joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433650
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4337c7
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
xor ebx, ebx
cmp esi, 0
je 0x4337c1
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.0042f280
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4336d4
jmp 0x4337b5
mov ebx, edi
add ebx, 1
mov dword [esp], ebx
call fcn.00408730
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.004274e0
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x8f
mov byte [esp + 0x15], 0xd5
mov byte [esp + 0x16], 0xd7
mov byte [esp + 0x17], 0xdf
mov byte [esp + 0x18], 0xaa
mov byte [esp + 0x19], 0xde
mov byte [esp + 0x1a], 0xa3
mov byte [esp + 0x1b], 0xd5
mov byte [esp + 0x1c], 0xa4
mov byte [esp + 0x1d], 0x93
mov byte [esp + 0x1e], 0xd2
mov byte [esp + 0x1f], 0xcf
mov byte [esp + 0x20], 0xd0
mov byte [esp + 0x21], 0x45
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x11
jne 0x433748
xor eax, eax
mov ebp, dword [esp + 0x28]
cmp eax, 0x11
jae 0x433787
movzx edx, byte [esp + eax + 0x14]
mov ecx, eax
add ecx, 0x45272792
xor ecx, edx
mov edx, ecx
shl edx, 1
and edx, 0x4a
xor ecx, 0x25
add ecx, edx
add cl, 1
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x43375b
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
call fcn.00409630
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], ebp
call fcn.00408740
jmp 0x4337b1
jmp 0x4337b3
jmp 0x4337b5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x437c40
mov dword [esp], ecx
lea eax, [ebx - 2]
mov dword [esp + 4], 0x323230a3
mov word [esp + 8], 0
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0x7d
sub edi, esi
and edi, 0x4e
mov edx, esi
and edx, 1
sub edx, edi
xor dl, byte [esp + esi + 4]
add dl, 0x7c
mov byte [esp + esi + 4], dl
lea edx, [esi + esi]
and edx, 2
mov edi, edx
and edi, esi
or edx, esi
xor edx, 1
add edx, edi
mov esi, edx
cmp edx, 6
jb 0x437c70
cmp ebx, 2
je 0x437cbb
mov edx, dword [esp + 4]
mov esi, eax
sar esi, 1
mov edi, edx
not edi
test al, 2
jne 0x437cc2
jmp 0x437cec
mov eax, ebp
jmp 0x437d48
dec esi
mov ecx, dword [esp + 0x24]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp], ecx
xor eax, ebp
mov ecx, eax
and ecx, edi
mov ebp, eax
not ebp
and ebp, edx
imul ebp, ecx
mov ecx, eax
and ecx, edx
or eax, edx
imul eax, ecx
add eax, ebp
mov ebp, eax
cmp ebx, 4
mov ecx, dword [esp]
je 0x437d48
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0xc], esi
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
and eax, edi
mov esi, ebp
not esi
and esi, edx
imul esi, eax
mov eax, ebp
and eax, edx
or ebp, edx
imul ebp, eax
add ebp, esi
movzx eax, word [ecx + ebx*2 + 2]
xor eax, ebp
mov esi, eax
and esi, edi
mov ebp, eax
not ebp
and ebp, edx
imul ebp, esi
mov esi, eax
and esi, edx
or eax, edx
imul eax, esi
mov esi, dword [esp + 0xc]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x437d00
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 0xc], 0xf0e0910
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
lea eax, [esp + 0xc]
mov ecx, 0x7d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov edi, ecx
and edi, esi
lea edx, [ecx - 0x4faa4600]
or edx, esi
not edx
or edx, edi
neg edx
lea esi, [edx + edx]
and esi, 0x16
xor edx, 0x74
sub edx, esi
add dl, 2
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x76
jne 0x437d80
mov ecx, dword [esp + 0xc]
mov dword [esp], 0x989b9a9d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
mov edx, eax
and edx, 1
mov esi, eax
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
mov ebx, eax
xor ebx, 0x1b
add ebx, edi
add ebx, edx
xor bl, byte [esp + eax]
add bl, 0x79
mov byte [esp + eax], bl
inc eax
cmp eax, 5
jne 0x437dc0
mov eax, dword [esp]
mov edx, dword [0x44ce64]
test edx, edx
je 0x437e41
xor esi, esi
mov edi, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xeb857808
je 0x437e20
inc esi
cmp edx, esi
jne 0x437e10
jmp 0x437e41
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x437e41
lea eax, [esp + 0x14]
push eax
push ecx
push 0xffffffffffffffff
push 0xc
push edx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x437f5e
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x989b9a9d
mov byte [esp + 4], 0
nop
nop
nop
nop
nop
mov eax, ebx
and eax, 1
mov edx, ebx
and edx, 2
mov esi, edx
xor esi, 2
imul esi, eax
or eax, 2
imul eax, edx
mov edx, ebx
xor edx, 0x1b
add edx, esi
add edx, eax
xor dl, byte [esp + ebx]
add dl, 0x79
mov byte [esp + ebx], dl
inc ebx
cmp ebx, 5
jne 0x437e60
mov eax, dword [esp]
mov edx, dword [0x44ce64]
test edx, edx
je 0x437ecc
xor esi, esi
mov edi, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x8869e8e9
je 0x437ec0
inc esi
cmp edx, esi
jne 0x437eb0
jmp 0x437ecc
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x437f68
mov dword [esp], 0x989b9a9d
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 1
mov edi, edx
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, esi
or esi, 2
imul esi, edi
mov ebx, edx
xor ebx, 0x1b
add ebx, ebp
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x79
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x437ee0
test eax, eax
setns bl
mov eax, dword [0x44ce64]
test eax, eax
je 0x437f5a
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x1b6183f2
je 0x437f40
inc esi
cmp eax, esi
jne 0x437f30
jmp 0x437f5a
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x437f5a
push ecx
push 4
push eax
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esp
lea esi, [esp + 0xc]
push eax
push 4
push esi
push 0x14
push ecx
push 0x14
push edx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x20
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0xc], 0
setne byte [esp + 0xb]
jmp 0x437ecc
Function at 0x438550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043fc50
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449234]

Function at 0x4388b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00440440
add esp, 0x14
test eax, eax
js 0x4389ef
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004408e0
add esp, 0x24
mov ecx, eax
xor esi, esi
mov eax, 0
test ecx, ecx
js 0x438950
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43891a
mov eax, 0xffffffff
jmp 0x438921
lea eax, [eax*2 + 2]
push eax
call fcn.00408730
add esp, 4
push edi
mov edi, eax
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.00440fa0
add esp, 0x14
test eax, eax
js 0x438945
mov eax, edi
jmp 0x438950
push edi
call fcn.00408740
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x989b9a9d
mov byte [esp + 8], 0
mov edx, esi
and edx, 1
mov edi, esi
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, edx
or edx, 2
imul edx, edi
mov ebx, esi
xor ebx, 0x1b
add ebx, ebp
add ebx, edx
xor bl, byte [esp + esi + 4]
add bl, 0x79
mov byte [esp + esi + 4], bl
inc esi
cmp esi, 5
jne 0x438960
mov edx, dword [0x44ce64]
test edx, edx
je 0x4389de
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x4389c0
inc edi
cmp edx, edi
jne 0x4389b0
jmp 0x4389de
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4389de
push ecx
push 4
push edx
push dword [0x44ce6c]
mov esi, eax
call fcn.0043d480
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x4389f1
lea eax, [esp + 4]
push eax
call fcn.0043fa30
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aaa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43ab80
xor eax, eax
cmp dword [ecx], 0
jne 0x43abec
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x989b9a9d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, eax
xor edi, 0xdfbb49e4
mov ebp, eax
or ebp, 3
and ebp, edi
mov edi, eax
and edi, 4
xor edi, 0xe4
mov ebx, eax
or ebx, 0x1b
add ebx, ebp
sub edi, ebp
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dl, pe_nt_image_headers32
sub dl, bl
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x43ab10
mov eax, dword [esp]
mov esi, dword [0x44ce64]
test esi, esi
je 0x43abec
xor edi, edi
mov ebx, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43abf6
inc edi
cmp esi, edi
jne 0x43ab70
jmp 0x43abec
mov dword [esp + 8], 0x94a4b74
mov byte [esp + 0xc], 0
mov edx, 0x7777c26d
lea eax, [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov edi, esi
not edi
lea ecx, [edx - 1]
or edi, ecx
mov ebx, edi
not ebx
and edi, 2
mov ebp, ebx
and ebp, 0xffffff9d
imul ebp, edi
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
add ebx, ebp
sub ebx, esi
add ebx, edx
mov edx, ebx
and edx, 0x60
add edx, edx
xor ebx, 0x1f
sub ebx, edx
add bl, 2
mov byte [eax], bl
inc eax
mov edx, ecx
cmp ecx, 0x7777c268
jne 0x43aba0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43abec
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push dword [esp + 0x44]
push ecx
push 0x10
push esi
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x1c
jmp 0x43abec

Function at 0x43ac20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43ace8
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0x989b9a9d
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
xor edi, 0xdfbb49e4
mov ebp, edx
or ebp, 3
and ebp, edi
mov edi, edx
and edi, 4
xor edi, 0xe4
mov ebx, edx
or ebx, 0x1b
add ebx, ebp
sub edi, ebp
xor ebx, edi
and ebx, esi
xor ebx, edi
mov al, pe_nt_image_headers32
sub al, bl
mov byte [esp + edx], al
inc edx
cmp edx, 5
jne 0x43ac50
mov edx, dword [0x44ce64]
test edx, edx
je 0x43acdb
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ce68]
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43acba
mov eax, edi
xor eax, 1
and edi, 1
lea edi, [eax + edi*2]
cmp edi, edx
jb 0x43aca0
jmp 0x43acdb
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43acdb
push dword [esp + 8]
push 4
push edx
push dword [0x44ce6c]
mov esi, ecx
call fcn.0043d480
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43acf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43ada0
mov eax, dword [ecx]
test eax, eax
je 0x43ada0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x989b9a9d
mov byte [esp + 8], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi + 4]
mov eax, edi
xor eax, 0xdfbb49e4
mov esi, edi
or esi, 3
and esi, eax
mov eax, edi
and eax, 4
xor eax, 0xe4
mov edx, edi
or edx, 0x1b
add edx, esi
sub eax, esi
xor edx, eax
and edx, ebx
xor edx, eax
mov al, pe_nt_image_headers32
sub al, dl
mov byte [esp + edi + 4], al
inc edi
cmp edi, 5
jne 0x43ad30
mov eax, dword [esp + 4]
mov ebx, dword [0x44ce64]
test ebx, ebx
je 0x43ae14
xor edx, edx
mov edi, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xaf0e0c2e
je 0x43adf0
inc edx
cmp ebx, edx
jne 0x43ad90
jmp 0x43ae14
mov dword [esp + 4], 0x591a1b14
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x9b0d567b
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x64f2a989]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x99
mov byte [esp + eax + 0x64f2a989], cl
inc eax
cmp eax, 0x9b0d5682
jne 0x43adc0
mov eax, dword [esp + 4]
jmp 0x43af15
mov edx, dword [edi + edx*8 + 4]
cmp edx, eax
je 0x43ae14
push dword [ebp + 8]
push dword [esp + 0x10]
push 8
push edx
push dword [0x44ce6c]
mov esi, ecx
call fcn.0043d480
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43af08
cmp eax, 0xc000010a
jne 0x43af08
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x989b9a9d
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 4]
mov edi, eax
xor edi, 0xdfbb49e4
mov edx, eax
or edx, 3
and edx, edi
mov edi, eax
and edi, 4
xor edi, 0xe4
mov ebx, eax
or ebx, 0x1b
add ebx, edx
sub edi, edx
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dl, pe_nt_image_headers32
sub dl, bl
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 5
jne 0x43ae70
mov eax, dword [esp + 4]
mov esi, dword [0x44ce64]
test esi, esi
je 0x43af08
xor edi, edi
mov ebx, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4c697c35
je 0x43aee0
inc edi
cmp esi, edi
jne 0x43aed0
jmp 0x43af08
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43af08
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 0xc
push edx
push dword [0x44ce6c]
mov esi, ecx
call fcn.0043d480
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43af15
mov esi, eax
call fcn.0043ac20
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43af20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0x989b9a9d
mov byte [esp + 4], 0
xor esi, esi
nop
nop
nop
nop
nop
movzx ebp, byte [esp + esi]
mov eax, esi
xor eax, 0xdfbb49e4
mov edi, esi
or edi, 3
and edi, eax
mov eax, esi
and eax, 4
xor eax, 0xe4
mov edx, esi
or edx, 0x1b
add edx, edi
sub eax, edi
xor edx, eax
and edx, ebp
xor edx, eax
mov al, pe_nt_image_headers32
sub al, dl
mov byte [esp + esi], al
inc esi
cmp esi, 5
jne 0x43af40
test ebx, ebx
jne 0x43af80
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44ce64]
test ebp, ebp
je 0x43afd7
xor edx, edx
mov esi, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43afb0
inc edx
cmp ebp, edx
jne 0x43afa0
jmp 0x43afd7
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43afd7
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43d3e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x449ae8]

Function at 0x43e250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x44]
movzx eax, word [eax]
mov dword [esp], 0x696a3537
mov byte [esp + 4], 0
mov ecx, 0xea45b5e7
mov edx, 0x15ba4a18
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x15ba4a19]
mov edi, ecx
xor edi, esi
or edi, edx
lea esi, [esi + edi*2]
add esi, ecx
add esi, 2
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x7c
mov byte [esp + ecx + 0x15ba4a19], bl
inc ecx
dec edx
cmp ecx, 0xea45b5ec
jne 0x43e280
xor ecx, ecx
cmp dword [esp], eax
setne cl
mov eax, dword [ecx*4 + 0x449eec]
mov ecx, 0xaeb7b209
xor ecx, dword [str.V7QP_X]
add eax, ecx
inc eax
mov edi, dword [esp + 0x44]
jmp eax

Function at 0x43ebf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x111e1fcc
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 4]
mov ebx, eax
and ebx, 5
mov esi, eax
and esi, 2
xor esi, 0xc53bb8ba
mov edx, eax
or edx, 0x3ac44745
add edx, ebx
mov edi, ecx
xor edi, edx
sub esi, ebx
or edi, esi
not edi
add edi, edi
xor edx, edi
and edi, esi
add edi, edi
sub edx, edi
add dl, cl
add dl, 0xa7
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 5
jne case.default.0x43ec63
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x44a4a8]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov esi, dword [0x44a4c4]
mov edi, dword [edx]
xor eax, eax
cmp edi, edx
setne al
mov dword [esp + 0xc], edx
jmp dword [eax*4 + 0x44a4b0]
jmp esi
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [0x44a4e8]
nop
nop
nop
nop
nop
jmp eax

Function at 0x43ef8f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x636261b0
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov ecx, 0x26912d18
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x26912d0c]
mov edx, ecx
and edx, esi
mov eax, edx
and eax, 2
mov edi, edx
or edx, 2
imul edx, eax
xor eax, 2
and edi, 0x1d
imul edi, eax
add edx, edi
add esi, ecx
mov eax, edx
xor eax, esi
not edx
and edx, esi
add edx, edx
sub edx, eax
mov eax, edx
or eax, 0xfe
add eax, edx
not edx
and edx, 1
add eax, edx
add al, 0x89
mov byte [esp + ecx - 0x26912d0c], al
inc ecx
cmp ecx, 0x26912d1f
jne 0x43efb0
mov eax, dword [esp + 0xc]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x44a558]
Function at 0x43f110
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x43424190
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
movzx edx, byte [esp + eax]
mov esi, eax
or esi, 0x8e5da690
xor esi, edx
add esi, 0x382bbf2f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 7
jb case.default.0x43f16f
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a5b8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44a5d0]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44a5d8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
int1
inc ebx
add bh, al
int1
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add bh, al
int1
inc ebx
add ch, cl
int1
inc ebx
add byte [ecx + esi*8 - 0xe44ffbd], ch
inc ebx
add byte [eax - 0x32ffbc0f], dl
int1
inc ebx
add byte [ecx + esi*8 - 0xd9fffbd], bl
inc ebx
add byte [eax - 0xe], ah
inc ebx
add byte [edx - 0xe], ah
inc ebx
add byte [eax - 0xe], ah
inc ebx
add byte [edx - 0xe], dh
inc ebx
add byte [eax - 0xb], bh
inc ebx
add bh, dh
inc ebx
add byte [eax - 0xb], bh
inc ebx
add byte [0x780043f3], bl
cmc
inc ebx
add byte [ecx - 0xb], ah
inc ebx
add byte [eax - 0xd], dh
inc ebx
add bh, bh
hlt

Function at 0x43f1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [esp + 0x4c]
movzx eax, word [ebx]
mov dword [esp], 0x21268df3
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
movzx esi, byte [esp + ecx]
lea edi, [ecx - 0x79bcf6b7]
mov edx, 0xb6
sub edx, ecx
xor edx, edi
and edx, esi
xor edx, edi
mov esi, 0xd4
sub esi, edx
add edx, 0x2b
and esi, 0x99
and edx, 0x66
or edx, 1
sub edx, esi
mov byte [esp + ecx], dl
mov edx, 2
sub edx, ecx
add ecx, 0x1d
and edx, 0x1c
and ecx, 0x23
sub ecx, edx
cmp ecx, 6
jb 0x43f200
mov ecx, dword [esp]
mov edx, dword [0x44a5f0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
Function at 0x43fa80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fa90
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43faab
mov eax, 0xffffffff
jmp 0x43faae
add eax, 0xa
push eax
call fcn.00408730
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43faf1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43fae0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x5492bfff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x5492bfff]
mov edi, ecx
or edi, esi
not esi
or esi, edx
and esi, edi
mov edi, 1
sub edi, esi
mov ebx, edi
not ebx
and ebx, 1
mov ebp, 0xfb
sub ebp, esi
and ebp, 0xfe
or edi, 0xfe
xor edi, ebp
lea ebx, [edi + ebx*2]
mov byte [esp + ecx - 0x5492bfff], bl
inc ecx
dec edx
cmp ecx, 0x5492c006
jne 0x43fb80
mov esi, dword [esp]
mov ecx, dword [0x44ce64]
test ecx, ecx
je 0x43fc35
xor edx, edx
mov edi, dword [0x44ce68]
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43fbf0
inc edx
cmp ecx, edx
jne 0x43fbe0
jmp 0x43fc35
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43fc35
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44ce6c]
mov edi, eax
call fcn.0043d480
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408740
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret