov eax, ebp
movzx ebp, bl
mov ecx, ebp
xor ecx, 0xffffff7f
mov esi, ebp
or esi, 0x80
test esi, ecx
je 0x40b2f0
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40b320
cmp bl, 0xc2
jae 0x40b355
mov ebp, eax
jmp 0x40b307
inc edx
mov ebx, dword [esp]
lea ecx, [ebx + 2]
mov word [ebx], bp
mov ebp, eax
mov esi, ecx
sub esi, ebx
sar esi, 1
sub ebp, esi
mov dword [esp], ecx
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40b2a0
jmp 0x40b51f
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40b384
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40b3d4
cmp ebp, 0xe0
jne 0x40b3dd
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40b2df
jmp 0x40b3dd
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40b3c2
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
mov ebx, dword [esp]
lea ecx, [ebx + 2]
mov word [ebx], si
jmp 0x40b2fa
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40b3ca
cmp bl, 0xf4
ja 0x40b2df
movzx ecx, byte [edx + 1]
je 0x40b430
cmp ebp, 0xf0
mov ebp, eax
jne 0x40b43b
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40b307
jmp 0x40b43b
inc edx
mov ebp, eax
jmp 0x40b309
mov ebx, dword [esp]
mov ecx, ebx
jmp 0x40b2fa
cmp cl, 0x9f
ja 0x40b2df
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b428
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b4fb
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp + 4]
and esi, 0x3f
or esi, ecx
mov ebx, dword [esp]
mov word [ebx], si
lea ecx, [ebx + 2]
add edx, 3
jmp 0x40b2fa
inc edx
mov ebp, eax
jmp 0x40b307
cmp cl, 0x8f
mov ebp, eax
ja 0x40b307
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b505
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b4fb
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b50b
and ebp, 0x3f
shl ebp, 6
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
or ecx, ebp
add edx, 4
mov esi, ecx
and esi, 0x1ff800
cmp esi, 0xd800
je 0x40b2df
mov esi, dword [esp + 4]
and esi, 0x3f
or esi, ecx
cmp esi, 0x10000
mov ebp, eax
jb 0x40b307
cmp ebp, 2
jb 0x40b515
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov ebx, dword [esp]
mov word [ebx], cx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [ebx + 4]
mov word [ebx + 2], si
jmp 0x40b2fc
add edx, 2
mov ebp, eax
jmp 0x40b309
inc edx
jmp 0x40b307
add edx, 3
mov ebp, eax
jmp 0x40b309
mov ebx, dword [esp]
mov ecx, ebx
jmp 0x40b2fc
mov eax, dword [esp]
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c600
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov ebp, dword [esp + 0x448]
mov dword [esp + 0x34], 0x85eb83cf
mov dword [esp + 0x38], 0x89e1871c
mov dword [esp + 0x3c], 0x8de08be6
mov dword [esp + 0x40], 0xb19f8fef
mov dword [esp + 0x44], 0xb59ab3e7
mov dword [esp + 0x48], 0xb998b7e6
mov dword [esp + 0x4c], 0xbdcbbb92
mov dword [esp + 0x50], 0xa1cebfd7
mov dword [esp + 0x54], 0xa5cba3c6
mov dword [esp + 0x58], 0xa93ba731
mov dword [esp + 0x5c], 0xade2ab8a
mov dword [esp + 0x60], 0xd1f0afda
mov dword [esp + 0x64], 0xd584d383
mov dword [esp + 0x68], 0xd988d7f8
mov dword [esp + 0x6c], 0xddfcdb81
mov dword [esp + 0x70], 0xc1a9dfa9
mov dword [esp + 0x74], 0xc592c3ac
mov dword [esp + 0x78], 0xc993c792
mov dword [esp + 0x7c], 0xcd54cbea
mov dword [esp + 0x80], 0xf1a4cf98
mov dword [esp + 0x84], 0xf5d4f3db
mov dword [esp + 0x88], 0xf968f7b7
mov dword [esp + 0x8c], 0xfd90fb6a
mov dword [esp + 0x90], 0xe197ff9b
mov dword [esp + 0x94], 0xe586e387
mov dword [esp + 0x98], 0xe981e7ad
mov dword [esp + 0x9c], 0xedc3eb7e
mov dword [esp + 0xa0], 0x1143efbb
mov dword [esp + 0xa4], 0x153a1345
mov dword [esp + 0xa8], 0x194e1745
mov dword [esp + 0xac], 0x1d341b3a
mov dword [esp + 0xb0], 0x1481f55
mov dword [esp + 0xb4], 0x5490376
mov dword [esp + 0xb8], 0x924074a
mov dword [esp + 0xbc], 0xd600b2a
mov dword [esp + 0xc0], 0x315b0f67
mov dword [esp + 0xc4], 0x35143357
mov dword [esp + 0xc8], 0x395d3771
mov dword [esp + 0xcc], 0x3d573b59
mov dword [esp + 0xd0], 0x21093f51
mov dword [esp + 0xd4], 0x25672302
mov dword [esp + 0xd8], 0x29ba274e
mov dword [esp + 0xdc], 0x2d412b45
mov dword [esp + 0xe0], 0x517f2f4b
mov dword [esp + 0xe4], 0x55055303
mov dword [esp + 0xe8], 0x5976570f
mov dword [esp + 0xec], 0x5d725b0a
mov dword [esp + 0xf0], 0x416e5f0e
mov dword [esp + 0xf4], 0x45644312
mov dword [esp + 0xf8], 0x49294735
mov dword [esp + 0xfc], 0x4d2d4b2c
mov dword [esp + 0x100], 0x71194fdc
mov dword [esp + 0x104], 0x7521735d
mov dword [esp + 0x108], 0x792f7725
mov dword [esp + 0x10c], 0x7d2f7b54
mov dword [esp + 0x110], 0x61607f28
mov eax, dword [0x447350]
mov dword [esp], eax
mov ecx, 0x52682b12
mov edx, 0x2d97d4ed
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x52682ade]
mov edi, ecx
and edi, esi
add edi, edi
sub edi, esi
lea ebx, [edx + edi]
add ebx, 0x80000000
and ebx, ecx
mov edi, ebx
and edi, 0x52682ffd
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
xor eax, 2
imul eax, edi
add ebx, eax
mov eax, ebx
xor eax, ecx
and ebx, edx
add ebx, ebx
sub ebx, eax
mov eax, esi
not eax
and eax, ebx
not ebx
and ebx, esi
sub ebx, eax
add bl, 0x70
mov byte [esp + ecx - 0x52682ade], bl
inc ecx
dec edx
cmp ecx, 0x52682bf2
jne 0x40c860
lea ebx, [esp + 0x34]
push 0
push 0
push 0
push 0
push ebx
call dword [esp + 0x14]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x4417e0]
mov ecx, 0xd08132a3
xor ecx, dword [0x4417e8]
add eax, ecx
inc eax
jmp eax
Function at 0x439eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], ecx
mov eax, dword [ecx]
test eax, eax
je 0x439f97
mov dword [esp + 4], eax
mov dword [esp], 0xcbcccdce
mov edx, 0x2ef40a89
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
not eax
movzx edi, byte [esp + edx - 0x2ef40a89]
mov esi, edi
and esi, 0xffffff84
mov ebx, edi
not ebx
or ebx, 0xa1358e7b
add ebx, edi
inc ebx
and eax, 4
mov ecx, edx
xor ecx, 0x84
mov ebp, edx
or ebp, 0xb
and ebp, ecx
or ebp, eax
xor esi, ebx
not ebx
xor esi, 0x84
or ebx, edi
not ebx
and ebx, 0x84
or ebx, esi
xor ebx, ebp
add bl, 0xb8
mov byte [esp + edx - 0x2ef40a89], bl
inc edx
cmp edx, 0x2ef40a8d
jne 0x439ee0
mov edx, dword [0x4486a8]
test edx, edx
je 0x439f8d
mov eax, dword [esp]
xor esi, esi
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xb430e561
je 0x439f70
inc esi
cmp edx, esi
jne 0x439f60
jmp 0x439f8d
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x439f8d
push dword [esp + 4]
push 4
push edx
push dword [0x4486b0]
call fcn.0043b5b0
add esp, 0x10
mov eax, dword [esp + 8]
mov dword [eax], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cb00
Capabilities:
Encode data using xor

Disassembly:
push eax
mov dword [esp], 0x49484716
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf6
xor cl, byte [esp + eax]
add cl, 0x50
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43cb10
mov eax, dword [esp]
mov eax, dword fs:[eax]
pop ecx
ret

Function at 0x43ce80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp + 0xc], 0xd2d17a62
mov ecx, 0x4d1437e7
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x4d1437db]
xor edx, ecx
mov esi, 0x38
sub esi, edx
add edx, 7
and esi, 0xd0
and edx, 0x2f
sub edx, esi
add dl, 0xd1
mov byte [esp + ecx - 0x4d1437db], dl
inc ecx
cmp ecx, 0x4d1437eb
jne 0x43cea0
xor ecx, ecx
cmp dword [esp + 0xc], eax
setne cl
jmp dword [ecx*4 + 0x445ee0]

Function at 0x43d420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d440
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43d45b
mov eax, 0xffffffff
jmp 0x43d45e
add eax, 0xa
push eax
call fcn.00408b60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43d4a1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43d490
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x66676869
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x46
xor dl, byte [esp + ecx]
add dl, 0xd0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43d500
mov esi, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43d57f
xor edx, edx
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43d540
inc edx
cmp ecx, edx
jne 0x43d530
jmp 0x43d57f
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d57f
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x4486b0]
mov edi, eax
call fcn.0043b5b0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408b70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d5c0
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x43d5e5
mov ecx, 0xffffffff
jmp 0x43d5e7
add ecx, ecx
push ecx
call fcn.00408b60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43d631
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43d620
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x66676869
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x46
xor dl, byte [esp + ecx]
add dl, 0xd0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43d690
mov esi, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43d701
xor edx, edx
mov ebx, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43d6d0
inc edx
cmp ecx, edx
jne 0x43d6c0
jmp 0x43d701
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d701
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x4486b0]
mov edi, eax
call fcn.0043b5b0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408b70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret