joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424f20
Capabilities:
Connect to wmi namespace via wbemlocator
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x408
mov eax, dword [ebp + 8]
mov dword [esp + 0x3bc], 0x43c5b4
mov ecx, dword [0x7ffe026c]
mov dword [eax], ecx
mov ecx, dword [0x7ffe0270]
mov dword [eax + 4], ecx
mov ecx, dword [0x7ffe0260]
mov dword [eax + 8], ecx
mov ecx, dword [0x7ffe0264]
sub ecx, 2
sete byte [eax + 0xc]
mov esi, eax
add esi, 0x10
mov dword [eax + 0x10], 0
mov ebx, eax
add ebx, 0x14
mov byte [eax + 0x14], 0
mov ecx, eax
add ecx, 0x28
mov dword [esp + 0x284], ecx
mov word [eax + 0x28], 0
mov ecx, eax
add ecx, 0x2a
mov dword [esp + 0x200], ecx
mov byte [eax + 0x2a], 0
mov dword [esp + 0x124], 0
lea eax, [esp + 0x124]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x437bc8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x437bd8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x3b8], eax
mov eax, dword [esp + 0x3bc]
mov ecx, dword [esp + 0x3b8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x3b4], 0x43c5bc
mov dword [esp + 0x3ac], 0x43c5c4
mov dword [esp + 0x3a4], 0x43c5cc
mov dword [esp + 0x39c], 0x43c5d4
mov dword [esp + 0x394], 0x43c5dc
mov dword [esp + 0x38c], 0x43c5e4
mov dword [esp + 0x384], 0x43c5ec
mov dword [esp + 0x37c], 0x43c5f4
mov dword [esp + 0x374], 0x43c5fc
mov dword [esp + 0x36c], 0x43c604
mov dword [esp + 0x364], 0x43c60c
mov dword [esp + 0x35c], 0x43c010
mov dword [esp + 0x358], 0x5a
mov dword [esp + 0x354], 0x43c614
mov dword [esp + 0x34c], 0x43c61c
mov dword [esp + 0x344], 0x43c624
mov dword [esp + 0x33c], 0x43c010
mov dword [esp + 0x338], 0x5e
mov dword [esp + 0x334], 0x43c62c
mov dword [esp + 0x32c], 0x43c010
mov dword [esp + 0x328], 0x60
mov dword [esp + 0x324], 0x43c634
mov dword [esp + 0x31c], 0x43c63c
mov dword [esp + 0x314], 0x43c644
mov dword [esp + 0x30c], 0x43c010
mov dword [esp + 0x308], 0x64
mov dword [esp + 0x304], 0x43c64c
mov dword [esp + 0x2fc], 0x43c654
mov dword [esp + 0x2f4], 0x43c010
mov dword [esp + 0x2f0], 0x67
mov dword [esp + 0x2ec], 0x43c010
mov dword [esp + 0x2e8], 0x68
mov dword [esp + 0x2e4], 0x43c010
mov dword [esp + 0x2e0], 0x69
mov dword [esp + 0x2dc], 0x43c010
mov dword [esp + 0x2d8], 0x6a
mov dword [esp + 0x2d4], 0x43c65c
mov dword [esp + 0x2cc], 0x43c664
mov dword [esp + 0x2c4], 0x43c010
mov dword [esp + 0x2c0], 0x6d
mov dword [esp + 0x2bc], 0x43c010
mov dword [esp + 0x2b8], 0x4f
mov dword [esp + 0x2b4], 0x43c010
mov dword [esp + 0x2b0], 0x52
mov dword [esp + 0x2ac], 0x43c010
mov dword [esp + 0x2a8], 0x55
mov dword [esp + 0x2a4], 0x43c010
mov dword [esp + 0x2a0], 0x5b
mov dword [esp + 0x29c], 0x43c010
mov dword [esp + 0x298], 0x62
mov dword [esp + 0x294], 0x43c010
mov dword [esp + 0x290], 0x65
mov dword [esp + 0x28c], 0x43c010
mov dword [esp + 0x288], 0x6b
jmp eax
Function at 0x4273a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x310
mov dword [esp + 0x2d4], 0x43c66c
mov dword [esp + 0xec], 0
lea eax, [esp + 0xec]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x437bc8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x437bd8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2d0], eax
mov eax, dword [esp + 0x2d4]
mov ecx, dword [esp + 0x2d0]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2cc], 0x43c674
mov dword [esp + 0x2c4], 0x43c67c
mov dword [esp + 0x2bc], 0x43c684
mov dword [esp + 0x2b4], 0x43c68c
mov dword [esp + 0x2ac], 0x43c694
mov dword [esp + 0x2a4], 0x43c010
mov dword [esp + 0x2a0], 0x7b
mov dword [esp + 0x29c], 0x43c69c
mov dword [esp + 0x294], 0x43c6a4
mov dword [esp + 0x28c], 0x43c6ac
mov dword [esp + 0x284], 0x43c010
mov dword [esp + 0x280], 0x80
mov dword [esp + 0x27c], 0x43c010
mov dword [esp + 0x278], 0x80
mov dword [esp + 0x274], 0x43c6b4
mov dword [esp + 0x26c], 0x43c6bc
mov dword [esp + 0x264], 0x43c010
mov dword [esp + 0x260], 0x83
mov dword [esp + 0x25c], 0x43c6c4
mov dword [esp + 0x254], 0x43c6cc
mov dword [esp + 0x24c], 0x43c6d4
mov dword [esp + 0x244], 0x43c6dc
mov dword [esp + 0x23c], 0x43c6e4
mov dword [esp + 0x234], 0x43c010
mov dword [esp + 0x230], 0x89
mov dword [esp + 0x22c], 0x43c6ec
mov dword [esp + 0x224], 0x43c010
mov dword [esp + 0x220], 0x8b
mov dword [esp + 0x21c], 0x43c010
mov dword [esp + 0x218], 0x8c
mov dword [esp + 0x214], 0x43c010
mov dword [esp + 0x210], 0x8d
mov dword [esp + 0x20c], 0x43c6f4
mov dword [esp + 0x204], 0x43c6fc
mov dword [esp + 0x1fc], 0x43c010
mov dword [esp + 0x1f8], 0x90
mov dword [esp + 0x1f4], 0x43c010
mov dword [esp + 0x1f0], 0x91
mov dword [esp + 0x1ec], 0x43c010
mov dword [esp + 0x1e8], 0x92
mov dword [esp + 0x1e4], 0x43c010
mov dword [esp + 0x1e0], 0x93
mov dword [esp + 0x1dc], 0x43c704
mov dword [esp + 0x1d4], 0x43c70c
mov dword [esp + 0x1cc], 0x43c010
mov dword [esp + 0x1c8], pe_nt_image_headers32
mov dword [esp + 0x1c4], 0x43c010
mov dword [esp + 0x1c0], 0x7d
mov dword [esp + 0x1bc], 0x43c010
mov dword [esp + 0x1b8], 0x84
mov dword [esp + 0x1b4], 0x43c010
mov dword [esp + 0x1b0], 0x87
mov dword [esp + 0x1ac], 0x43c010
mov dword [esp + 0x1a8], 0x95
xor ebx, ebx
jmp eax
Function at 0x428b80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, esp
call fcn.00409360
sub esp, 0x18
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0xc], esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x428bc4
jmp 0x428cfa
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x428cf2
sub esp, 4
mov dword [esi + 0x18], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esi + 0x14], eax
mov dword [esp], eax
call fcn.00408b90
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x428ce1
mov eax, dword [esi + 0xc]
mov cl, byte [eax]
mov byte [esi + 8], cl
mov byte [edi], 0x8b
mov byte [edi + 1], 0xd1
mov byte [edi + 2], 0xdb
mov byte [edi + 3], 0xd3
mov byte [edi + 4], 0xe6
mov byte [edi + 5], 0xd2
mov byte [edi + 6], 0xe7
mov byte [edi + 7], 0xd1
mov byte [edi + 8], 0xe0
mov byte [edi + 9], 0x97
mov byte [edi + 0xa], 0xae
mov byte [edi + 0xb], 0xb3
mov byte [edi + 0xc], 0xac
mov byte [edi + 0xd], 0x39
mov ecx, 0xe
mov byte [edi + ecx], 0
add ecx, 1
cmp ecx, 0x13
jne 0x428c6a
mov dword [esi + 4], 0
mov ecx, dword [esi + 4]
cmp ecx, 0x13
jae 0x428cc1
mov ecx, dword [esi + 4]
mov dword [esi + 0x10], edx
mov edx, dword [esi + 4]
movzx eax, byte [edi + edx]
mov ebx, ecx
add ebx, 0xa83504b6
mov edx, 0x49
sub edx, ecx
xor edx, ebx
and edx, eax
xor edx, ebx
mov dword [esi + 0x1c], edx
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x1c]
add al, 6
mov ecx, dword [esi + 4]
mov byte [edi + ecx], al
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
jmp 0x428c7d
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edi
mov eax, dword [esi + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00409560
mov bl, al
and bl, 1
jmp 0x428ce1
sub esp, 4
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x428cf2
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x428cfa
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42d6c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x42d6d0
test edx, edx
je 0x42d74a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x42d702
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x42d6f0
cmp esi, 3
jb 0x42d74a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x42d710
pop esi
pop edi
pop ebx
ret
Function at 0x42dd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
lea eax, [esp + 0x24]
push 0x68
push 7
push 0x100080
push eax
push dword [ebp + 8]
call fcn.00434840
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x20], 0
jmp dword [eax*4 + 0x43cec8]
Function at 0x430d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x232021f6
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x430ddb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, 0xa4
sub esi, ecx
add ecx, 0x20e8305b
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
add cl, 0x83
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x430da0
mov ecx, dword [esp + 8]
jmp dword [0x43d1cc]
Function at 0x430ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x3a393837
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov word [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x430f69
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 8
sub edx, eax
add eax, 0x4032cff7
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x3f
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x430f30
mov edi, dword [esp + 0x10]
mov eax, dword [0x43f060]
test eax, eax
je 0x430fb6
xor ecx, ecx
mov edx, dword [0x43f064]
nop
nop
cmp dword [edx + ecx*8], 0x10def2fc
je 0x430f90
inc ecx
cmp eax, ecx
jne 0x430f80
jmp 0x430fb6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x430fb6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x43f068]
push eax
call fcn.00432610
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x431108
mov dword [esp + 0x20], esi
push dword [esp + 8]
call fcn.00430d60
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 0x3a393837
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov word [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x431049
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
mov esi, 8
sub esi, eax
add eax, 0x4032cff7
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xc]
add al, 0x3f
mov edx, dword [esp]
mov byte [esp + edx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x431010
mov edi, dword [esp + 0x10]
mov edx, dword [0x43f060]
test edx, edx
je 0x431095
xor ebx, ebx
mov esi, dword [0x43f064]
nop
cmp dword [esi + ebx*8], 0x10def2fc
je 0x431070
inc ebx
cmp edx, ebx
jne 0x431060
jmp 0x431095
mov edx, dword [esi + ebx*8 + 4]
cmp edx, edi
je 0x431095
push 0
push ecx
mov eax, dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x43f068]
push edx
call fcn.00432610
add esp, 0x1c
mov edi, eax
test edi, edi
js 0x4310fc
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 4]
mov esi, dword [eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [eax + esi + 0x3c]
add eax, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edi + ebx]
movzx edx, word [ecx + ebx]
test si, si
je 0x4310d5
add ebx, 2
cmp si, dx
je 0x4310c0
cmp si, dx
je 0x4310e7
mov esi, dword [eax]
test esi, esi
jne 0x4310b0
mov edi, 0xc0000225
jmp 0x4310fc
mov ecx, dword [eax + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], ecx
mov eax, dword [eax + 0xdc]
mov dword [edx + 8], eax
xor edi, edi
push dword [esp + 4]
call fcn.00430e10
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x431140
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 4]
test edx, edx
je 0x431151
xor eax, eax
cmp dword [ecx], 0
je 0x431159
ret 4
mov eax, 0xc0000008
ret 4
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x431209
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, 8
sub esi, eax
add eax, 0x4032cff7
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0x3f
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x4311d0
mov eax, dword [esp + 8]
mov esi, dword [0x43f060]
test esi, esi
je 0x431265
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x43f064]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xcde6ec36
je 0x431240
inc edi
cmp esi, edi
jne 0x431230
jmp 0x431265
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x431265
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x43f068]
push esi
call fcn.00432610
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x431270
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x431362
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 0xd
ja 0x4312fb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, 8
sub edi, edx
add edx, 0x4032cff7
xor edi, edx
and edi, esi
xor edi, edx
mov dword [esp + 4], edi
mov edx, dword [esp + 4]
add dl, 0x3f
mov esi, dword [esp]
mov byte [esp + esi + 8], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 0xe
jb 0x4312c0
mov edx, dword [0x43f060]
test edx, edx
je 0x43134e
mov esi, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x43f064]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xa3c1f363
je 0x431330
inc edi
cmp edx, edi
jne 0x431320
jmp 0x43134e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43134e
push eax
push 1
push dword [0x43f068]
push edx
mov esi, ecx
call fcn.00432610
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431370
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc0000008
cmp dword [ecx + 4], 0
je 0x431579
mov edx, dword [ecx]
test edx, edx
je 0x431579
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x431409
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, 8
sub edi, eax
add eax, 0x4032cff7
xor edi, eax
and edi, esi
xor edi, eax
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x18]
add al, 0x3f
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x4313d0
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 8]
mov ebx, dword [0x43f060]
test ebx, ebx
je 0x431467
xor edi, edi
mov esi, dword [0x43f064]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0x45a3f4b9
je 0x431443
inc edi
cmp ebx, edi
jne 0x431430
mov edi, dword [ebp + 0x10]
jmp 0x431467
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x431467
push dword [ebp + 8]
push edx
push 2
push dword [0x43f068]
push esi
mov esi, ecx
call fcn.00432610
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x431565
cmp eax, 0xc000010a
jne 0x431565
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
mov edx, dword [ecx]
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xd
ja 0x43150c
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi + 8]
mov edi, 8
sub edi, eax
add eax, 0x4032cff7
xor edi, eax
and edi, esi
xor edi, eax
mov dword [esp], edi
mov eax, dword [esp]
add al, 0x3f
mov esi, dword [esp + 4]
mov byte [esp + esi + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe
jb 0x4314d0
mov eax, dword [esp + 8]
mov esi, dword [0x43f060]
test esi, esi
je 0x431565
xor edi, edi
mov ebx, dword [0x43f064]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x39c83604
je 0x431540
inc edi
cmp esi, edi
jne 0x431530
jmp 0x431565
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x431565
lea eax, [esp + 0x18]
push eax
push 0
push edx
push 3
push dword [0x43f068]
push esi
mov esi, ecx
call fcn.00432610
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x431572
mov esi, eax
call fcn.00431270
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x431580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
test edx, edx
jne 0x4315b8
lea edx, [esp + 0x18]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x431609
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, 8
sub edi, eax
add eax, 0x4032cff7
xor edi, eax
and edi, esi
xor edi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
add al, 0x3f
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x4315d0
mov eax, dword [esp + 8]
mov esi, dword [0x43f060]
test esi, esi
je 0x431654
xor edi, edi
mov ebx, dword [0x43f064]
nop
cmp dword [ebx + edi*8], 0xaead8b9f
je 0x431630
inc edi
cmp esi, edi
jne 0x431620
jmp 0x431654
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x431654
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x43f068]
push esi
call fcn.00432610
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x433870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x18], 0xb3b2b180
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov word [esp + 0x24], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xd
ja 0x4338ee
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
mov edx, 0xc7
sub edx, eax
add eax, 0x30f238
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
add al, 0x78
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe
jb 0x4338b0
mov eax, dword [esp + 0x18]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x43dad8]
jmp dword [0x43daec]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp + 8], 0
mov esi, dword [edx]
xor eax, eax
cmp esi, edx
setne al
mov dword [esp + 0xc], edx
jmp dword [eax*4 + 0x43daf0]
mov eax, dword [esp + 0x10]
jmp dword [eax*4 + 0x43db08]
mov esi, dword [esi]
xor eax, eax
cmp esi, edx
setne al
jmp dword [eax*4 + 0x43daf0]
mov ebx, dword [esi + 0x30]
xor eax, eax
test ebx, ebx
setne al
mov dword [esp + 0x10], 1
jmp dword [eax*4 + 0x43daf8]
mov ecx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x43398f
or edx, 0x20
movzx eax, word [ebx]
lea edi, [eax - 0x41]
cmp di, 0x1a
jae 0x43399e
or eax, 0x20
test dx, dx
je 0x4339ae
add ebx, 2
add ecx, 2
cmp dx, ax
je 0x433980
movzx eax, ax
movzx ecx, dx
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
xor ecx, ecx
cmp eax, edx
sete cl
mov edx, dword [esp + 0xc]
jmp dword [ecx*4 + 0x43db00]
mov eax, dword [esi + 0x18]
mov dword [esp + 8], eax
xor eax, eax
jmp dword [eax*4 + 0x43db08]
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x83828ddc
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x433ca9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, 0xe9
sub esi, eax
add eax, 0xf6c8d516
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0x66
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x433c70
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x43db68]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x43db70]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x43db70]
mov eax, dword [esi + 0x30]
xor edi, edi
jmp dword [edi*4 + 0x43db80]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x43db70]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x43db78]
mov edi, 1
jmp dword [edi*4 + 0x43db80]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret