joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eb50
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.004136c0
sub esp, 0x14
mov edi, esp
jmp 0x42eb65
call fcn.004136c0
push eax
mov esi, esp
jmp 0x42eb6f
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42eb83
cmp eax, 0
setne al
jmp 0x42eb8b
xor ebx, ebx
test al, 1
jne 0x42eb96
jmp 0x42ed17
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42ebd2
jmp 0x42ed11
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00429990
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42ed00
mov dword [ebp - 0x18], eax
mov ebx, eax
sub ebx, 0xffffffff
sub esp, 4
mov dword [esp], ebx
call fcn.004086b0
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00422490
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x81
mov byte [edi + 1], 0xa7
mov byte [edi + 2], 0xa5
mov byte [edi + 3], 0xa9
mov byte [edi + 4], 0xbe
mov byte [edi + 5], 0xae
mov byte [edi + 6], 0xb9
mov byte [edi + 7], 0xab
mov byte [edi + 8], 0xb8
mov byte [edi + 9], 0x61
mov byte [edi + 0xa], 0xa6
mov byte [edi + 0xb], 0xd9
mov byte [edi + 0xc], 0xa4
mov byte [edi + 0xd], 0x57
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x42ec6f
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x14
jae 0x42ecc6
mov dl, byte [edi + eax]
mov esi, eax
add esi, 0x8f
mov ebx, 0x70
sub ebx, eax
and ebx, 0x46
and esi, 0xb9
or ebx, esi
mov ecx, dword [ebp + 8]
xor bl, dl
xor bl, 0x46
add bl, 0x35
mov byte [edi + eax], bl
mov esi, eax
add esi, 1
mov edx, eax
xor edx, 0xffffffff
or edx, 1
add edx, esi
or eax, 1
add eax, edx
jmp 0x42ec80
mov esi, dword [ebp - 0x1c]
jmp 0x42eccb
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
call fcn.00409730
mov bl, al
and bl, 1
jmp 0x42ece8
jmp 0x42ecea
jmp 0x42ecec
jmp 0x42ecee
sub esp, 4
mov dword [esp], esi
call fcn.004086c0
add esp, 4
jmp 0x42ecfe
jmp 0x42ed00
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42ed11
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043dc70
add esp, 0x14
test eax, eax
js 0x434fc6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043e120
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x434f1a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x434ee8
mov eax, 0xffffffff
jmp 0x434eef
lea eax, [eax*2 + 2]
push eax
call fcn.004086b0
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043e840
add esp, 0x14
test eax, eax
jns 0x434f1a
push esi
call fcn.004086c0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x94959697
mov byte [esp + 8], 0
nop
nop
nop
nop
nop
nop
lea ecx, [edi - 0x6dcb2f5]
mov edx, ecx
and edx, 0x11
xor ecx, 0x51
lea ecx, [ecx + edx*2]
xor cl, byte [esp + edi + 4]
add cl, 0x34
mov byte [esp + edi + 4], cl
lea ecx, [edi + edi]
and ecx, 2
mov edx, ecx
and edx, edi
or ecx, edi
xor ecx, 1
add ecx, edx
mov edi, ecx
cmp ecx, 5
jb 0x434f30
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x434faa
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x434f90
inc edi
cmp ecx, edi
jne 0x434f80
jmp 0x434faa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x434faa
push eax
push 4
push ecx
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x10
test esi, esi
jne 0x434fc8
lea eax, [esp + 4]
push eax
call fcn.0043d1d0
add esp, 4
test al, al
je 0x434fc6
cmp dword [esp + 4], 1
je 0x434fc8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0x8c8d8a8b
mov dword [esp + 4], 0
mov eax, 0x5cd18762
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5cd18762]
lea edx, [eax - 0x5cd18700]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, ecx
and edx, 0x15
xor ecx, 0x15
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x5cd18762], cl
inc eax
cmp eax, 0x5cd1876a
jne 0x436d40
mov edi, dword [esp]
mov eax, dword [0x44a4ac]
test eax, eax
je 0x436dc6
xor ecx, ecx
mov edx, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436da0
inc ecx
cmp eax, ecx
jne 0x436d90
jmp 0x436dc6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436dc6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x77b68984
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov ebp, eax
and ebp, 4
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ebp
or ebp, 2
imul ebp, edx
mov edx, eax
xor edx, 0xca07441e
add edx, esi
add edx, ebp
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add dl, cl
add dl, 0x6a
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne 0x436de0
cmp edi, dword [esp]
jne 0x436f35
push dword [esp + 8]
call fcn.00436bc0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0x8c8d8a8b
mov dword [esp + 4], 0
mov edx, 0x5cd18762
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x5cd18762]
lea edi, [edx - 0x5cd18700]
and edi, esi
or esi, edx
xor esi, edi
mov edi, esi
and edi, 0x15
xor esi, 0x15
lea ecx, [esi + edi*2]
inc cl
mov byte [esp + edx - 0x5cd18762], cl
inc edx
cmp edx, 0x5cd1876a
jne 0x436e50
mov edi, dword [esp]
mov edx, dword [0x44a4ac]
test edx, edx
je 0x436ed5
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x436eb0
inc ebp
cmp edx, ebp
jne 0x436ea0
jmp 0x436ed5
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x436ed5
push 0
push ecx
push eax
push 5
push 0x10
push edx
push dword [0x44a4b4]
mov esi, eax
call fcn.00439880
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x436f2c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x436f05
add edi, 2
cmp si, bp
je 0x436ef0
cmp si, bp
je 0x436f17
mov esi, dword [ecx]
test esi, esi
jne 0x436ee0
mov edi, 0xc0000225
jmp 0x436f2c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00436c60
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x436f70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x437040
xor eax, eax
cmp dword [ecx], 0
jne 0x43707b
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x8c8d8a8b
mov dword [esp + 4], 0
mov eax, 0x5cd18762
nop
movzx esi, byte [esp + eax - 0x5cd18762]
lea edi, [eax - 0x5cd18700]
and edi, esi
or esi, eax
xor esi, edi
mov edi, esi
and edi, 0x15
xor esi, 0x15
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + eax - 0x5cd18762], bl
inc eax
cmp eax, 0x5cd1876a
jne 0x436fe0
mov eax, dword [esp]
mov esi, dword [0x44a4ac]
test esi, esi
je 0x43707b
xor edi, edi
mov ebx, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x437084
inc edi
cmp esi, edi
jne 0x437030
jmp 0x43707b
mov dword [esp + 8], 0x1c6c7cc
mov eax, 0xd0a47dd1
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2f5b8237]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xeb
mov byte [esp + eax + 0x2f5b8237], cl
inc eax
cmp eax, 0xd0a47dd5
jne 0x437050
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43707b
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x1c
jmp 0x43707b

Function at 0x4370b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43716a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x8c8d8a8b
mov dword [esp + 4], 0
mov edx, 0x5cd18762
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x5cd18762]
lea edi, [edx - 0x5cd18700]
and edi, esi
or esi, edx
xor esi, edi
mov edi, esi
and edi, 0x15
xor esi, 0x15
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x5cd18762], bl
inc edx
cmp edx, 0x5cd1876a
jne 0x4370e0
mov edx, dword [0x44a4ac]
test edx, edx
je 0x43715e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x437140
inc edi
cmp edx, edi
jne 0x437130
jmp 0x43715e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43715e
push eax
push 4
push edx
push dword [0x44a4b4]
mov esi, ecx
call fcn.00439880
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x437710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x437729
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43773a
cmp eax, 2
je 0x4377b0
jmp 0x4377dd
push 0xbbf966b4
push dword [0x44a4a0]
call fcn.0043ca10
add esp, 8
test eax, eax
je 0x43777b
mov ecx, dword [esi]
test ecx, ecx
je 0x4377a8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x437784
cmp dword [esp + 4], 0
je 0x437784
mov dword [esi + 4], 3
jmp 0x4377a8
mov dword [esi + 4], 1
jmp 0x4377dd
lea eax, [esp + 0xc]
push eax
call fcn.0043d1d0
add esp, 4
test al, al
je 0x4377a8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x4377a5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x4377dd
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x4524c8]
call fcn.0043ca10
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x437884
mov ecx, dword [esi]
mov dword [esp + 4], 0x8c8d8a8b
mov dword [esp + 8], 0
mov eax, 0x5cd18762
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5cd1875e]
lea esi, [eax - 0x5cd18700]
and esi, edx
or edx, eax
xor edx, esi
mov esi, edx
and esi, 0x15
xor edx, 0x15
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax - 0x5cd1875e], dl
inc eax
cmp eax, 0x5cd1876a
jne 0x437800
mov eax, dword [esp + 4]
mov edx, dword [0x44a4ac]
test edx, edx
je 0x437884
xor esi, esi
mov ebx, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x437860
inc esi
cmp edx, esi
jne 0x437850
jmp 0x437884
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x437884
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 0x14
push edx
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4384a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0x931e9166
mov dword [esp + 0x34], 0xaf5aad50
mov dword [esp + 0x38], 0xab9ca95c
mov dword [esp + 0x3c], 0xa752a558
mov dword [esp + 0x40], 0xa3a2a154
mov dword [esp + 0x44], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x30]
mov esi, eax
and esi, 4
xor esi, 0x892ad124
mov ecx, eax
and ecx, 0x1b
sub ecx, esi
xor ecx, edx
mov edx, ecx
and edx, 0x24d404b3
xor ecx, 0xadd615b3
lea edx, [ecx + edx*2]
mov esi, edx
xor esi, 0x7e
or edx, 1
and esi, edx
and ecx, 1
sub edx, ecx
lea ecx, [edx + esi*2]
mov byte [esp + eax + 0x30], cl
inc eax
cmp eax, 0x18
jne 0x4384e0
lea eax, [esp + 0x30]
push eax
call fcn.0043c520
add esp, 4
mov dword [0x4524c8], eax
mov esi, 0x38cb2dc4
test eax, eax
je 0x438546
mov esi, 0x12880a4c
lea edi, [esp + 0x1e]
mov ebp, 0x6faab802
xor eax, eax
cmp ebp, 0xec3e9e4e
setl al
mov eax, dword [eax*4 + 0x446d08]
mov ecx, dword [0x446d10]
mov edx, ecx
and edx, 0xf0d6d9f7
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x8f292609
mov dword [esp + 0x2c], ecx
mov dword [esp], ecx
mov dword [esp + 0x28], ecx
jmp eax

Function at 0x4397d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x4470c4]

Function at 0x43a520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x58]
movzx eax, word [edi]
mov dword [esp + 8], 0xb7b6effd
mov byte [esp + 0xc], 0
xor ecx, ecx
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea esi, [ecx - 0x35f8bbe2]
and esi, edx
add edx, ecx
add edx, 0xca07441e
add esi, esi
sub edx, esi
add dl, 0x6a
mov byte [esp + ecx + 8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x43a540
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [0x447554]
mov edx, eax
and edx, 0x4c99b709
mov esi, edx
sub esi, eax
add esi, dword [ecx*4 + 0x44754c]
lea ecx, [edx + esi]
add ecx, 0xb36648f7
xor eax, eax
jmp ecx
Function at 0x43c520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x61666754
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
xor edx, edx
nop
movzx esi, byte [esp + edx + 4]
mov edi, eax
and edi, 2
mov ecx, edx
xor ecx, 0x199481e9
add ecx, edi
xor ecx, esi
mov esi, ecx
and esi, 0x70
mov edi, ecx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor ecx, 0x72
add ecx, ebx
add ecx, esi
inc cl
mov byte [esp + edx + 4], cl
inc edx
add eax, 2
cmp edx, 7
jne case.default.0x43c595
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x447b3c]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov dword [esp], 0
mov esi, dword [ecx]
xor eax, eax
cmp esi, ecx
setne al
mov dword [esp + 0xc], ecx
jmp dword [eax*4 + 0x447b44]
jmp dword [edi*4 + 0x447b5c]
mov ebx, dword [esi + 0x30]
xor eax, eax
test ebx, ebx
setne al
mov edi, 1
jmp dword [eax*4 + 0x447b4c]
mov ebp, dword [esp + 0x24]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebp]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x43c610
or ecx, 0x20
movzx edx, word [ebx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x43c61f
or edx, 0x20
test cx, cx
je 0x43c62f
add ebx, 2
add ebp, 2
cmp cx, dx
je 0x43c600
xor eax, eax
cmp cx, dx
sete al
mov ecx, dword [esp + 0xc]
jmp dword [eax*4 + 0x447b54]
mov eax, dword [esi + 0x18]
mov dword [esp], eax
xor eax, eax
jmp dword [eax*4 + 0x447b5c]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c810
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xe3e2e1b0
mov dword [esp + 4], 0
mov eax, 0x925e6d58
mov edx, 0x6da192a8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x6da192a8]
lea esi, [ebx + ebx]
not esi
add esi, ebx
mov edi, ebx
and edi, 0xffffffa2
and esi, 0x5d
or esi, edi
xor esi, ebx
xor esi, 0xa2
and esi, ebx
lea edi, [edx + esi]
not esi
or esi, eax
add esi, edi
not ebx
or ebx, eax
and ebx, esi
mov esi, ebx
not esi
mov edi, esi
and edi, 0x47
xor ebx, 0xb8
add ebx, esi
and esi, 0xb8
sub ebx, esi
add ebx, edi
inc bl
mov byte [esp + eax + 0x6da192a8], bl
inc eax
dec edx
cmp eax, 0x925e6d60
jne 0x43c840
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447b9c]

Function at 0x43c930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xe9eaebb4
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xb85d90d7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x47a26f29]
mov ebx, edx
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0xcd
mov byte [esp + eax + 0x47a26f29], dl
inc eax
cmp eax, 0xb85d90de
jne 0x43c960
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447bbc]
Function at 0x43d230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d240
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d25b
mov eax, 0xffffffff
jmp 0x43d25e
add eax, 0xa
push eax
call fcn.004086b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43d2a1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43d290
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x20272625
xor ecx, ecx
xor edx, edx
movzx edi, byte [esp + edx]
mov ebx, ecx
and ebx, 2
mov esi, edx
xor esi, 0x752dbdb9
add esi, ebx
mov ebx, esi
and ebx, edi
lea ebp, [esi + edi]
not ebp
lea ebx, [ebx*2]
add ebx, ebp
mov ebp, esi
not ebp
or ebx, ebp
add ebx, esi
lea ebx, [ebx*2 + 2]
xor esi, ebx
and ebp, ebx
add ebp, ebp
sub esi, ebp
add esi, edi
mov edi, esi
and edi, 1
mov ebx, 0x9d
sub ebx, esi
and esi, 0xfffffffe
add esi, 0x62
xor esi, 0xfe
and ebx, 0xfe
or ebx, esi
not ebx
add ebx, edi
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 4
jne 0x43d310
mov esi, dword [esp]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43d3f5
xor edx, edx
mov edi, dword [0x44a4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43d3b0
inc edx
cmp ecx, edx
jne 0x43d3a0
jmp 0x43d3f5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d3f5
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44a4b4]
mov edi, eax
call fcn.00439880
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004086c0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d410
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d420
mov ebx, eax
sar ebx, 1
lea esi, [ebx + 4]
and eax, 2
mov ecx, esi
xor ecx, 1
add ecx, eax
jns 0x43d445
mov ecx, 0xffffffff
jmp 0x43d447
add ecx, ecx
push ecx
call fcn.004086b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x43d492
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x43d480
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, ebx
lea ecx, [esi + edx]
mov word [esp + 8], cx
lea ecx, [esi + edx]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x20272625
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx]
mov ebp, ecx
and ebp, 2
mov esi, edx
xor esi, 0x752dbdb9
add esi, ebp
mov ebp, esi
and ebp, ebx
lea edi, [esi + ebx]
not edi
lea edi, [edi + ebp*2]
mov ebp, esi
not ebp
or edi, ebp
add edi, esi
lea edi, [edi*2 + 2]
xor esi, edi
and ebp, edi
add ebp, ebp
sub esi, ebp
add esi, ebx
mov ebp, esi
and ebp, 1
mov ebx, 0x9d
sub ebx, esi
and esi, 0xfffffffe
add esi, 0x62
xor esi, 0xfe
and ebx, 0xfe
or ebx, esi
not ebx
add ebx, ebp
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 4
jne 0x43d510
mov esi, dword [esp]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43d5d7
xor edx, edx
mov ebx, dword [0x44a4b0]
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43d5a0
inc edx
cmp ecx, edx
jne 0x43d590
jmp 0x43d5d7
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d5d7
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44a4b4]
mov edi, eax
call fcn.00439880
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004086c0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret