joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418010
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x418030
cmp eax, 0xffffffdd
jge 0x418047
mov eax, 0xffffffff
jmp 0x41804a
add eax, 0x22
push eax
call fcn.00409510
add esp, 4
mov esi, eax
mov dword [esp + 8], 0x23ad21c2
mov dword [esp + 0xc], 0xdf4dddae
mov dword [esp + 0x10], 0xdb3bd94c
mov dword [esp + 0x14], 0xd74bd543
mov dword [esp + 0x18], 0xd34cd132
mov dword [esp + 0x1c], 0xcf52cd4d
mov dword [esp + 0x20], 0xcb47c92d
mov dword [esp + 0x24], 0xc748c55e
mov word [esp + 0x28], 0xc1c6
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x4180ee
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xcff4e6fb
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0x23
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x4180c0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x418111
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x418100
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x418141
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418130
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x3910d91
mov dword [esp + 0xc], 0x7db018e
mov dword [esp + 0x10], 0x3bb205e1
mov dword [esp + 0x14], 0x3fdb39ac
mov dword [esp + 0x18], 0x33a53dae
mov dword [esp + 0x1c], 0x37a531a9
mov dword [esp + 0x20], 0x2bf535a6
mov dword [esp + 0x24], 0x2ff129f7
mov dword [esp + 0x28], 0x23c02df2
mov dword [esp + 0x2c], 0x27b121b5
mov dword [esp + 0x30], 0xdb4c25c1
mov dword [esp + 0x34], 0xdf4dd91f
mov dword [esp + 0x38], 0xd346dd4e
mov dword [esp + 0x3c], 0xd75ed135
mov dword [esp + 0x40], 0xcb33d540
mov dword [esp + 0x44], 0xcf03c92c
mov dword [esp + 0x48], 0xc3c2cd12
mov byte [esp + 0x4e], 0
mov word [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x46
ja 0x418241
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xb14902d6
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x26
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x47
jb 0x418210
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x4184c0
push ecx
push esi
call fcn.00418a20
add esp, 0x10
jmp dword [0x43eea4]
Function at 0x418390
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4183a0
cmp eax, 0xffffffed
jge 0x4183b7
mov eax, 0xffffffff
jmp 0x4183ba
add eax, 0x12
push eax
call fcn.00409510
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x739d6db0
mov dword [esp + 8], 0x778f7195
mov dword [esp + 0xc], 0x7b487540
mov dword [esp + 0x10], 0x7f98799c
mov dword [esp + 0x14], 0x7d7c
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x13
ja 0x41842e
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xcf5fdae
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0x3e
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x14
jb 0x418400
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x418451
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418440
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x418481
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418470
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00437fd0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x43eeac]
Function at 0x41b0f0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x4440fc]
mov dword [esp + 8], 0x8bc885ad
mov dword [esp + 0xc], 0x8fed891b
mov dword [esp + 0x10], 0xb3e08de9
mov dword [esp + 0x14], 0xb720b1f5
mov dword [esp + 0x18], 0xbbf0b526
mov dword [esp + 0x1c], 0xbf2cb9dd
mov dword [esp + 0x20], 0xa397bdd9
mov dword [esp + 0x24], 0xa1a2
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1f
ja 0x41b180
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0xbd10a115
xor ecx, edx
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x58]
add cl, 0x6d
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x20
jb 0x41b150
lea edi, [esp + 0x68]
lea ebp, [esp + 8]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call eax
mov ebx, dword [esp + 0x68]
test ebx, ebx
jns 0x41b1a3
mov eax, 0xffffffff
jmp 0x41b1a6
lea eax, [ebx + ebx]
push eax
call fcn.00409510
add esp, 4
mov esi, eax
mov eax, dword [0x4440fc]
mov dword [esp + 8], 0x1b6e1945
mov dword [esp + 0xc], 0x17751583
mov dword [esp + 0x10], 0x13861171
mov dword [esp + 0x14], 0xf9e0d4d
mov dword [esp + 0x18], 0xb760998
mov dword [esp + 0x1c], 0x78a0565
mov dword [esp + 0x20], 0x35f0161
mov dword [esp + 0x24], 0x3d3c
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1f
ja 0x41b240
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0xc49d2e84
xor ecx, edx
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x58]
add cl, 0x64
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x20
jb 0x41b210
push edi
push ebx
push esi
push 0xe
push ebp
push 0
call eax
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 9
jns 0x41b25c
mov eax, 0xffffffff
jmp 0x41b263
lea eax, [eax*2 + 0x12]
push eax
call fcn.00409510
add esp, 4
mov edi, eax
mov dword [esp + 8], 0x6312611c
mov dword [esp + 0xc], 0x67056505
mov dword [esp + 0x10], 0x6b0b6903
mov dword [esp + 0x14], 0x6f0b6d0b
mov dword [esp + 0x18], 0x93929103
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x41b2de
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xe0334670
xor eax, ecx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x58]
add al, 0xf0
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x41b2b0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x41b301
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b2f0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41b331
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b320
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.00437fd0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f634]
Function at 0x42ba10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00418890
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
jmp 0x42ba28
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42ba3c
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42ba4d
jmp 0x42bb82
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x42ba79
cmp eax, 0
setne cl
jmp 0x42ba81
xor ebx, ebx
test cl, 1
jne 0x42ba8d
jmp 0x42bb7c
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.00409640
add esp, 4
jmp 0x42baaf
jmp 0x42bab1
cmp eax, 0
setne cl
jmp 0x42bab9
xor ebx, ebx
test cl, 1
jne 0x42bac5
jmp 0x42bb6d
mov cl, byte [edi]
mov byte [ebp - 0x14], cl
mov byte [esi], 0x53
mov byte [esi + 1], 0x79
mov byte [esi + 2], 0x73
mov byte [esi + 3], 0x7b
mov byte [esi + 4], 0x76
mov byte [esi + 5], 0x7a
mov byte [esi + 6], 0x67
mov byte [esi + 7], 0x89
mov byte [esi + 8], pe_nt_image_headers32
mov byte [esi + 9], 0x37
mov byte [esi + 0xa], 0x8e
mov byte [esi + 0xb], 0x8b
mov byte [esi + 0xc], 0x8c
mov byte [esi + 0xd], 1
mov ecx, 0xe
mov byte [esi + ecx], 0
add ecx, 1
cmp ecx, 0x13
jne 0x42bb06
jmp 0x42bb14
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x13
jae 0x42bb4d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
movzx edx, byte [esi + edx]
add ecx, 0xe2630482
xor ecx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
add cl, 0x72
mov edx, dword [ebp - 0x10]
mov byte [esi + edx], cl
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
jmp 0x42bb1b
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040a320
mov bl, al
and bl, 1
jmp 0x42bb6d
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x430820
test edx, edx
je 0x43089a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x430852
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x430840
cmp esi, 3
jb 0x43089a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x430860
pop esi
pop edi
pop ebx
ret
Function at 0x433e20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov dword [esp + 4], 0x8b8485d6
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 6
ja 0x433e80
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0xa7a0d115
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x6d
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 7
jb 0x433e50
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x44c11c]
add esp, 0x10
ret

Function at 0x433ea0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x441f40]
Function at 0x433f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3c3d3e3f
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x433fae
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x2ef9e858
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x98
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x433f80
mov edi, dword [esp + 4]
mov ecx, dword [0x444100]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp eax, ecx
je 0x434006
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0xcecd21fd
je 0x433fe1
add eax, 8
cmp eax, ecx
jne 0x433fd0
jmp 0x434006
mov eax, dword [eax + 4]
cmp eax, edi
je 0x434006
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x444104]
push eax
call fcn.00435b40
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x434135
push dword [esp + 8]
call fcn.00433e20
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x3c3d3e3f
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x434070
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x2ef9e858
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x98
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x434040
mov edi, dword [esp + 4]
mov esi, dword [0x444100]
mov edx, dword [esi]
mov ebx, dword [esi + 4]
cmp edx, ebx
je 0x4340c5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx], 0xcecd21fd
je 0x4340a1
add edx, 8
cmp edx, ebx
jne 0x434090
jmp 0x4340c5
mov edx, dword [edx + 4]
cmp edx, edi
je 0x4340c5
push 0
push ecx
push eax
push 5
push 4
push dword [0x444104]
push edx
mov esi, eax
call fcn.00435b40
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43412c
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x28]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x434105
add ebx, 2
cmp bp, si
je 0x4340f0
cmp bp, si
je 0x434117
mov ebx, dword [edx]
test ebx, ebx
jne 0x4340e0
mov edi, 0xc0000225
jmp 0x43412c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.00433ea0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x434170
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x2c
mov edx, dword [ecx + 4]
test edx, edx
je 0x434241
xor eax, eax
cmp dword [ecx], 0
jne 0x4342a2
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x3c3d3e3f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x434211
nop
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
add eax, 0x2ef9e858
xor eax, edx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x98
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x4341e0
mov eax, dword [esp + 8]
mov edx, dword [0x444100]
mov esi, dword [edx]
mov edi, dword [edx + 4]
cmp esi, edi
je 0x4342a2
mov edx, dword [esp + 0x38]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi], 0xeeeb5415
je 0x4342aa
add esi, 8
cmp esi, edi
jne 0x434230
jmp 0x4342a2
mov dword [esp + 0x14], 0xa3626168
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43429e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0xf8ddb870
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf0
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x434270
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop esi
pop edi
ret 4
mov esi, dword [esi + 4]
cmp esi, eax
je 0x4342a2
lea eax, [esp + 0xc]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x444104]
push esi
call fcn.00435b40
add esp, 0x1c
jmp 0x4342a2

Function at 0x4342d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x434390
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x3c3d3e3f
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x434330
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x2ef9e858
xor edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0x98
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x434300
mov esi, dword [0x444100]
mov edx, dword [esi]
mov esi, dword [esi + 4]
cmp edx, esi
je 0x43437e
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx], 0x625b6034
je 0x434361
add edx, 8
cmp edx, esi
jne 0x434350
jmp 0x43437e
mov edx, dword [edx + 4]
cmp edx, edi
je 0x43437e
push eax
push 1
push dword [0x444104]
push edx
mov esi, ecx
call fcn.00435b40
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0xc
pop esi
pop edi
ret
Function at 0x4343a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 4], 0
je 0x434431
mov edx, dword [ecx]
test edx, edx
je 0x434431
mov dword [esp], 0x3c3d3e3f
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x434401
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi]
add eax, 0x2ef9e858
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x98
mov esi, dword [esp + 4]
mov byte [esp + esi], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x4343d0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp]
mov edi, dword [0x444100]
mov ebx, dword [edi]
mov edi, dword [edi + 4]
cmp ebx, edi
je 0x4344a7
nop
nop
nop
nop
nop
nop
cmp dword [ebx], 0xc766965c
je 0x434487
add ebx, 8
cmp ebx, edi
jne 0x434420
jmp 0x4344a7
mov dword [esp + 8], 0xfbb8b9be
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43447e
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x335a3147
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xf
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x434450
mov eax, dword [esp + 8]
jmp 0x434592
mov edi, dword [ebx + 4]
cmp edi, eax
je 0x4344a7
push dword [ebp + 8]
push edx
push 2
push dword [0x444104]
push edi
mov edi, ecx
call fcn.00435b40
mov ecx, edi
add esp, 0x14
cmp esi, 1
mov edi, dword [ebp + 0x10]
mov edx, edi
sbb edx, 0
jl 0x434585
cmp eax, 0xc000010a
jne 0x434585
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43452e
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x10]
add eax, 0x2ef9e858
xor eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x98
mov esi, dword [esp]
mov byte [esp + esi + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x434500
mov eax, dword [esp + 0x10]
mov edi, dword [0x444100]
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x434585
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi], 0x7e28bda7
je 0x434561
add esi, 8
cmp esi, edi
jne 0x434550
jmp 0x434585
mov esi, dword [esi + 4]
cmp esi, eax
je 0x434585
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x444104]
push esi
mov esi, ecx
call fcn.00435b40
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x434592
mov esi, eax
call fcn.004342d0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4345a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x30]
test edx, edx
jne 0x4345b3
lea edx, [esp + 0xc]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x3c3d3e3f
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x4345fe
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0x2ef9e858
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x98
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x4345d0
mov eax, dword [esp + 4]
mov esi, dword [0x444100]
mov ebp, dword [esi]
mov esi, dword [esi + 4]
cmp ebp, esi
je 0x434652
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp], 0x3baba5e0
je 0x434632
add ebp, 8
cmp ebp, esi
jne 0x434620
jmp 0x434652
mov ebp, dword [ebp + 4]
cmp ebp, eax
je 0x434652
push edx
push ebx
push edi
push dword [esp + 0x30]
push ecx
push 5
push dword [0x444104]
push ebp
call fcn.00435b40
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4350c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov dword [esp + 0x30], 0x1b86198e
mov dword [esp + 0x34], 0x79205a8
mov dword [esp + 0x38], 0x3540194
mov dword [esp + 0x3c], 0xf9a0da0
mov dword [esp + 0x40], 0xb0a099c
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x13
ja 0x435133
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x30]
add eax, 0xf68a67ac
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x4c
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x14
jb 0x435100
lea eax, [esp + 0x30]
push eax
call fcn.00436f70
add esp, 4
mov dword [0x44c114], eax
mov esi, 0xe67bdc23
test eax, eax
je 0x435153
mov esi, 0x3058f4ff
mov edi, 0x67070d08
xor eax, eax
cmp edi, 0x25cb15bb
setl al
jmp dword [eax*4 + 0x441f68]