joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1118
call fcn.0040c830
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41ce90
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x450c14]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cec4
mov eax, 0xffffffff
jmp 0x41cec7
lea eax, [ebx + ebx]
push eax
call fcn.0040c8d0
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x450c14]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x41cefc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c8d0
add esp, 4
mov edi, eax
mov dword [esp + 0x114], 0xb9c6bbe8
mov dword [esp + 0x118], 0xbd2bbfdf
mov dword [esp + 0x11c], 0xb192b328
mov dword [esp + 0x120], 0xb52db7da
mov dword [esp + 0x124], 0xa93fab22
mov dword [esp + 0x128], 0xad3faf37
mov dword [esp + 0x12c], 0xa1a2a33e
mov byte [esp + 0x130], 0
mov eax, 0x9f
mov ecx, 0x60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x75]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xe5
mov byte [esp + eax + 0x75], dl
inc eax
dec ecx
cmp eax, 0xbc
jne 0x41cf70
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41cfc1
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cfb0
mov word [eax], 0
movzx ecx, word [esp + 0x114]
test cx, cx
je 0x41cff1
lea edx, [esp + 0x116]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cfe0
mov word [eax], 0
lea eax, [esp + 0xa8]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00443f70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b6fc]
Function at 0x422fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x422fe0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x450c14]
mov edi, dword [esp]
test edi, edi
jns 0x42300c
mov eax, 0xffffffff
jmp 0x42300f
lea eax, [edi + edi]
push eax
call fcn.0040c8d0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x450c14]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00444110
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44bba8]
Function at 0x424b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424b30
cmp eax, 0xffffffed
jge 0x424b47
mov eax, 0xffffffff
jmp 0x424b4a
add eax, 0x12
push eax
call fcn.0040c8d0
add esp, 4
mov esi, eax
mov dword [esp], 0x59e75be8
mov dword [esp + 4], 0x5dd15fe3
mov dword [esp + 8], 0x51205328
mov dword [esp + 0xc], 0x55f057f4
mov word [esp + 0x10], 0xab54
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, esp
mov ecx, 0xded7a710
nop
movzx edx, byte [eax]
mov ebx, ecx
or ebx, edx
not ebx
lea ebp, [ecx + 0x21285900]
and ebp, edx
or ebp, ebx
mov edx, ebp
not edx
or edx, 0x54
add edx, ebp
xor ebp, 0x54
lea edx, [edx*2]
add edx, ebp
add dl, 3
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xded7a6f9
jne 0x424b90
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424bf1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424be0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424c21
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424c10
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00444110
add esp, 8
mov edi, eax
mov eax, dword [0x44bc68]
nop
nop
nop
nop
nop
nop
nop
jmp eax

Function at 0x424b53
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424b30
cmp eax, 0xffffffed
jge 0x424b47
mov eax, 0xffffffff
jmp 0x424b4a
add eax, 0x12
push eax
call fcn.0040c8d0
add esp, 4
mov esi, eax
mov dword [esp], 0x59e75be8
mov dword [esp + 4], 0x5dd15fe3
mov dword [esp + 8], 0x51205328
mov dword [esp + 0xc], 0x55f057f4
mov word [esp + 0x10], 0xab54
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, esp
mov ecx, 0xded7a710
nop
movzx edx, byte [eax]
mov ebx, ecx
or ebx, edx
not ebx
lea ebp, [ecx + 0x21285900]
and ebp, edx
or ebp, ebx
mov edx, ebp
not edx
or edx, 0x54
add edx, ebp
xor ebp, 0x54
lea edx, [edx*2]
add edx, ebp
add dl, 3
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xded7a6f9
jne 0x424b90
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424bf1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424be0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424c21
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424c10
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00444110
add esp, 8
mov edi, eax
mov eax, dword [0x44bc68]
nop
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x424c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
movzx eax, byte [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44bd90]

Function at 0x427340
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov dword [esp], 0xd182cfeb
mov dword [esp + 4], 0xd5b7d3a1
mov dword [esp + 8], 0xd9bad7b7
mov dword [esp + 0xc], 0xddaadb9b
mov dword [esp + 0x10], 0xe19adfac
mov dword [esp + 0x14], 0xe596e383
mov dword [esp + 0x18], 0xe9c1e787
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0xebe8
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
mov esi, ecx
and esi, 0x1a
mov ebx, edx
xor ebx, 0x4d
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x7f
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 0x23
jne 0x4273a0
lea esi, [esp + 0x76]
mov edx, esp
mov edi, esi
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x92]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x54]
push ebp
push 0
push 0
push 0xe
push esi
push 0
call dword [0x450c14]
mov ebx, dword [esp + 0x54]
mov edi, 0xffffffff
test ebx, ebx
jns 0x42740a
mov eax, 0xffffffff
jmp 0x42740d
lea eax, [ebx + ebx]
push eax
call fcn.0040c8d0
add esp, 4
mov esi, eax
push ebp
push ebx
push eax
push 0xe
lea eax, [esp + 0x86]
push eax
push 0
call dword [0x450c14]
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
js 0x42743f
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040c8d0
add esp, 4
mov ebx, eax
mov dword [esp], 0x93429174
mov dword [esp + 4], 0xaf4dad4d
mov dword [esp + 8], 0xab4ba953
mov dword [esp + 0xc], 0xa75ba55b
mov dword [esp + 0x10], 0xa3a2a153
mov byte [esp + 0x14], 0
mov eax, 0xa4
mov ecx, 0x1c
mov edi, ecx
or edi, 0xd4
add edi, eax
mov edx, eax
neg edx
and edx, 0x2b
or edx, edi
xor dl, byte [esp + ecx - 0x1c]
xor dl, 0xd4
add dl, 0x34
mov byte [esp + ecx - 0x1c], dl
dec eax
inc ecx
cmp ecx, 0x31
jne 0x427480
movzx ecx, word [esi]
mov eax, ebx
test cx, cx
je 0x4274d1
lea edx, [esi + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4274c0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x427501
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4274f0
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push ebx
call fcn.00444110
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x50], esi
mov dword [esp + 0x5c], ebx
jmp dword [eax*4 + 0x44c3b8]
Function at 0x427a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xe9adeb8f
mov dword [esp + 8], 0xed7eef78
mov dword [esp + 0xc], 0xd175d3a8
mov dword [esp + 0x10], 0xd571d744
mov dword [esp + 0x14], 0xd966dbbf
mov dword [esp + 0x18], 0xdd76df6c
mov dword [esp + 0x1c], 0xc150c347
mov dword [esp + 0x20], 0xc56dc764
mov dword [esp + 0x24], 0xc96ccb52
mov dword [esp + 0x28], 0xcd58cf67
mov dword [esp + 0x2c], 0x318e3368
mov dword [esp + 0x30], 0x35a03780
mov dword [esp + 0x34], 0x39903ba5
mov dword [esp + 0x38], 0x3d923f97
mov dword [esp + 0x3c], 0x21b72397
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x2720
mov byte [esp + 0x44], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd7
xor dl, byte [esp + ecx + 4]
add dl, 0xcd
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x41
jne 0x427b10
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ebx, esp
push ebx
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x450c14]
mov ebp, dword [esp]
test ebp, ebp
jns 0x427b6c
mov eax, 0xffffffff
jmp 0x427b73
lea eax, [ebp*2]
push eax
call fcn.0040c8d0
add esp, 4
mov edi, eax
push ebx
push ebp
push eax
push 0x1e
push esi
push 0
call dword [0x450c14]
mov dword [esp + 4], 0x89328b20
mov dword [esp + 8], 0x85348703
mov dword [esp + 0xc], 0x81398338
mov dword [esp + 0x10], 0x9d209f0e
mov dword [esp + 0x14], 0x99149b2b
mov dword [esp + 0x18], 0x95969724
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0xa3
xor cl, byte [esp + eax + 4]
add cl, 0xd1
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x18
jne 0x427bc0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0xac]
call fcn.00422fd0
add esp, 0x14
jmp dword [0x44c420]
Function at 0x42a1f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x59ee5bf1
mov dword [esp + 0x58], 0x5df95fe3
mov dword [esp + 0x5c], 0x512053ef
mov dword [esp + 0x60], 0x55de57eb
mov dword [esp + 0x64], 0xa9aaabef
mov word [esp + 0x68], 0
mov byte [esp + 0x6a], 0
lea eax, [esp + 0x54]
mov ecx, 0xded7a710
nop
nop
nop
nop
movzx esi, byte [eax]
mov edx, ecx
or edx, esi
lea edi, [ecx + 0x21285900]
and edi, esi
not edx
or edx, edi
mov esi, edx
and esi, 1
or edx, 1
add edx, 0x54
xor edx, esi
lea edx, [edx + esi*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xded7a6f9
jne 0x42a260
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043db70
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44cb80]
Function at 0x435720
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4358c6
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
cmp esi, 0
setne al
jmp 0x43577c
jmp 0x43577e
xor ebx, ebx
test al, 1
jne 0x435789
jmp 0x4358be
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00430ef0
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4357b1
jmp 0x4358b2
mov dword [esp + 0x2c], eax
mov ebx, eax
add ebx, 1
mov dword [esp], ebx
call fcn.0040c8d0
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00429d80
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x79
mov byte [esp + 0x15], 0x43
mov byte [esp + 0x16], 0x45
mov byte [esp + 0x17], 0x41
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x19], 0x42
mov byte [esp + 0x1a], 0x51
mov byte [esp + 0x1b], 0x47
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 9
mov byte [esp + 0x1e], 0x42
mov byte [esp + 0x1f], 0xc1
mov byte [esp + 0x20], 0x3c
mov byte [esp + 0x21], 0x4b
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x14
jne 0x435829
xor eax, eax
cmp eax, 0x14
jae 0x435880
movzx edx, byte [esp + eax + 0x14]
mov ebx, eax
and ebx, 0xbf5f304b
xor ebx, 0xbf5f304b
mov ecx, eax
and ecx, 0x40a0cfb4
sub ecx, ebx
mov ebx, edx
add ebx, 1
mov ebp, edx
xor ebp, 0xffffffff
mov edi, ecx
or edi, ebp
add edi, ebx
shl edi, 1
add ecx, edx
sub ecx, edi
mov edi, dword [esp + 0x44]
add cl, 0x77
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x435838
lea eax, [esp + 0x14]
mov ecx, edi
mov dword [esp], eax
mov edi, dword [esp + 0x28]
mov dword [esp + 4], edi
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0040d3d0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4358a8
mov dword [esp], edi
call fcn.0040c8e0
jmp 0x4358b2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4358c6
and bl, 1
movzx eax, bl
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b270
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x450c14]
mov dword [esp + 0x18], 0xe93febcf
mov dword [esp + 0x1c], 0xed1bef17
mov dword [esp + 0x20], 0xf119f318
mov dword [esp + 0x24], 0xf532f703
mov dword [esp + 0x28], 0xf915fb02
mov dword [esp + 0x2c], 0xfd15ff02
mov dword [esp + 0x30], 0x818283d7
lea ecx, [esp + 0x18]
mov edx, 0x5c778b58
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
mov esi, edx
or esi, edi
lea ebx, [edx - 0x5c778b00]
and ebx, edi
not esi
or esi, ebx
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0xbc
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x5c778b3c
jne 0x43b2d0
lea ecx, [esp + 0x54]
lea esi, [esp + 0x64]
lea edi, [esp + 0x18]
push ecx
push 8
push esi
push 0xd
push edi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e388]

Function at 0x43b980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.00443f70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e460]

Function at 0x43bbc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00444650
add esp, 0x14
test eax, eax
js 0x43bcef
lea esi, [esp + 0xc]
lea eax, [esp + 0x10]
push esi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00444a60
add esp, 0x24
mov ecx, eax
xor ebx, ebx
mov eax, 0
test ecx, ecx
js 0x43bc5f
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43bc29
mov eax, 0xffffffff
jmp 0x43bc30
lea eax, [eax*2 + 2]
push eax
call fcn.0040c8d0
add esp, 4
push esi
mov esi, eax
push eax
push 0
push edi
push dword [esp + 0x10]
call fcn.00445090
add esp, 0x14
test eax, eax
js 0x43bc54
mov eax, esi
jmp 0x43bc5f
push esi
call fcn.0040c8e0
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0xc0c7c6c5
mov word [esp + 8], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
add dl, 0xb1
xor dl, byte [esp + ebx + 4]
add dl, 0x8b
mov byte [esp + ebx + 4], dl
inc ebx
cmp ebx, 6
jne 0x43bc80
mov edx, dword [0x450c18]
test edx, edx
je 0x43bcde
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x450c1c]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43bcc0
inc edi
cmp edx, edi
jne 0x43bcb0
jmp 0x43bcde
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43bcde
push ecx
push 1
push dword [0x450c20]
push edx
mov esi, eax
call fcn.00440770
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43bcf1
lea eax, [esp + 4]
push eax
call fcn.00443d70
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x43bd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov ebx, 0xffffffff
mov esi, ebx
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x43bd10
mov eax, ebx
and eax, 3
mov edx, ebx
or edx, 3
imul edx, eax
xor eax, 3
mov ecx, ebx
and ecx, 0xfffffffc
imul ecx, eax
add edx, ecx
shr edx, 2
movzx eax, byte [edi + ebx - 1]
cmp eax, 0x3d
je 0x43bd48
cmp eax, 0x2e
jne 0x43bd49
dec edx
movzx eax, byte [edi + ebx - 2]
cmp eax, 0x3d
je 0x43bd58
cmp eax, 0x2e
jne 0x43bd59
dec edx
mov dword [esp + 4], edx
mov edx, 0
test ebx, ebx
je 0x43be59
xor ecx, ecx
mov ebp, 2
mov dword [esp + 8], ebx
jmp 0x43bd96
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov ecx, edx
mov ebx, dword [esp + 8]
cmp ebp, ebx
mov ebp, eax
jae 0x43be59
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x44]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.00421d90
add esp, 4
mov edi, ebx
mov bh, al
movzx eax, byte [esi + ebp - 1]
mov esi, dword [esp + 0xc]
push eax
call fcn.00421d90
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi], al
cmp ebp, edi
jae 0x43bd80
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00421d90
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43bd80
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x48]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp + 8]
jae 0x43bd77
mov ecx, dword [esp + 0x44]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.00421d90
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x43bd80
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x43bd80
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x43beb6
mov esi, dword [esp + 0x48]
lea edx, [esi + 0x20]
lea edi, [esp + 0x10]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x30]
xor eax, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
add ebx, 0xffffffe0
je 0x43beb0
mov ecx, eax
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0x10]
xor cl, byte [esi + eax + 0x20]
mov byte [esi + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, ebx
jb 0x43be90
mov byte [esi + ebx], 0
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43db70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xb1
xor cl, byte [esp + eax]
add cl, 0x8b
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43dba0
mov edi, dword [esp]
mov eax, dword [0x450c18]
test eax, eax
je 0x43dc06
xor ecx, ecx
mov edx, dword [0x450c1c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43dbe0
inc ecx
cmp eax, ecx
jne 0x43dbd0
jmp 0x43dc06
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43dc06
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x450c20]
push eax
call fcn.00440770
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xf7b68984
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
movzx esi, byte [esp + ecx]
mov ebp, eax
and ebp, 0xc
mov edx, ecx
xor edx, 0xcf828a5e
add edx, ebp
mov ebp, edx
and ebp, esi
add edx, esi
add ebp, ebp
sub edx, ebp
add dl, 0x2a
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x43dc20
cmp edi, dword [esp]
jne 0x43dd45
push dword [esp + 8]
call fcn.0043d980
add esp, 4
mov esi, dword [esp + 8]
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0xb1
xor cl, byte [esp + edx]
add cl, 0x8b
mov byte [esp + edx], cl
inc edx
cmp edx, 6
jne 0x43dc80
mov edi, dword [esp]
mov edx, dword [0x450c18]
test edx, edx
je 0x43dce5
mov ecx, esi
xor ebp, ebp
mov esi, dword [0x450c1c]
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43dcc0
inc ebp
cmp edx, ebp
jne 0x43dcb0
jmp 0x43dce5
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43dce5
push 0
push ecx
push eax
push 5
push 4
push dword [0x450c20]
push edx
mov esi, eax
call fcn.00440770
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43dd3c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43dd15
add edi, 2
cmp si, bp
je 0x43dd00
cmp si, bp
je 0x43dd27
mov esi, dword [ecx]
test esi, esi
jne 0x43dcf0
mov edi, 0xc0000225
jmp 0x43dd3c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043da70
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4