joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 0xc], ecx
cmp dword [ecx + 8], 0
je 0x43a963
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x43a963
mov dword [esp + 8], eax
mov dword [esp], 0x181b1a1d
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, esi
and ebx, 1
mov edx, ebx
xor edx, 0xb19c89d9
mov ecx, esi
and ecx, 2
mov edi, ecx
sub edi, edx
mov eax, 0x2b
sub eax, edi
neg edx
add edx, ecx
add edx, 0x14
and eax, 0x35
and edx, 0x4a
or edx, eax
xor dl, byte [esp + esi]
xor dl, 0xb5
add dl, 0x59
mov byte [esp + esi], dl
xor ebx, 0x9bbaf00d
neg ebx
lea eax, [ecx + ebx]
inc eax
mov ecx, eax
and ecx, 0xd
xor eax, 0x9bbaf00d
lea esi, [eax + ecx*2]
cmp esi, 4
jb 0x43a8e0
mov eax, dword [esp]
mov edi, dword [0x44bcdc]
test edi, edi
je 0x43a9ea
xor edx, edx
mov ebx, dword [0x44bce0]
nop
cmp dword [ebx + edx*8], 0xaf0e0c2e
je 0x43a9ca
inc edx
cmp edi, edx
jne 0x43a950
jmp 0x43a9ea
mov dword [esp], 0x114e4f44
mov dword [esp + 4], 0
mov eax, 0x496948d
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x496948d]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x3c
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0x3e
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax - 0x496948d], cl
inc eax
cmp eax, 0x4969495
jne 0x43a980
mov eax, dword [esp]
jmp 0x43aaf1
mov edx, dword [ebx + edx*8 + 4]
cmp edx, eax
je 0x43a9ea
push dword [ebp + 8]
push dword [esp + 0xc]
push 8
push edx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x43aae0
cmp eax, 0xc000010a
jne 0x43aae0
mov ecx, 0xffffd8f0
mov esi, dword [ebp + 0xc]
mov eax, esi
mul ecx
sub edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x181b1a1d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 1
mov ecx, edi
xor ecx, 0xb19c89d9
mov ebx, eax
and ebx, 2
mov edx, ebx
sub edx, ecx
mov esi, 0x2b
sub esi, edx
neg ecx
lea edx, [ebx + ecx]
add edx, 0x14
and esi, 0x35
and edx, 0x4a
or edx, esi
xor dl, byte [esp + eax + 0x10]
xor dl, 0xb5
add dl, 0x59
mov byte [esp + eax + 0x10], dl
xor edi, 0x9bbaf00d
neg edi
lea eax, [ebx + edi]
inc eax
mov ecx, eax
and ecx, 0xd
xor eax, 0x9bbaf00d
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43aa30
xor edi, edi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43aa93
mov edi, esp
mov eax, dword [esp + 0x10]
mov esi, dword [0x44bcdc]
test esi, esi
je 0x43aae0
xor edx, edx
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x4c697c35
je 0x43aac0
inc edx
cmp esi, edx
jne 0x43aab0
jmp 0x43aae0
mov edx, dword [ebx + edx*8 + 4]
cmp edx, eax
je 0x43aae0
push edi
push 0
push dword [esp + 0x10]
push 0xc
push edx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x18
test eax, eax
js 0x43aaf1
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.0043a7d0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43ab00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [ecx]
mov dword [esp], 0x181b1a1d
xor edx, edx
mov eax, edx
and eax, 1
mov edi, eax
xor edi, 0xb19c89d9
mov esi, edx
and esi, 2
mov ebx, esi
sub ebx, edi
mov ebp, 0x2b
sub ebp, ebx
neg edi
lea ebx, [esi + edi]
add ebx, 0x14
and ebp, 0x35
and ebx, 0x4a
or ebx, ebp
xor bl, byte [esp + edx]
xor bl, 0xb5
add bl, 0x59
mov byte [esp + edx], bl
xor eax, 0x9bbaf00d
neg eax
add eax, esi
inc eax
mov edx, eax
and edx, 0xd
xor eax, 0x9bbaf00d
lea edx, [eax + edx*2]
cmp edx, 4
jb 0x43ab10
mov eax, dword [esp]
mov edx, dword [0x44bcdc]
test edx, edx
je 0x43ab98
xor esi, esi
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xc18bc4ba
je 0x43ab90
inc esi
cmp edx, esi
jne 0x43ab80
jmp 0x43ab98
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43aba2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
push 0x18
push edx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x28
jmp 0x43ab9b

Function at 0x43abd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], 0x181b1a1d
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ebp, eax
and ebp, 1
mov ecx, ebp
xor ecx, 0xb19c89d9
mov edi, eax
and edi, 2
mov edx, edi
sub edx, ecx
mov esi, 0x2b
sub esi, edx
neg ecx
add ecx, edi
add ecx, 0x14
and esi, 0x35
and ecx, 0x4a
or ecx, esi
xor cl, byte [esp + eax]
xor cl, 0xb5
add cl, 0x59
mov byte [esp + eax], cl
xor ebp, 0x9bbaf00d
neg ebp
lea eax, [edi + ebp]
inc eax
mov ecx, eax
and ecx, 0xd
xor eax, 0x9bbaf00d
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43abf0
test ebx, ebx
jne 0x43ac4e
lea ebx, [esp + 8]
mov eax, dword [esp]
mov edx, dword [0x44bcdc]
test edx, edx
je 0x43acab
xor ecx, ecx
mov ebp, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ecx*8], 0xe6c7f7c6
je 0x43ac81
inc ecx
cmp edx, ecx
jne 0x43ac70
jmp 0x43acab
mov edx, dword [ebp + ecx*8 + 4]
cmp edx, eax
je 0x43acab
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 0x14
push edx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43caf0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x448a9c]

Function at 0x43da90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 8], 0x8186ddd3
mov dword [esp + 0xc], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea esi, [ecx + 0xe0b1ea1]
and esi, edx
add esi, esi
neg esi
lea ebx, [ecx + esi]
add ebx, 0xe0b1ea1
add bl, dl
add bl, 0xdb
mov byte [esp + ecx + 8], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 8
jb 0x43dac0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x448f14]
mov ecx, dword [0x448f1c]
mov edx, ecx
not edx
and ecx, 0x2abc0cf2
lea esi, [ecx*2 + 2]
sub esi, ecx
add esi, 0xfffffffe
and edx, 0xd543f30d
or edx, esi
lea ecx, [eax + edx]
inc ecx
xor eax, eax
jmp ecx
Function at 0x43e310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x818687f4
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
not ecx
or ecx, 0xe0b1ea1
add ecx, eax
inc ecx
mov edx, eax
or edx, 0xe0b1ea1
mov esi, ecx
and esi, edx
xor edx, ecx
lea ecx, [edx + esi*2]
xor cl, byte [esp + eax + 4]
add cl, 0xdb
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 8
jb case.default.0x43e37a
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x4493bc]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov esi, dword [0x4493e4]
mov edi, dword [edx]
xor eax, eax
cmp edi, edx
setne al
mov dword [esp + 0xc], edx
jmp dword [eax*4 + 0x4493d4]
jmp esi
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [0x449410]
nop
nop
nop
nop
jmp eax
jecxz 0x449402
add byte [ecx - 0x1c], al
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx + 0x470043e3], al
in al, 0x43
add al, dl
jecxz 0x44941e
add al, dl
jecxz 0x449422
add al, dl
jecxz 0x449426
add dl, dl
jecxz 0x44942a
add al, dl
jecxz 0x44942e
add byte [eax - 0x14ffbc1d], ch
jecxz 0x449436
add byte [eax + 0x320043e3], ch
in al, 0x43
add byte [edi - 0x1c], al
inc ebx
add byte [ebx + 0x500043e3], dh
in al, 0x43
inc ebx
add byte [eax - 0x1c], dl
inc ebx
add byte [eax - 0x1c], dl
inc ebx
add byte [eax - 0x1c], dl
inc ebx
add byte [edx - 0x1c], dl
inc ebx
add dl, cl
in al, 0x43
add al, dl
in al, 0x43
add al, dl
in al, 0x43
inc ebx
add al, dl
in al, 0x43
inc ebx
add al, dl
in al, 0x43
inc ebx
add dh, dl
in al, 0x43
inc ebx
add byte [esi + 0x4d0043e5], ah
in eax, 0x43
inc ebx
add byte [ebp - 0x1b], cl
inc ebx
add byte [esi - 0x6bffbc1b], al
in eax, 0x43
add byte [0xa60043e5], bh
in eax, 0x43
add byte [ebx - 0x1b], cl
inc ebx
inc ebx
add byte [ebp - 0x1ac2ffbd], dl
inc ebx
add byte [esi + 0x4b0043e5], ah
in eax, 0x43
add byte [edx + 0x270043e5], bh
out 0x43, al
add byte [ebp - 0x1a], al
inc ebx
add byte [edx + 0x700043e6], dh
out 0x43, al
add al, al
out 0x43, al
add al, al
out 0x43, al
add dl, al
out 0x43, al
add al, al
out 0x43, al
add byte [edi - 0x1a], bh
inc ebx
add byte [eax - 0x3dffbc1a], dl
out 0x43, al
add byte [eax - 0x5fffbc1a], ah
out 0x43, al
add byte [eax - 0x5fffbc1a], ah
out 0x43, al
add byte [edx + 0x320043e6], ah
out 0x43, eax
add byte [edi - 0x72ffbc19], al
out 0x43, eax
add byte [edi + 0x43], ch
add byte [eax - 0x19], dl
inc ebx
add byte [ebx - 0x19], bh
inc ebx
add byte [ebp + 0x5c0043e7], cl
out 0x43, eax
add al, dh
out 0x43, eax
add al, dh
out 0x43, eax
add al, dh
out 0x43, eax
add dl, dh
out 0x43, eax
add byte [edx], al
call 0xebb49505
inc ebx
add byte [eax], cl
call 0xe8c5950d
inc ebx
add dl, ah
call 0xe8c59515
inc ebx
add bl, bh
call 0xebb4951d
inc ebx
add byte [ecx], ah
jmp 0xebb49525
Function at 0x43e6d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x57564938
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
lea esi, [eax + 0x2e96ee6e]
and esi, edx
add edx, eax
add edx, 0x2e96ee6e
add esi, esi
sub edx, esi
add dl, 0xda
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 8
jb case.default.0x43e72b
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44948c]

Function at 0x43e7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0xf0ee7d5
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + ecx]
mov ebx, edx
and ebx, 4
or ebx, ecx
xor bl, byte [esp + ecx]
xor bl, 0x42
add bl, 0xb6
mov byte [esp + ecx], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 4
jb 0x43e7c0
mov ecx, dword [esp]
mov edx, dword [case.0x43e620.26]
nop
nop
nop
nop
Function at 0x43f090
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f0b0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43f0cb
mov eax, 0xffffffff
jmp 0x43f0ce
add eax, 0xa
push eax
call fcn.004095d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43f111
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43f100
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx + 0xb2371c5]
lea edi, [ecx + 0xc5]
and edi, esi
or edx, esi
xor edx, edi
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x26
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 5
xor ecx, 0x26208d95
lea ecx, [ecx + edx*2]
add ecx, 0xd9df726c
cmp ecx, 7
jb 0x43f190
mov esi, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x43f242
xor edx, edx
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43f200
inc edx
cmp ecx, edx
jne 0x43f1f0
jmp 0x43f242
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43f242
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44bce4]
mov edi, eax
call fcn.0043cba0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004095e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f260
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f280
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43f29b
mov eax, 0xffffffff
jmp 0x43f29e
add eax, 0xa
push eax
call fcn.004095d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43f2e1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43f2d0
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx + 0xb2371c5]
lea ebx, [ecx + 0xc5]
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x26
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 5
xor ecx, 0x26208d95
lea ecx, [ecx + edx*2]
add ecx, 0xd9df726c
cmp ecx, 7
jb 0x43f360
mov esi, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x43f404
xor edx, edx
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x43f3d0
inc edx
cmp ecx, edx
jne 0x43f3c0
jmp 0x43f404
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f404
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44bce4]
mov edi, eax
call fcn.0043cba0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004095e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f440
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43f45b
mov eax, 0xffffffff
jmp 0x43f45e
add eax, 0xa
push eax
call fcn.004095d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f4a1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f490
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x101f1e1d
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x20]
lea edx, [ecx + 0xb2371c5]
lea ebx, [ecx + 0xc5]
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x26
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 5
xor ecx, 0x26208d95
lea ecx, [ecx + edx*2]
add ecx, 0xd9df726c
cmp ecx, 7
jb 0x43f510
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x43f5a9
xor edx, edx
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x43f580
inc edx
cmp ecx, edx
jne 0x43f570
jmp 0x43f5a9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f5a9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44bce4]
mov ebx, eax
call fcn.0043cba0
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.004095e0
add esp, 4
test edi, edi
je 0x43f5bc
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0xb2371c5]
lea ebx, [eax + 0xc5]
and ebx, ecx
or edx, ecx
xor edx, ebx
mov ecx, edx
and ecx, 1
or edx, 1
add edx, ecx
add dl, 0x26
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 5
xor eax, 0x26208d95
lea eax, [eax + ecx*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x43f600
mov eax, dword [esp]
mov edx, dword [0x44bcdc]
test edx, edx
je 0x43f698
xor ebx, ebx
mov ecx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x43f670
inc ebx
cmp edx, ebx
jne 0x43f660
jmp 0x43f698
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43f698
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x20
test edi, edi
je 0x43f6a2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43f6ae
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
lea ebx, [eax + 0xb2371c5]
lea ebp, [eax + 0xc5]
and ebp, edi
or ebx, edi
xor ebx, ebp
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x26
mov byte [esp + eax], bl
mov edi, eax
and edi, 5
xor eax, 0x26208d95
lea eax, [eax + edi*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x43f6f0
mov eax, dword [esp]
mov ebx, dword [0x44bcdc]
test ebx, ebx
je 0x43f78e
xor ebp, ebp
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x43f760
inc ebp
cmp ebx, ebp
jne 0x43f750
jmp 0x43f78e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f78e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x30
cmp eax, 0x103
jne 0x43f849
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
movzx edx, byte [esp + eax]
lea ecx, [eax + 0xb2371c5]
lea edi, [eax + 0xc5]
and edi, edx
or ecx, edx
xor ecx, edi
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x26
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 5
xor eax, 0x26208d95
lea eax, [eax + ecx*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x43f7b0
mov eax, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x43f841
xor edx, edx
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f820
inc edx
cmp ecx, edx
jne 0x43f810
jmp 0x43f841
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f841
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x18
test eax, eax
js 0x43f849
mov eax, dword [esp + 8]
test esi, esi
je 0x43f85c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f85a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
lea ebx, [eax + 0xb2371c5]
lea ebp, [eax + 0xc5]
and ebp, edi
or ebx, edi
xor ebx, ebp
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x26
mov byte [esp + eax], bl
mov edi, eax
and edi, 5
xor eax, 0x26208d95
lea eax, [eax + edi*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x43f8a0
mov eax, dword [esp]
mov ebx, dword [0x44bcdc]
test ebx, ebx
je 0x43f93e
xor ebp, ebp
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x43f910
inc ebp
cmp ebx, ebp
jne 0x43f900
jmp 0x43f93e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f93e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x30
cmp eax, 0x103
jne 0x43f9f9
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
movzx edx, byte [esp + eax]
lea ecx, [eax + 0xb2371c5]
lea edi, [eax + 0xc5]
and edi, edx
or ecx, edx
xor ecx, edi
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x26
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 5
xor eax, 0x26208d95
lea eax, [eax + ecx*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x43f960
mov eax, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x43f9f1
xor edx, edx
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f9d0
inc edx
cmp ecx, edx
jne 0x43f9c0
jmp 0x43f9f1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f9f1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x18
test eax, eax
js 0x43f9f9
mov eax, dword [esp + 8]
test esi, esi
je 0x43fa03
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret