joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421e87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
push eax
sub esp, 0x7c
mov dword [ebp - 0x1c], esp
sub esp, 0x100
mov eax, esp
mov dword [ebp - 0x20], eax
mov ebx, eax
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x70
mov dword [ebp - 0x14], esp
sub esp, 0x24
mov esi, esp
sub esp, 0xc
mov dword [ebp - 0x18], esp
sub esp, 0x40
mov dword [ebp - 0x28], esp
sub esp, 0x80
mov dword [ebp - 0x38], esp
mov eax, dword [0x449d18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0x717e677c
mov ecx, 0x95
mov edi, 0x6a
nop
nop
movzx eax, byte [ebp + ecx - 0xc5]
mov edx, edi
xor edx, ecx
and edx, eax
xor edx, ecx
add dl, 0x17
mov byte [ebp + ecx - 0xc5], dl
inc ecx
dec edi
cmp ecx, 0x99
jne 0x40e4f0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x54], 0x219d27ad
mov dword [ebp - 0x50], 0x3d9a2396
mov dword [ebp - 0x4c], 0x39b23fb0
mov dword [ebp - 0x48], 0x354c3b88
mov dword [ebp - 0x44], 0x31823788
mov dword [ebp - 0x40], 0xd323384
mov dword [ebp - 0x3c], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
mov eax, edx
add al, 0x89
xor al, byte [ebp + edx - 0x54]
add al, 0x53
mov byte [ebp + edx - 0x54], al
inc edx
cmp edx, 0x1c
jne case.default.0x40e591
lea eax, [ebp - 0x54]
push ecx
push 0
push eax
call dword [ebp - 0x10]
mov ecx, 0x449ce0
push eax
call fcn.00439ce0
movzx eax, al
mov eax, dword [eax*4 + 0x444a38]
mov ecx, 0x7a5a2e15
xor ecx, dword [0x444a40]
add eax, ecx
inc eax
jmp eax
xor ebp, dword [ebp + 0x202444c7]
cmp dword [edi + 0x44c7514b], ebp
scasd eax, dword es:[edi]
dec ebx
push ecx
mov dword [esp + 0x24], 0x55bd53c1
scasd eax, dword es:[edi]
dec ebx
push ecx
mov dword [esp + 0x24], 0x55bd53c1
mov dword [esp + 0x28], 0x59c157bb
mov dword [esp + 0x2c], 0x5db15bb6
mov dword [esp + 0x30], 0x41bd5fb9
mov dword [esp + 0x34], 0x45a943d4
mov dword [esp + 0x38], 0x49a847d5
mov dword [esp + 0x3c], 0x4da94bdd
mov dword [esp + 0x40], 0x71de4fdc
mov dword [esp + 0x44], 0x755873e5
mov word [esp + 0x48], 0x7774
mov byte [esp + 0x4e], 0
mov dword [esp + 0x4a], 0
mov eax, 0xee40205d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x11bfdfa3]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x2e
mov byte [esp + eax + 0x11bfdfa3], cl
inc eax
cmp eax, 0xee4020ac
jne 0x421f00
lea eax, [esp + 0x54]
push eax
push 0x423ac0
lea eax, [esp + 8]
push eax
push edi
call fcn.0041fdf0
add esp, 0x10
mov ebx, eax
jmp dword [0x4464a0]
Function at 0x4255ec
Capabilities:
Encode data using xor

Disassembly:
mov ecx, esi
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x4255f0
sub eax, esi
cmp eax, 0xffffffd9
jge 0x425610
mov eax, 0xffffffff
jmp 0x425613
add eax, 0x26
push eax
call fcn.0040cc80
add esp, 4
mov ebx, eax
mov dword [esp + 0x1c], 0x913b9f30
mov dword [esp + 0x20], 0x950c9301
mov dword [esp + 0x24], 0x890d9732
mov dword [esp + 0x28], 0x8d268b11
mov dword [esp + 0x2c], 0x811f8f29
mov dword [esp + 0x30], 0x8524831e
mov dword [esp + 0x34], 0x791f871f
mov dword [esp + 0x38], 0x7dec7ba6
mov dword [esp + 0x3c], 0x71d87fd8
mov word [esp + 0x40], 0x7370
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor eax, eax
nop
nop
mov edx, eax
and edx, 0x1b
xor edx, 0x9b
mov ecx, eax
and ecx, 0x24
sub ecx, edx
xor cl, byte [esp + eax + 0x1c]
add cl, 7
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x2c
jne 0x425680
movzx ecx, word [esi]
mov eax, ebx
test cx, cx
je 0x4256d1
mov edx, esi
add edx, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4256c0
mov word [eax], 0
movzx ecx, word [esp + 0x1c]
test cx, cx
je 0x425701
lea edx, [esp + 0x1e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4256f0
mov word [eax], 0
mov dword [esp + 8], ebx
jmp dword [0x446ce4]

Function at 0x425710
Capabilities:
Copy file

Disassembly:
push esi
call fcn.0040cc90
add esp, 4
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x446cec]

Function at 0x425729
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x446cec]
Function at 0x42b8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42b9d5
mov edx, dword [esp + 0x18]
dec edx
je 0x42b9d5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42b8f0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x42b980
cmp ebx, 0x7ff
ja 0x42b920
cmp edx, 2
jb 0x42b920
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x42b980
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x42b99a
cmp edx, 4
jb 0x42b99a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
xor bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
mov ebx, eax
not ebx
or ebx, 0x3f
add ebx, eax
add bl, 0x81
mov byte [ebp + 2], bl
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x42b9d5
test edx, edx
jne 0x42b8d0
jmp 0x42b9d5
movzx eax, ax
cmp eax, 0xdc00
jne 0x42b9a8
mov esi, edi
jmp 0x42b988
cmp edx, 3
jb 0x42b9d1
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x42b980
mov eax, ebp
jmp 0x42b980
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430850
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
call fcn.00416ff0
sub esp, 0x14
mov edi, esp
jmp 0x430865
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x430882
xor ebx, ebx
test al, 1
jne 0x43088d
jmp 0x430a15
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x430a0d
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042b830
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4309fe
mov ecx, eax
and ecx, 1
shl ecx, 1
mov dword [ebp - 0x20], eax
mov ebx, eax
xor ebx, 1
add ebx, ecx
sub esp, 4
mov dword [esp], ebx
call fcn.0040cc80
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042b8a0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xe3
mov byte [edi + 1], 0x9d
mov byte [edi + 2], 0x9b
mov byte [edi + 3], 0x93
mov byte [edi + 4], 0x86
mov byte [edi + 5], 0x9a
mov byte [edi + 6], 0x87
mov byte [edi + 7], 0x95
mov byte [edi + 8], 0x9c
mov byte [edi + 9], 0xc7
mov byte [edi + 0xa], 0x8e
mov byte [edi + 0xb], 0xb3
mov byte [edi + 0xc], 0x88
mov byte [edi + 0xd], 0x3d
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x430968
mov ecx, dword [ebp + 8]
xor eax, eax
cmp eax, 0x13
jae 0x4309c4
movzx ecx, byte [edi + eax]
mov dword [ebp - 0x14], ecx
mov esi, ecx
xor esi, 0xffffffff
shl esi, 1
add esi, ecx
mov edx, 0xfe
sub edx, esi
mov esi, 0x37
sub esi, eax
or edx, esi
mov ebx, 0x37
sub ebx, eax
mov esi, 0x37
sub esi, eax
or ebx, esi
mov ecx, dword [ebp + 8]
and ebx, dword [ebp - 0x14]
xor edx, 0xffffffff
or ebx, edx
add bl, 0x18
mov byte [edi + eax], bl
add eax, 1
jmp 0x430979
jmp 0x4309c6
jmp 0x4309c8
jmp 0x4309ca
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.0040d710
mov bl, al
and bl, 1
jmp 0x4309ea
sub esp, 4
mov dword [esp], esi
call fcn.0040cc90
add esp, 4
jmp 0x4309fa
jmp 0x4309fc
jmp 0x4309fe
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x430a15
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 0xc], 0xb18e8f84
mov word [esp + 0x10], 0
mov eax, 0x9abfb95d
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x654046af]
xor edx, eax
mov ecx, edx
and ecx, 0x2e
add ecx, ecx
xor edx, 0xd1
sub ecx, edx
mov byte [esp + eax + 0x654046af], cl
inc eax
cmp eax, 0x9abfb963
jne 0x435720
mov ecx, dword [esp + 0xc]
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xeb
xor dl, byte [esp + eax]
add dl, 0x69
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x435760
mov eax, dword [esp]
mov edx, dword [0x44b030]
test edx, edx
je 0x4357cb
xor esi, esi
mov edi, dword [0x44b034]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x7ce2a696
je 0x4357aa
mov ebx, esi
and ebx, 1
xor esi, 1
lea esi, [esi + ebx*2]
cmp esi, edx
jb 0x435790
jmp 0x4357cb
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x4357cb
lea eax, [esp + 0x14]
push eax
push ecx
push 0xffffffffffffffff
push 3
push edx
push dword [0x44b038]
call fcn.0043b600
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x4358ae
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0xeb
xor al, byte [esp + ebx]
add al, 0x69
mov byte [esp + ebx], al
inc ebx
cmp ebx, 5
jne 0x4357f0
mov eax, dword [esp]
mov edx, dword [0x44b030]
test edx, edx
je 0x435838
xor esi, esi
mov edi, dword [0x44b034]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xb1b3ec83
je 0x435830
inc esi
cmp edx, esi
jne 0x435820
jmp 0x435838
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x4358b7
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xeb
xor bl, byte [esp + edx]
add bl, 0x69
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x435850
test eax, eax
setns bl
mov eax, dword [0x44b030]
test eax, eax
je 0x4358aa
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x44b034]
nop
nop
nop
cmp dword [edi + esi*8], 0xb62b8d10
je 0x435890
inc esi
cmp eax, esi
jne 0x435880
jmp 0x4358aa
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x4358aa
push ecx
push 1
push eax
push dword [0x44b038]
call fcn.0043b600
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov eax, esp
lea esi, [esp + 0xc]
push eax
push 4
push esi
push 0x14
push ecx
push 5
push edx
push dword [0x44b038]
call fcn.0043b600
add esp, 0x20
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0xc], 0
setne byte [esp + 0xb]
jmp 0x435838
Function at 0x436350
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043f880
add esp, 0x14
test eax, eax
js 0x436476
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043fcc0
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x4363ea
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4363b8
mov eax, 0xffffffff
jmp 0x4363bf
lea eax, [eax*2 + 2]
push eax
call fcn.0040cc80
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00440330
add esp, 0x14
test eax, eax
jns 0x4363ea
push esi
call fcn.0040cc90
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x787b7a7d
mov byte [esp + 8], 0
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0xeb
xor cl, byte [esp + ebx + 4]
add cl, 0x69
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 5
jne 0x436400
mov ecx, dword [0x44b030]
test ecx, ecx
je 0x43645a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44b034]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436440
inc edi
cmp ecx, edi
jne 0x436430
jmp 0x43645a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43645a
push eax
push 1
push ecx
push dword [0x44b038]
call fcn.0043b600
add esp, 0x10
test esi, esi
jne 0x436478
lea eax, [esp + 4]
push eax
call fcn.0043ee80
add esp, 4
test al, al
je 0x436476
cmp dword [esp + 4], 1
je 0x436478
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438330
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
mov eax, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xeb]
lea ecx, [eax - 0x6a48e400]
mov esi, eax
and esi, edx
or ecx, edx
xor ecx, esi
mov edx, ecx
not edx
and edx, 0x98
and ecx, 0x67
sub ecx, edx
inc cl
mov byte [esp + eax - 0xeb], cl
inc eax
cmp eax, 0xf0
jne 0x438360
mov edi, dword [esp]
mov eax, dword [0x44b030]
test eax, eax
je 0x4383e6
xor ecx, ecx
mov edx, dword [0x44b034]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x4383c0
inc ecx
cmp eax, ecx
jne 0x4383b0
jmp 0x4383e6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x4383e6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x44b038]
call fcn.0043b600
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xb7f60904
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xfe
xor cl, byte [esp + eax]
add cl, 0xa
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x438400
cmp edi, dword [esp]
jne 0x438535
mov dword [esp + 0xc], ebp
push dword [esp + 8]
call fcn.00438130
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
mov edx, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0xeb]
lea ecx, [edx - 0x6a48e400]
mov edi, edx
and edi, esi
or ecx, esi
xor ecx, edi
mov esi, ecx
not esi
and esi, 0x98
and ecx, 0x67
sub ecx, esi
inc cl
mov byte [esp + edx - 0xeb], cl
inc edx
cmp edx, 0xf0
jne 0x438450
mov edi, dword [esp]
mov ecx, dword [0x44b030]
test ecx, ecx
je 0x4384d5
xor edx, edx
mov esi, dword [0x44b034]
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x4384b0
inc edx
cmp ecx, edx
jne 0x4384a0
jmp 0x4384d5
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, edi
je 0x4384d5
push 0
push ebp
push eax
push 5
push 4
push ecx
push dword [0x44b038]
mov esi, eax
call fcn.0043b600
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43852c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x438505
add edi, 2
cmp si, bp
je 0x4384f0
cmp si, bp
je 0x438517
mov esi, dword [ecx]
test esi, esi
jne 0x4384e0
mov edi, 0xc0000225
jmp 0x43852c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00438230
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x438580
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x438650
xor eax, eax
cmp dword [ecx], 0
jne 0x4386bc
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
mov eax, 0xeb
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xeb]
lea ebx, [eax - 0x6a48e400]
mov edi, eax
and edi, esi
or ebx, esi
xor ebx, edi
mov esi, ebx
not esi
and esi, 0x98
and ebx, 0x67
sub ebx, esi
inc bl
mov byte [esp + eax - 0xeb], bl
inc eax
cmp eax, 0xf0
jne 0x4385f0
mov eax, dword [esp]
mov esi, dword [0x44b030]
test esi, esi
je 0x4386bc
xor edi, edi
mov ebx, dword [0x44b034]
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x4386c5
inc edi
cmp esi, edi
jne 0x438640
jmp 0x4386bc
mov dword [esp + 8], 0x19dadbdc
mov dword [esp + 0xc], 0
mov eax, 0xaaefc5cf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x55103a39]
lea edx, [ecx + ecx]
not edx
add edx, ecx
mov esi, eax
or esi, ecx
not ecx
and ecx, edx
lea edx, [ecx + ecx]
not edx
add edx, ecx
and edx, eax
xor edx, esi
add edx, 0xbfc3481c
mov ecx, edx
and ecx, 0x74
xor edx, 0xf4
lea ecx, [edx + ecx*2]
add cl, 0xe5
mov byte [esp + eax + 0x55103a39], cl
inc eax
cmp eax, 0xaaefc5d7
jne 0x438670
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4386bc
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x44b038]
call fcn.0043b600
add esp, 0x1c
jmp 0x4386bc

Function at 0x438700
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4387ba
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
mov edx, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0xeb]
lea ebx, [edx - 0x6a48e400]
mov edi, edx
and edi, esi
or ebx, esi
xor ebx, edi
mov esi, ebx
not esi
and esi, 0x98
and ebx, 0x67
sub ebx, esi
inc bl
mov byte [esp + edx - 0xeb], bl
inc edx
cmp edx, 0xf0
jne 0x438730
mov edx, dword [0x44b030]
test edx, edx
je 0x4387ae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44b034]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x438790
inc edi
cmp edx, edi
jne 0x438780
jmp 0x4387ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4387ae
push eax
push 1
push edx
push dword [0x44b038]
mov esi, ecx
call fcn.0043b600
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x438a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x438b24
push 0xbbf966b4
push dword [0x44b024]
call fcn.0043e6d0
add esp, 8
test eax, eax
je 0x438ae9
mov ecx, dword [esi]
test ecx, ecx
je 0x438b21
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x438afd
cmp dword [esp], 0
je 0x438afd
mov dword [esi + 4], 3
jmp 0x438b21
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x438bb7
lea eax, [esp + 0xc]
push eax
call fcn.0043ee80
add esp, 4
test al, al
je 0x438b21
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x438b1e
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x438bb7
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
mov eax, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xeb]
lea edx, [eax - 0x6a48e400]
mov ebx, eax
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
not esi
and esi, 0x98
and edx, 0x67
sub edx, esi
inc dl
mov byte [esp + eax - 0xeb], dl
inc eax
cmp eax, 0xf0
jne 0x438b50
mov eax, dword [esp]
mov edx, dword [0x44b030]
test edx, edx
je 0x438c54
xor esi, esi
mov ebx, dword [0x44b034]
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x438c30
inc esi
cmp edx, esi
jne 0x438ba0
jmp 0x438c54
mov dword [esp], 0x787b7a7d
mov byte [esp + 4], 0
mov eax, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xeb]
lea edx, [eax - 0x6a48e400]
mov ebx, eax
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
not esi
and esi, 0x98
and edx, 0x67
sub edx, esi
inc dl
mov byte [esp + eax - 0xeb], dl
inc eax
cmp eax, 0xf0
jne 0x438bd0
mov eax, dword [esp]
mov edx, dword [0x44b030]
test edx, edx
je 0x438c54
xor esi, esi
mov ebx, dword [0x44b034]
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x438c30
inc esi
cmp edx, esi
jne 0x438c20
jmp 0x438c54
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x438c54
push ecx
push ebp
push edi
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push edx
push dword [0x44b038]
call fcn.0043b600
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x438fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x438fd9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x438fea
cmp eax, 2
je 0x439060
jmp 0x43908d
push 0xbbf966b4
push dword [0x44b024]
call fcn.0043e6d0
add esp, 8
test eax, eax
je 0x43902b
mov ecx, dword [esi]
test ecx, ecx
je 0x439058
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x439034
cmp dword [esp + 4], 0
je 0x439034
mov dword [esi + 4], 3
jmp 0x439058
mov dword [esi + 4], 1
jmp 0x43908d
lea eax, [esp + 0xc]
push eax
call fcn.0043ee80
add esp, 4
test al, al
je 0x439058
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x439055
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43908d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x45304c]
call fcn.0043e6d0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x439134
mov ecx, dword [esi]
mov dword [esp + 4], 0x787b7a7d
mov byte [esp + 8], 0
mov eax, 0xeb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xe7]
lea edx, [eax - 0x6a48e400]
mov ebx, eax
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
not esi
and esi, 0x98
and edx, 0x67
sub edx, esi
inc dl
mov byte [esp + eax - 0xe7], dl
inc eax
cmp eax, 0xf0
jne 0x4390b0
mov eax, dword [esp + 4]
mov edx, dword [0x44b030]
test edx, edx
je 0x439134
xor esi, esi
mov ebx, dword [0x44b034]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x439110
inc esi
cmp edx, esi
jne 0x439100
jmp 0x439134
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x439134
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push edx
push dword [0x44b038]
call fcn.0043b600
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18