joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43c8b2
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x43ca4e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43ca4e
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov eax, 3
mov ebp, 0x3ef55dcc
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 3]
mov edi, eax
and edi, 0xb
xor edi, 0x12c5094b
mov ecx, ebp
or ecx, 0x2c307494
add ecx, eax
add ecx, 0xc10aa231
or ecx, edi
xor edx, 0xd3cf8b6b
mov edi, edx
and edi, ecx
add edx, ecx
add edi, edi
sub edx, edi
inc dl
mov byte [esp + eax - 3], dl
inc eax
dec ebp
cmp eax, 9
jne 0x43c8d0
mov eax, dword [esp]
mov ecx, dword [0x44ac38]
test ecx, ecx
je 0x43c940
xor edx, edx
mov edi, dword [0x44ac3c]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43c946
inc edx
cmp ecx, edx
jne 0x43c930
jmp 0x43c970
mov ebp, dword [esp + 0x20]
jmp 0x43c970
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43c970
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x43ca4e
push 0x732f71fd
push dword [0x452c54]
call fcn.0043e240
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov edx, 3
mov esi, 0x3ef55dcc
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 3]
mov edi, edx
and edi, 0xb
xor edi, 0x12c5094b
mov ebp, esi
or ebp, 0x2c307494
add ebp, edx
add ebp, 0xc10aa231
or ebp, edi
xor ebx, 0xd3cf8b6b
mov edi, ebx
and edi, ebp
add ebx, ebp
add edi, edi
sub ebx, edi
inc bl
mov byte [esp + edx - 3], bl
inc edx
dec esi
cmp edx, 9
jne 0x43c9c0
mov edx, dword [0x44ac38]
test edx, edx
je 0x43ca4e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43ca30
inc edi
cmp edx, edi
jne 0x43ca20
jmp 0x43ca4e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ca4e
push ecx
push 1
push edx
push dword [0x44ac40]
mov esi, eax
call fcn.0043b650
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dd70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x8f8e89f8
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
lea edx, [eax + 0xecff22]
or edx, 0xec689c20
xor edx, ecx
lea ecx, [edx + 0x5f5f0455]
mov esi, ecx
and esi, 1
mov edi, 0xaa
sub edi, edx
and edi, 0x81
and ecx, 0x7e
or ecx, edi
xor ecx, 0x80
lea ecx, [ecx + esi*2]
mov byte [esp + eax + 8], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb case.default.0x43ddee
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x449678]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov dword [esp], 0
mov esi, dword [0x449698]
mov edx, dword [ecx]
xor eax, eax
mov dword [esp + 0x10], ecx
cmp edx, ecx
setne al
jmp dword [eax*4 + 0x449680]
mov dword [esp + 4], edx
mov eax, dword [edx + 0x30]
xor edx, edx
test eax, eax
setne dl
mov dword [esp + 0x14], 1
mov ecx, dword [esp + 0x2c]
mov ebp, eax
jmp dword [edx*4 + 0x449688]
mov ecx, dword [esp + 0x2c]
mov ebp, eax
jmp esi
movzx ebx, word [ecx]
lea edx, [ebx - 0x41]
cmp dx, 0x1a
jae 0x43de87
or ebx, 0x20
movzx edx, word [ebp]
lea edi, [edx - 0x41]
cmp di, 0x1a
jae 0x43de97
or edx, 0x20
test bx, bx
je 0x43de70
add ebp, 2
add ecx, 2
cmp bx, dx
je case.0x43ddee.5
jmp 0x43de70
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x14]
jmp dword [eax*4 + 0x4496b8]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43e0e2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x939291a0
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xdc
xor dl, byte [esp + eax]
add dl, 0xb4
mov byte [esp + eax], dl
inc eax
cmp eax, 6
jne case.default.0x43e0c1
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4496f8]
jmp 0x43e0cd
mov ecx, dword [eax + 8]
mov edx, dword [case.0x43e0c1.3]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x449710]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43e480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi + edx], 0
lea edx, [edx + 1]
jne 0x43e4a0
lea eax, [edi + edx]
dec eax
add edx, edi
neg edx
mov ecx, edi
not ecx
and ecx, eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x22262489
mov dword [esp + 0xc], 0
mov dword [esp], edi
and edx, edi
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 8]
mov ebx, eax
not ebx
or ebx, 0x103dcbb9
mov ebp, eax
and ebp, 1
sub ebx, ebp
lea ebx, [ebx + eax*2]
add ebx, 0x2921e9ba
and ebx, 0x18e41dff
xor ebx, edi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x62
mov byte [esp + eax + 8], bl
mov edi, eax
and edi, 6
or eax, 0x6ac8e216
add eax, edi
add eax, 0x95371deb
cmp eax, 8
jb 0x43e4e0
mov ebx, dword [esp + 4]
sub ebx, edx
je 0x43e546
mov edi, dword [esp + 8]
mov ebp, edi
not ebp
inc edx
test bl, 1
jne 0x43e54d
jmp 0x43e575
mov eax, esi
jmp 0x43e5d8
dec ebx
mov ecx, dword [esp + 0x28]
movsx eax, byte [ecx]
inc ecx
mov dword [esp], ecx
xor eax, esi
mov ecx, eax
and ecx, ebp
mov esi, eax
not esi
and esi, edi
imul esi, ecx
mov ecx, eax
and ecx, edi
or eax, edi
imul eax, ecx
add eax, esi
mov esi, eax
cmp dword [esp + 4], edx
mov ecx, dword [esp]
je 0x43e5d8
xor edx, edx
mov eax, esi
mov dword [esp + 0x10], ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx esi, byte [ecx + edx]
xor esi, eax
mov eax, esi
and eax, ebp
mov ebx, esi
not ebx
and ebx, edi
imul ebx, eax
mov eax, esi
and eax, edi
or esi, edi
imul esi, eax
add esi, ebx
movsx eax, byte [ecx + edx + 1]
xor eax, esi
mov esi, eax
and esi, ebp
mov ebx, eax
not ebx
and ebx, edi
imul ebx, esi
mov esi, eax
and esi, edi
or eax, edi
imul eax, esi
add eax, ebx
mov ebx, dword [esp + 0x10]
add edx, 2
cmp ebx, edx
jne 0x43e590
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ea90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43eaa0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43eabb
mov eax, 0xffffffff
jmp 0x43eabe
add eax, 0xa
push eax
call fcn.0040c9f0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43eb01
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43eaf0
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
lea esi, [ecx - 0x3ef55dcd]
lea edi, [ecx + 0x33]
or esi, edi
and esi, edx
mov edi, esi
and edi, 0x3d
mov ebx, esi
and ebx, 2
mov ebp, esi
or ebp, 0xfd
inc ebp
imul ebp, edi
or esi, 2
imul esi, ebx
sub ebp, esi
add edx, ecx
add edx, 0xc10aa233
add edx, ebp
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 4
or ecx, 0xd1ba3f34
add ecx, edx
inc ecx
mov edx, ecx
xor edx, 0xd1ba3f34
and ecx, 0xb
add ecx, ecx
sub ecx, edx
cmp ecx, 6
jb 0x43eb70
mov esi, dword [esp]
mov ecx, dword [0x44ac38]
test ecx, ecx
je 0x43ec45
xor edx, edx
mov edi, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43ec00
inc edx
cmp ecx, edx
jne 0x43ebf0
jmp 0x43ec45
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43ec45
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0xb
push ecx
push dword [0x44ac40]
mov edi, eax
call fcn.0043b650
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.0040ca00
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ec60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ec70
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43ec8b
mov eax, 0xffffffff
jmp 0x43ec8e
add eax, 0xa
push eax
call fcn.0040c9f0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43ecd1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43ecc0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
lea esi, [ecx - 0x3ef55dcd]
lea ebx, [ecx + 0x33]
or esi, ebx
and esi, edx
mov ebx, esi
and ebx, 0x3d
mov ebp, esi
and ebp, 2
mov edi, esi
or edi, 0xfd
inc edi
imul edi, ebx
or esi, 2
imul esi, ebp
sub edi, esi
add edx, ecx
add edx, 0xc10aa233
add edx, edi
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 4
or ecx, 0xd1ba3f34
add ecx, edx
inc ecx
mov edx, ecx
xor edx, 0xd1ba3f34
and ecx, 0xb
add ecx, ecx
sub ecx, edx
cmp ecx, 6
jb 0x43ed40
mov esi, dword [esp]
mov ecx, dword [0x44ac38]
test ecx, ecx
je 0x43ee07
xor edx, edx
mov ebx, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43edd0
inc edx
cmp ecx, edx
jne 0x43edc0
jmp 0x43ee07
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43ee07
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x44ac40]
mov edi, eax
call fcn.0043b650
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040ca00
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ee20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ee40
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43ee5b
mov eax, 0xffffffff
jmp 0x43ee5e
add eax, 0xa
push eax
call fcn.0040c9f0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43eea1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43ee90
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xc8cbcacd
mov word [esp + 0x24], 0
