joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207e0
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00420800
add esp, 4
test al, al
je 0x420f50
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x9c
mov dword [esp + 0x14], 0
mov eax, 0x20219
mov ecx, 1
lea edi, [esp + 0x76]
jmp dword [ecx*4 + 0x446f74]
Function at 0x423740
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [0x44ab88]
mov dword [esp + 0x28], 0x2a68280e
mov dword [esp + 0x2c], 0x2ebf2cbd
mov dword [esp + 0x30], 0x52305015
mov dword [esp + 0x34], 0x563454c1
mov dword [esp + 0x38], 0x5a27587e
mov dword [esp + 0x3c], 0x5ece5c13
mov dword [esp + 0x40], 0x422440d5
mov dword [esp + 0x44], 0x462444d5
mov dword [esp + 0x48], 0x4a66482d
mov dword [esp + 0x4c], 0x4e334c60
mov dword [esp + 0x50], 0x721470e4
mov dword [esp + 0x54], 0x76e274e0
mov dword [esp + 0x58], 0x7aea7812
mov dword [esp + 0x5c], 0x7e517c13
mov dword [esp + 0x60], 0x620c60f9
mov dword [esp + 0x64], 0x66676409
mov dword [esp + 0x68], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x423820
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x8c092438
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xef
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x4237f0
lea esi, [esp + 0x7c]
lea ecx, [esp + 0x28]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x423843
mov eax, 0xffffffff
jmp 0x423846
lea eax, [edi + edi]
push eax
call fcn.00409a00
add esp, 4
mov ebp, eax
mov eax, dword [0x44ab88]
mov dword [esp + 0x28], 0xa2e4a4fa
mov dword [esp + 0x2c], 0x9e31a033
mov dword [esp + 0x30], 0x9a3c9c23
mov dword [esp + 0x34], 0x96389817
mov dword [esp + 0x38], 0x923194ca
mov dword [esp + 0x3c], 0x8e029021
mov dword [esp + 0x40], 0x8a108c03
mov dword [esp + 0x44], 0x8628881b
mov dword [esp + 0x48], 0x82d2841b
mov dword [esp + 0x4c], 0xfe2580d4
mov dword [esp + 0x50], 0xfa60fc70
mov dword [esp + 0x54], 0xf676f874
mov dword [esp + 0x58], 0xf266f46e
mov dword [esp + 0x5c], 0xeea3f061
mov dword [esp + 0x60], 0xea78ec67
mov dword [esp + 0x64], 0xe6e9e87f
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x3f
ja 0x42392d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
lea ebx, [ecx + edx]
add ebx, 0xf0291099
add ecx, 0xf0291099
and ecx, edx
add ecx, ecx
sub ebx, ecx
mov dword [esp + 4], ebx
mov ecx, dword [esp + 4]
add cl, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x40
jb 0x4238f0
push esi
push edi
push ebp
push 0x1f
lea ecx, [esp + 0x38]
push ecx
push 0
call eax
lea eax, [esp + 0x24]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0043eec0
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4472f4]
cmp dword [edx], eax
xchg ebp, eax
cmp dword [edx], eax
cmp edi, dword [edx]
inc edx
add byte [esi - 0x1fffbdc7], dh
cmp dword [edx], eax
invalid
Function at 0x42f1f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2e8
mov dword [esp + 0x2bc], 0x447ec4
mov dword [esp + 0x90], 0
lea eax, [esp + 0x90]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x442a08
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x442a18
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2b8], eax
mov eax, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2b8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2b4], 0x447ecc
mov dword [esp + 0x2ac], 0x447ed4
mov dword [esp + 0x2a4], 0x447edc
mov dword [esp + 0x29c], 0x447450
mov dword [esp + 0x298], 0x130
mov dword [esp + 0x294], 0x447450
mov dword [esp + 0x290], 0x131
mov dword [esp + 0x28c], 0x447ee4
mov dword [esp + 0x284], 0x447eec
mov dword [esp + 0x27c], 0x447450
mov dword [esp + 0x278], 0x134
mov dword [esp + 0x274], 0x447ef4
mov dword [esp + 0x26c], 0x447efc
mov dword [esp + 0x264], 0x447f04
mov dword [esp + 0x25c], 0x447f0c
mov dword [esp + 0x254], 0x447f14
mov dword [esp + 0x24c], 0x447450
mov dword [esp + 0x248], 0x13b
mov dword [esp + 0x244], 0x447450
mov dword [esp + 0x240], 0x13b
mov dword [esp + 0x23c], 0x447f1c
mov dword [esp + 0x234], 0x447f24
mov dword [esp + 0x22c], 0x447f2c
mov dword [esp + 0x224], 0x447f34
mov dword [esp + 0x21c], 0x447450
mov dword [esp + 0x218], 0x140
mov dword [esp + 0x214], 0x447f3c
mov dword [esp + 0x20c], 0x447450
mov dword [esp + 0x208], 0x142
mov dword [esp + 0x204], 0x447f44
mov dword [esp + 0x1fc], 0x447f4c
mov dword [esp + 0x1f4], 0x447f54
mov dword [esp + 0x1ec], 0x447450
mov dword [esp + 0x1e8], 0x146
mov dword [esp + 0x1e4], 0x447f5c
