joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov eax, dword [esp + 0x90]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413ca0
sar esi, 1
lea ebx, [esp + 0x6c]
push ebx
push 0
push 0
push esi
push eax
push 0
call dword [0x443d50]
mov ebp, dword [esp + 0x6c]
mov edi, 0xffffffff
test ebp, ebp
jns 0x413cd4
mov eax, 0xffffffff
jmp 0x413cdb
lea eax, [ebp*2]
push eax
call fcn.00409690
add esp, 4
push ebx
push ebp
mov dword [esp + 0x1c], eax
push eax
push esi
mov ebp, dword [esp + 0xa0]
push ebp
push 0
call dword [0x443d50]
mov eax, dword [esp + 0x6c]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x413d13
add eax, eax
mov edi, eax
push edi
call fcn.00409690
add esp, 4
mov ebx, eax
mov dword [esp + 0x1c], 0x59865ba8
mov dword [esp + 0x20], 0x5dab5fbf
mov dword [esp + 0x24], 0x517253a8
mov dword [esp + 0x28], 0x55ad57ba
mov dword [esp + 0x2c], 0x699f6ba2
mov dword [esp + 0x30], 0x6d9f6f97
mov dword [esp + 0x34], 0x6162639e
mov byte [esp + 0x38], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1c
ja 0x413d9e
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x1c]
add eax, 0x9a73478f
xor eax, ecx
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x54]
add al, 0x35
mov ecx, dword [esp]
mov byte [esp + ecx + 0x1c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1d
jb 0x413d70
mov eax, dword [esp + 0x14]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x413dd1
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413dc0
mov word [eax], 0
movzx ecx, word [esp + 0x1c]
test cx, cx
je 0x413e01
lea edx, [esp + 0x1e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413df0
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00437f60
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43ead0]

Function at 0x414c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov ebp, dword [esp + 0x9c]
mov ebx, dword [esp + 0x94]
xor eax, eax
test ebp, ebp
setne al
xor ecx, ecx
mov dword [esp + 0x48], 0
mov dword [esp + 0x70], 0
jmp dword [eax*4 + 0x43ec18]
Function at 0x418130
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x418150
cmp eax, 0xffffffdd
jge 0x418167
mov eax, 0xffffffff
jmp 0x41816a
add eax, 0x22
push eax
call fcn.00409690
add esp, 4
mov esi, eax
mov dword [esp + 8], 0x39a73b98
mov dword [esp + 0xc], 0x25b727a4
mov dword [esp + 0x10], 0x218d23ba
mov dword [esp + 0x14], 0x2d852f89
mov dword [esp + 0x18], 0x29862b88
mov dword [esp + 0x1c], 0x15bc1783
mov dword [esp + 0x20], 0x118913bb
mov dword [esp + 0x24], 0x1d821f84
mov word [esp + 0x28], 0x1b1c
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x41820e
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x6b2fc90b
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0xc9
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x4181e0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x418231
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x418220
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x418261
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418250
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0xf345f145
mov dword [esp + 0xc], 0xff8bfd46
mov dword [esp + 0x10], 0xfb42f955
mov dword [esp + 0x14], 0xc76bc578
mov dword [esp + 0x18], 0xc371c176
mov dword [esp + 0x1c], 0xcf79cd65
mov dword [esp + 0x20], 0xcba1c97e
mov dword [esp + 0x24], 0xd7bdd5bf
mov dword [esp + 0x28], 0xd374d1ba
mov dword [esp + 0x2c], 0xdf6ddd61
mov dword [esp + 0x30], 0xdb68d975
mov dword [esp + 0x34], 0x27912567
mov dword [esp + 0x38], 0x239e2196
mov dword [esp + 0x3c], 0x2f962d81
mov dword [esp + 0x40], 0x2b632994
mov dword [esp + 0x44], 0x37733598
mov dword [esp + 0x48], 0x3332315a
mov byte [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x44
ja 0x418351
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x728529d4
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xdc
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x45
jb 0x418320
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x4185e0
push ecx
push esi
call fcn.00418ea0
add esp, 0x10
jmp dword [0x43ef24]
Function at 0x4184a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4184b0
cmp eax, 0xffffffed
jge 0x4184c7
mov eax, 0xffffffff
jmp 0x4184ca
add eax, 0x12
push eax
call fcn.00409690
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xf967fba8
mov dword [esp + 8], 0xfd71ff63
mov dword [esp + 0xc], 0xf120f328
mov dword [esp + 0x10], 0xf550f754
mov dword [esp + 0x14], 0xebf4
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x41854e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xc48498ff
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 5
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x418520
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x418571
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418560
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4185a1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418590
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00438120
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x43ef2c]
Function at 0x41c070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x443d50]
mov dword [esp + 0xc], 0x79357b57
mov dword [esp + 0x10], 0x65f667e8
mov dword [esp + 0x14], 0x610d6328
mov dword [esp + 0x18], 0x6d016ffc
mov dword [esp + 0x1c], 0x690e6b47
mov dword [esp + 0x20], 0x95fe9714
mov dword [esp + 0x24], 0x9100930f
mov dword [esp + 0x28], 0x9df59ffc
mov dword [esp + 0x2c], 0x99f49b02
mov dword [esp + 0x30], 0x8518870f
mov dword [esp + 0x34], 0x81e683e8
mov dword [esp + 0x38], 0x8d108ff0
mov dword [esp + 0x3c], 0x89e08b1d
mov dword [esp + 0x40], 0xb522b71f
mov dword [esp + 0x44], 0xb12fb3df
mov word [esp + 0x48], 0xbfb0
mov dword [esp + 0x4a], 0
mov word [esp + 0x4e], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x41c150
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add ecx, 0xbc7f2f6b
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xe9
mov edx, dword [esp]
mov byte [esp + edx + 0xc], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x41c120
mov edi, dword [esp + 0x64]
lea ecx, [esp + 8]
lea ebx, [esp + 0xc]
push ecx
push 0
push 0
push 0x1e
push ebx
push 0
call eax
mov ebp, dword [esp + 8]
test ebp, ebp
jns 0x41c177
mov eax, 0xffffffff
jmp 0x41c17e
lea eax, [ebp*2]
push eax
call fcn.00409690
add esp, 4
mov esi, eax
mov eax, dword [0x443d50]
mov dword [esp + 0xc], 0x3f7f395d
mov dword [esp + 0x10], 0x23b23dac
mov dword [esp + 0x14], 0x27872164
mov dword [esp + 0x18], 0x2b8b25b0
mov dword [esp + 0x1c], 0x2f92294d
mov dword [esp + 0x20], 0x13ba2d98
mov dword [esp + 0x24], 0x17841185
mov dword [esp + 0x28], 0x1bbf15b0
mov dword [esp + 0x2c], 0x1fb8198e
mov dword [esp + 0x30], 0x3941db5
mov dword [esp + 0x34], 0x7ba01a4
mov dword [esp + 0x38], 0xb9c05b4
mov dword [esp + 0x3c], 0xfa4099b
mov dword [esp + 0x40], 0x73de0da5
mov dword [esp + 0x44], 0x77e171d5
mov dword [esp + 0x48], 0x7574
mov byte [esp + 0x4c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x40
ja 0x41c260
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add ecx, 0x2f76178a
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x4e
mov edx, dword [esp]
mov byte [esp + edx + 0xc], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x41
jb 0x41c230
lea ecx, [esp + 8]
push ecx
push ebp
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp + 0xc], 0x39923b80
mov dword [esp + 0x10], 0x25b427a3
mov dword [esp + 0x14], 0x21892388
mov dword [esp + 0x18], 0x2d802fbe
mov dword [esp + 0x1c], 0x29b42bbb
mov dword [esp + 0x20], 0x15161784
mov word [esp + 0x24], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x19
ja 0x41c2ee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0xc]
add eax, 0x8dfb720b
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xc9
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1a
jb 0x41c2c0
jmp dword [0x43f6bc]
Function at 0x4226c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
cmp edi, 0x24
ja 0x42271a
cmp edi, 1
je 0x42271a
mov ebp, dword [esp + 0x38]
mov ebx, ebp
jmp 0x4226f1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x4226f0
cmp ecx, 0x20
je 0x4226f0
cmp ecx, 0x2b
mov edx, edi
je 0x422710
cmp ecx, 0x2d
jne 0x42272f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x422734
xor edi, edi
test esi, esi
je 0x422915
mov dword [esi], 0x16
jmp 0x422915
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42275d
cmp edx, 0x10
jne 0x422775
cmp byte [ebx], 0x30
jne 0x422756
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x422777
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x422777
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x1c], ecx
sub eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
xor edx, edx
div edi
mov dword [esp + 0x20], eax
xor ebp, ebp
mov dword [esp + 8], 0
mov edx, edi
mov dword [esp + 0x18], edi
inc ebx
jmp 0x4227d1
mov ebp, ecx
mov dword [esp + 8], 0
mov esi, dword [esp + 0x44]
test esi, esi
je 0x4228b0
mov dword [esi], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x422813
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x4228e4
mov edx, eax
and edx, 0x20
mov ecx, edx
not ecx
lea ebp, [eax + ecx]
add ebp, 0x21
add eax, 0x21
sub edx, eax
and edx, 0x61
and ebp, 0xffffff9e
sub ebp, edx
mov edx, dword [esp + 0x18]
add ebp, 0xa
cmp ebp, edx
jge 0x4228e4
mov eax, edi
mov ecx, dword [esp + 0xc]
xor eax, ecx
mov esi, dword [esp + 8]
or eax, esi
je 0x4227b0
mov dword [esp + 0x14], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x20], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x422860
xor edx, edx
mov esi, dword [esp + 0xc]
jmp 0x422869
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 0xc]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
mov dword [esp + 8], ecx
cmp edi, esi
mov ecx, dword [esp + 0xc]
sbb eax, edx
setae al
jae 0x422895
mov dword [esp + 8], 0
mov ebp, ecx
and bl, al
mov esi, dword [esp + 0x44]
test esi, esi
mov edx, dword [esp + 0x18]
je 0x4228cb
test bl, bl
jne 0x4228cb
mov ebx, dword [esp + 0x14]
jmp 0x4227c6
mov dword [esp + 0x10], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
mov dword [esp + 8], 0
jmp 0x4227ab
test bl, bl
jne 0x4228d7
mov dword [esp + 0x10], 0x22
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], ebx
jmp 0x4227ab
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4228f2
mov ecx, dword [esp + 4]
mov dword [eax], ecx
test esi, esi
mov eax, dword [esp + 0x10]
je 0x4228fc
mov eax, dword [esi]
cmp eax, 0x22
jne 0x42290c
mov edi, SysReAllocString
sub edi, dword [esp + 0x1c]
jmp 0x422915
cmp byte [esp + 3], 0
jne 0x422915
neg edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42bd90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42bdbf
jmp 0x42bef6
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
jmp 0x42bdf3
xor ebx, ebx
test al, 1
jne 0x42bdfe
jmp 0x42beee
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.004097a0
add esp, 4
mov edx, eax
cmp edx, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42be2e
jmp 0x42bee2
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x27
mov byte [ebp - 0x27], 0xd
mov byte [ebp - 0x26], 0xf
mov byte [ebp - 0x25], 7
mov byte [ebp - 0x24], 0xa
mov byte [ebp - 0x23], 6
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x1d
mov byte [ebp - 0x20], 0xc
mov byte [ebp - 0x1f], 0xc3
mov byte [ebp - 0x1e], 2
mov byte [ebp - 0x1d], 7
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x8d
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x11
jne 0x42be70
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x42bebd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0042c260
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x42be84
jmp 0x42bebf
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00409fc0
mov bl, al
and bl, 1
jmp 0x42bee2
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42bef6
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x430820
mov dword [esp + 4], 0xbebabc31
mov dword [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 7
ja 0x43088c
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
lea ebx, [esi + 0x9f]
add esi, edi
and ebx, edi
add ebx, ebx
sub esi, ebx
add esi, 0xb81a49f
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x10]
add bl, 0xe5
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 8
jb 0x430850
test edx, edx
je 0x4308fe
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x4308c6
mov dword [esp + 0xc], edi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx]
xor eax, edi
imul eax, esi
add ecx, 2
inc ebp
cmp ebx, ebp
jne 0x4308b0
sub edx, ebp
mov edi, dword [esp + 0xc]
cmp edi, 3
jb 0x4308fe
xor edi, edi
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x4308d0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x431160
mov eax, esi
and eax, 0xfffffffc
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 3
mov edx, dword [esp]
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
mov ecx, dword [esp]
shr edx, 2
movzx eax, byte [edi + ecx - 1]
cmp eax, 0x3d
je 0x43119e
cmp eax, 0x2e
jne 0x43119f
dec edx
movzx eax, byte [edi + ecx - 2]
cmp eax, 0x3d
je 0x4311ae
cmp eax, 0x2e
jne 0x4311af
dec edx
mov dword [esp + 8], edx
mov edx, 0
test ecx, ecx
je 0x4312ad
xor esi, esi
mov ebp, 2
jmp 0x4311e2
mov edx, dword [esp + 4]
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x4312ad
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00416710
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.00416710
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
cmp ebp, ecx
jae 0x4311d0
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 8], edx
call fcn.00416710
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x4311d0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea edx, [esi + 2]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x44]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp]
mov ecx, dword [esp]
jae 0x4311c9
mov ebx, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
call fcn.00416710
add esp, 4
cmp al, 0x40
jne 0x43128b
mov edx, dword [esp + 4]
jmp 0x4312a5
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
mov edx, dword [esp + 4]
xor edx, 1
and esi, 1
lea edx, [edx + esi*2]
mov ecx, dword [esp]
jmp 0x4311d0
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x431345
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x431341
cmp ebx, 0x21
je 0x43132b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x431300
test bl, 1
je 0x431341
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433e80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x441aac]

Function at 0x433f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x74757a7b
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x433f6e
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xb63fd016
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x92
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x433f40
mov edi, dword [esp + 4]
mov eax, dword [0x443d54]
test eax, eax
je 0x433fc6
xor ecx, ecx
mov edx, dword [0x443d58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x433fa0
inc ecx
cmp eax, ecx
jne 0x433f90
jmp 0x433fc6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x433fc6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x443d5c]
push eax
call fcn.00435eb0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x434105
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.00433dd0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x74757a7b
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x434040
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0xb63fd016
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x92
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x434010
mov edi, dword [esp + 4]
mov edx, dword [0x443d54]
test edx, edx
je 0x434096
xor ebx, ebx
mov ebp, dword [0x443d58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x434071
inc ebx
cmp edx, ebx
jne 0x434060
jmp 0x434096
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x434096
push 0
push ecx
push eax
push 5
push 4
push dword [0x443d5c]
push edx
mov esi, eax
call fcn.00435eb0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x4340fc
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x4340d5
add ebx, 2
cmp bp, si
je 0x4340c0
cmp bp, si
je 0x4340e7
mov ebx, dword [edx]
test ebx, ebx
jne 0x4340b0
mov edi, 0xc0000225
jmp 0x4340fc
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.00433e80
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4