xor ecx, ecx
movzx edx, byte [esp + ecx + 0x20]
lea esi, [ecx - 0x3ef55dcd]
lea ebx, [ecx + 0x33]
or esi, ebx
and esi, edx
mov edi, esi
and edi, 0x3d
mov ebx, esi
or ebx, 0xfd
inc ebx
imul ebx, edi
mov edi, esi
and edi, 2
or esi, 2
imul esi, edi
sub ebx, esi
add edx, ecx
add edx, 0xc10aa233
add edx, ebx
inc dl
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 4
or ecx, 0xd1ba3f34
add ecx, edx
inc ecx
mov edx, ecx
xor edx, 0xd1ba3f34
and ecx, 0xb
add ecx, ecx
sub ecx, edx
cmp ecx, 6
jb 0x43ef00
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44ac38]
test ecx, ecx
je 0x43efb9
xor edx, edx
mov ebx, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x43ef90
inc edx
cmp ecx, edx
jne 0x43ef80
jmp 0x43efb9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43efb9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x44ac40]
mov ebx, eax
call fcn.0043b650
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040ca00
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43efcf
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43efe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor eax, eax
nop
movzx edx, byte [esp + eax]
lea ebx, [eax - 0x3ef55dcd]
lea ecx, [eax + 0x33]
or ebx, ecx
and ebx, edx
mov esi, ebx
and esi, 0x3d
mov ecx, ebx
or ecx, 0xfd
inc ecx
imul ecx, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
sub ecx, ebx
add edx, eax
add edx, 0xc10aa233
add edx, ecx
inc dl
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 4
or eax, 0xd1ba3f34
add eax, ecx
inc eax
mov ecx, eax
xor ecx, 0xd1ba3f34
and eax, 0xb
add eax, eax
sub eax, ecx
cmp eax, 6
jb 0x43f000
mov eax, dword [esp]
mov edx, dword [0x44ac38]
test edx, edx
je 0x43f0b8
xor ecx, ecx
mov ebx, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0x7cde1e50
je 0x43f090
inc ecx
cmp edx, ecx
jne 0x43f080
jmp 0x43f0b8
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, eax
je 0x43f0b8
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push ecx
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x20
test edi, edi
je 0x43f0c2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43f0d1
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
lea ebp, [eax - 0x3ef55dcd]
lea edi, [eax + 0x33]
or ebp, edi
and ebp, ebx
mov edi, ebp
and edi, 0x3d
mov esi, ebp
and esi, 2
mov ecx, ebp
or ecx, 0xfd
inc ecx
imul ecx, edi
or ebp, 2
imul ebp, esi
sub ecx, ebp
add ebx, eax
add ebx, 0xc10aa233
add ebx, ecx
inc bl
mov byte [esp + eax], bl
mov ecx, eax
and ecx, 4
or eax, 0xd1ba3f34
add eax, ecx
inc eax
mov ecx, eax
xor ecx, 0xd1ba3f34
and eax, 0xb
add eax, eax
sub eax, ecx
cmp eax, 6
jb 0x43f100
mov eax, dword [esp]
mov ebx, dword [0x44ac38]
test ebx, ebx
je 0x43f1c1
xor ebp, ebp
mov edi, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x43f190
inc ebp
cmp ebx, ebp
jne 0x43f180
jmp 0x43f1c1
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f1c1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x30
cmp eax, 0x103
jne 0x43f299
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax - 0x3ef55dcd]
lea esi, [eax + 0x33]
or edx, esi
and edx, ecx
mov esi, edx
and esi, 0x3d
mov edi, edx
and edi, 2
mov ebx, edx
or ebx, 0xfd
inc ebx
imul ebx, esi
or edx, 2
imul edx, edi
sub ebx, edx
add ecx, eax
add ecx, 0xc10aa233
add ecx, ebx
inc cl
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 4
or eax, 0xd1ba3f34
add eax, ecx
inc eax
mov ecx, eax
xor ecx, 0xd1ba3f34
and eax, 0xb
add eax, eax
sub eax, ecx
cmp eax, 6
jb 0x43f1e0
mov eax, dword [esp]
mov ecx, dword [0x44ac38]
test ecx, ecx
je 0x43f291
xor edx, edx
mov edi, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43f270
inc edx
cmp ecx, edx
jne 0x43f260
jmp 0x43f291
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f291
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x18
test eax, eax
js 0x43f299
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43f2b0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f2ae
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
lea ebp, [eax - 0x3ef55dcd]
lea edi, [eax + 0x33]
or ebp, edi
and ebp, ebx
mov edi, ebp
and edi, 0x3d
mov esi, ebp
and esi, 2
mov ecx, ebp
or ecx, 0xfd
inc ecx
imul ecx, edi
or ebp, 2
imul ebp, esi
sub ecx, ebp
add ebx, eax
add ebx, 0xc10aa233
add ebx, ecx
inc bl
mov byte [esp + eax], bl
mov ecx, eax
and ecx, 4
or eax, 0xd1ba3f34
add eax, ecx
inc eax
mov ecx, eax
xor ecx, 0xd1ba3f34
and eax, 0xb
add eax, eax
sub eax, ecx
cmp eax, 6
jb 0x43f2e0
mov eax, dword [esp]
mov ebx, dword [0x44ac38]
test ebx, ebx
je 0x43f3a1
xor ebp, ebp
mov edi, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x43f370
inc ebp
cmp ebx, ebp
jne 0x43f360
jmp 0x43f3a1
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f3a1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x30
cmp eax, 0x103
jne 0x43f479
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax - 0x3ef55dcd]
lea esi, [eax + 0x33]
or edx, esi
and edx, ecx
mov esi, edx
and esi, 0x3d
mov edi, edx
and edi, 2
mov ebx, edx
or ebx, 0xfd
inc ebx
imul ebx, esi
or edx, 2
imul edx, edi
sub ebx, edx
add ecx, eax
add ecx, 0xc10aa233
add ecx, ebx
inc cl
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 4
or eax, 0xd1ba3f34
add eax, ecx
inc eax
mov ecx, eax
xor ecx, 0xd1ba3f34
and eax, 0xb
add eax, eax
sub eax, ecx
cmp eax, 6
jb 0x43f3c0
mov eax, dword [esp]
mov ecx, dword [0x44ac38]
test ecx, ecx
je 0x43f471
xor edx, edx
mov edi, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43f450
inc edx
cmp ecx, edx
jne 0x43f440
jmp 0x43f471
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f471
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x18
test eax, eax
js 0x43f479
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43f487
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43f4b0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
xor eax, eax
movzx edi, byte [esp + eax]
lea ebx, [eax - 0x3ef55dcd]
lea ebp, [eax + 0x33]
or ebx, ebp
and ebx, edi
mov ebp, ebx
and ebp, 0x3d
mov ecx, ebx
and ecx, 2
mov edx, ebx
or edx, 0xfd
inc edx
imul edx, ebp
or ebx, 2
imul ebx, ecx
sub edx, ebx
lea ecx, [eax + edi]
add ecx, 0xc10aa233
add ecx, edx
inc cl
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 4
or eax, 0xd1ba3f34
add eax, ecx
inc eax
mov ecx, eax
xor ecx, 0xd1ba3f34
and eax, 0xb
add eax, eax
sub eax, ecx
cmp eax, 6
jb 0x43f510
mov eax, dword [esp]
mov edi, dword [0x44ac38]
test edi, edi
je 0x43f5c8
xor ebx, ebx
mov ebp, dword [0x44ac3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43f5a1
inc ebx
cmp edi, ebx
jne 0x43f590
jmp 0x43f5c8
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43f5c8
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 4
push edi
push dword [0x44ac40]
call fcn.0043b650
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10da60b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10da6200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10da60d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10da60c2
add dl, dl
jne 0x10da60e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10da6134
xor eax, eax
add dl, dl
jne 0x10da60ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10da61d5
add dl, dl
jne 0x10da60fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10da6108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10da6113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10da611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10da612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10da60cd
mov eax, 1
add dl, dl
jne 0x10da6142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10da614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10da6139
sub eax, ebx
mov ebx, 1
jne 0x10da6180
mov ecx, 1
add dl, dl
jne 0x10da6166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10da6171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10da615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10da60cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10da6197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10da61a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10da618e
cmp eax, 0x7d00
jae 0x10da61c5
cmp eax, 0x500
jb 0x10da61c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10da60cd
cmp eax, 0x7f
ja 0x10da61c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10da60cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10da61f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10da60cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10