mov dword [esp + 0x1dc], 0x447f64
mov dword [esp + 0x1d4], 0x447450
mov dword [esp + 0x1d0], 0x149
mov dword [esp + 0x1cc], 0x447450
mov dword [esp + 0x1c8], 0x14a
mov dword [esp + 0x1c4], 0x447f6c
mov dword [esp + 0x1bc], 0x447450
mov dword [esp + 0x1b8], 0x14c
mov dword [esp + 0x1b4], 0x447450
mov dword [esp + 0x1b0], 0x14d
mov dword [esp + 0x1ac], 0x447450
mov dword [esp + 0x1a8], 0x14e
mov dword [esp + 0x1a4], 0x447450
mov dword [esp + 0x1a0], 0x14f
mov dword [esp + 0x19c], 0x447f74
mov dword [esp + 0x194], 0x447f7c
mov dword [esp + 0x18c], 0x447450
mov dword [esp + 0x188], 0x12e
mov dword [esp + 0x184], 0x447450
mov dword [esp + 0x180], 0x135
mov dword [esp + 0x17c], 0x447450
mov dword [esp + 0x178], 0x138
mov dword [esp + 0x174], 0x447450
mov dword [esp + 0x170], 0x13e
mov dword [esp + 0x16c], 0x447450
mov dword [esp + 0x168], 0x144
mov dword [esp + 0x164], 0x447450
mov dword [esp + 0x160], 0x147
mov dword [esp + 0x15c], 0x447450
mov dword [esp + 0x158], 0x150
xor ebx, ebx
jmp eax
Function at 0x4366c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x4366e0
mov dword [esp + 0xc], 0x86868437
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43673e
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add eax, 0xe50a8698
xor eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0xe4
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x436710
cmp ebx, 2
je 0x436766
lea eax, [ebx - 2]
mov edx, eax
sar edx, 1
mov dword [esp + 8], edx
mov esi, dword [esp + 0xc]
mov edi, esi
not edi
test al, 2
jne 0x43676d
mov eax, esi
cmp ebx, 4
jne 0x4367a6
jmp 0x4367f6
mov edx, ebp
jmp 0x4367f6
dec dword [esp + 8]
movzx edx, word [ecx]
add ecx, 2
xor edx, ebp
mov ebp, edx
and ebp, edi
mov dword [esp + 4], ebp
mov ebp, edx
not ebp
and ebp, esi
imul ebp, dword [esp + 4]
mov eax, edx
and eax, esi
mov dword [esp + 4], eax
mov eax, esi
or edx, esi
imul edx, dword [esp + 4]
add edx, ebp
mov ebp, edx
cmp ebx, 4
je 0x4367f6
mov esi, eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, edx
mov eax, ebp
and eax, edi
mov edx, ebp
not edx
and edx, esi
imul edx, eax
mov eax, ebp
and eax, esi
or ebp, esi
imul ebp, eax
add ebp, edx
movzx edx, word [ecx + ebx*2 + 2]
xor edx, ebp
mov eax, edx
and eax, edi
mov ebp, edx
not ebp
and ebp, esi
imul ebp, eax
mov eax, edx
and eax, esi
or edx, esi
imul edx, eax
add edx, ebp
add ebx, 2
cmp dword [esp + 8], ebx
jne 0x4367b0
mov eax, edx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ad60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x2b2a2d1c
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43adbe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x73f18862
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xb2
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43ad90
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [str.0KKw]
jmp dword [0x448ae4]

Function at 0x43ae00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448b04]

Function at 0x43b0c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x43b1b0
xor eax, eax
cmp dword [ecx], 0
jne 0x43b207
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x14131211
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43b179
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
lea esi, [eax + edx]
add eax, 0x21
and eax, edx
add eax, eax
sub esi, eax
add esi, 0x889ee021
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x2c]
add al, 0xcf
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43b140
mov eax, dword [esp + 0xc]
mov esi, dword [0x44ab8c]
test esi, esi
je 0x43b207
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44ab90]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43b210
inc edi
cmp esi, edi
jne 0x43b1a0
jmp 0x43b207
mov dword [esp + 0x14], 0xff30313a
mov word [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x43b203
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0xbea98a85
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x49
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x43b1d0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b207
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44ab94]
push esi
call fcn.0043cc20
add esp, 0x1c
jmp 0x43b207

Function at 0x43cb60
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x448c94]
Function at 0x43d750
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, dword [esp + 0x58]
movzx eax, word [ebx]
mov dword [esp + 0x28], 0x3f309781
mov word [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x43d7b0
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0xbea98a85
xor ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
add cl, 0x49
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x43d780
xor ecx, ecx
cmp dword [esp + 0x28], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x449018]
mov edi, dword [ebx + 0x3c]
mov ecx, dword [ebx + edi]
mov dword [esp + 0x28], 0x342b6779
mov word [esp + 0x2c], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x43d820
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x28]
add edx, 0x24cb678d
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x5c
mov esi, dword [esp]
mov byte [esp + esi + 0x28], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x43d7f0
xor edx, edx
cmp ecx, dword [esp + 0x28]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x449020]
mov ebp, dword [ebx + edi + 0x78]
cmp dword [ebx + edi + 0x7c], 0
sete al
test ebp, ebp
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x449028]
mov eax, dword [ebx + ebp + 0x20]
add eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + ebp + 0x24]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebx + ebp + 0x1c]
add eax, ebx
mov dword [esp + 0x14], eax
mov ecx, dword [0x44ab90]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 8], ebp
jmp dword [eax*4 + 0x449040]
xor eax, eax
jmp dword [0x44903c]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ddc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x28]
mov esi, 2
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec esi
cmp byte [ecx + edx + 1], 0
lea edx, [edx + 1]
jne 0x43dde0
mov dword [esp + 4], 0x5030392
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43de51
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
lea ebx, [eax + 0x4653c21]
lea ebp, [eax + edi]
add ebp, 0x4653c21
add eax, 0x21
or eax, ebx
and eax, edi
add eax, eax
sub ebp, eax
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
add al, 0xe0
mov edi, dword [esp]
mov byte [esp + edi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43de10
test edx, edx
je 0x43de75
mov edi, ecx
mov ecx, dword [esp + 4]
mov ebx, ecx
not ebx
test dl, 1
mov dword [esp + 0xc], ebx
jne 0x43de7e
mov ebx, dword [esp + 0x2c]
test esi, esi
jne 0x43deaa
jmp 0x43df10
mov eax, dword [esp + 0x2c]
jmp 0x43df10
movsx eax, byte [edi]
xor eax, dword [esp + 0x2c]
mov edx, eax
and edx, ebx
mov ebx, ecx
mov ebp, eax
not ebp
and ebp, ecx
imul ebp, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
mov edx, esi
neg edx
inc edi
add eax, ebp
mov ebx, eax
test esi, esi
je 0x43df10
xor esi, esi
mov eax, ebx
mov dword [esp + 8], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ebp, byte [edi + esi]
xor ebp, eax
mov eax, ebp
mov edi, dword [esp + 0xc]
and eax, edi
mov ebx, ebp
not ebx
and ebx, ecx
imul ebx, eax
mov eax, ebp
and eax, ecx
or ebp, ecx
imul ebp, eax
add ebp, ebx
mov eax, dword [esp + 8]
movsx eax, byte [eax + esi + 1]
xor eax, ebp
mov ebx, eax
and ebx, edi
mov edi, dword [esp + 8]
mov ebp, eax
not ebp
and ebp, ecx
imul ebp, ebx
mov ebx, eax
and ebx, ecx
or eax, ecx
imul eax, ebx
add eax, ebp
add esi, 2
cmp edx, esi
jne 0x43dec0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43df20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x3f303162
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43df7e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xbea98a85
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x49
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43df50
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x44942c]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp + 4], 0
mov esi, dword [edx]
xor ecx, ecx
cmp esi, edx
setne cl
mov dword [esp + 0x10], edx
jmp dword [ecx*4 + 0x449434]
jmp dword [edi*4 + 0x44944c]
mov ebx, dword [esi + 0x30]
xor ecx, ecx
test ebx, ebx
setne cl
mov edi, 1
jmp dword [ecx*4 + 0x44943c]
mov ebp, dword [esp + 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebp]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x43e010
or ecx, 0x20
movzx edx, word [ebx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x43e01f
or edx, 0x20
test cx, cx
je 0x43e02f
add ebp, 2
add ebx, 2
cmp cx, dx
je 0x43e000
xor eax, eax
cmp cx, dx
sete al
mov edx, dword [esp + 0x10]
jmp dword [eax*4 + 0x449444]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e310
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x2b2a2d1c
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43e36e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x73f18862
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xb2
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43e340
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4494ac]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4494b4]
mov edi, 1
jmp dword [edi*4 + 0x4494c4]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4494bc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ed30
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43ed4b
mov eax, 0xffffffff
jmp 0x43ed4e
add eax, 0xa
push eax
call fcn.00409a00
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43ed91
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43ed80
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x14131211
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43ee30
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x889ee021
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xcf
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43ee00
mov esi, dword [esp + 4]
mov ecx, dword [0x44ab8c]
test ecx, ecx
je 0x43eea1
xor edx, edx
mov edi, dword [0x44ab90]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x10f02cc2
je 0x43ee60
inc edx
cmp ecx, edx
jne 0x43ee50
jmp 0x43eea1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43eea1
lea esi, [esp + 4]
lea edx, [esp + 0x18]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x60]
push dword [esp + 0x70]
push 0
push esi
push edx
push dword [esp + 0x70]
push dword [esp + 0x70]
push 0xb
push dword [0x44ab94]
push ecx
mov edi, eax
call fcn.0043cc20
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00409a10
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43eec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43eee0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43eefb
mov eax, 0xffffffff
jmp 0x43eefe
add eax, 0xa
push eax
call fcn.00409a00
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43ef41
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43ef30
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 0xc], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x14131211
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43f000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x889ee021
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xcf
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43efd0
mov esi, dword [esp + 4]
mov ecx, dword [0x44ab8c]
test ecx, ecx
je 0x43f066
xor edx, edx
mov ebx, dword [0x44ab90]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x43f030
inc edx
cmp ecx, edx
jne 0x43f020
jmp 0x43f066
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f066
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push dword [esp + 0x54]
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44ab94]
push ecx
mov edi, eax
call fcn.0043cc20
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00409a10
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f0a0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43f0bb
mov eax, 0xffffffff
jmp 0x43f0be
add eax, 0xa
push eax
call fcn.00409a00
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43f101
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43f0f0
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp + 4], si
add ecx, edx
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x14131211
mov byte [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43f1c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x889ee021
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xcf
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43f190
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44ab8c]
test ecx, ecx
je 0x43f219
xor edx, edx
mov edi, dword [0x44ab90]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x8896be63
je 0x43f1f0
inc edx
cmp ecx, edx
jne 0x43f1e0
jmp 0x43f219
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43f219
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x44ab94]
push ecx
mov edi, eax
call fcn.0043cc20
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00409a10
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43f22f
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret