joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4255d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42562a
cmp edi, 1
je 0x42562a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x425601
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x425600
cmp ecx, 0x20
je 0x425600
cmp ecx, 0x2b
mov edx, edi
je 0x425620
cmp ecx, 0x2d
jne 0x42563f
cmp al, 0x2b
sete byte [esp + 3]
inc ebx
jmp 0x425644
xor edi, edi
test eax, eax
je 0x4257fd
mov dword [eax], 0x16
jmp 0x4257fd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42566d
cmp edx, 0x10
jne 0x425685
cmp byte [ebx], 0x30
jne 0x425666
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x425687
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x425687
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x4256e0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x425798
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x425707
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x4257c8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x4257c8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x4256c0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x425750
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x425759
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42577d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4257ad
test bl, bl
jne 0x4257ad
mov ebx, dword [esp + 0x10]
jmp 0x4256d3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x4256b5
mov esi, edi
test bl, bl
jne 0x4257bb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x4256b5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4257d6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x4257e4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x4257f4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x4257fd
cmp byte [esp + 3], 0
jne 0x4257fd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4380f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x438110
mov dword [esp + 4], 0x5656a817
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 6
ja 0x438170
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0xb4a1cb7e
xor esi, edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
add bl, 0x2a
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 7
jb 0x438140
test edx, edx
je 0x4381de
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x4381a1
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438190
cmp edi, 3
jb 0x4381de
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x4381b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.0043fd00
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449788]
Function at 0x43c040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x449b2c]

Function at 0x43c0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x5d5e5f50
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43c14e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xc242a6a7
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43c120
mov edi, dword [esp + 4]
mov eax, dword [0x44ba98]
test eax, eax
je 0x43c1a6
xor ecx, ecx
mov edx, dword [0x44ba9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43c180
inc ecx
cmp eax, ecx
jne 0x43c170
jmp 0x43c1a6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c1a6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44baa0]
push eax
call fcn.0043dc50
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43c2e5
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043bfa0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x5d5e5f50
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x43c220
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0xc242a6a7
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 8
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x43c1f0
mov edi, dword [esp + 4]
mov edx, dword [0x44ba98]
test edx, edx
je 0x43c276
xor ebx, ebx
mov ebp, dword [0x44ba9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43c251
inc ebx
cmp edx, ebx
jne 0x43c240
jmp 0x43c276
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43c276
push 0
push ecx
push eax
push 5
push 4
push dword [0x44baa0]
push edx
mov esi, eax
call fcn.0043dc50
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43c2dc
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43c2b5
add ebx, 2
cmp bp, si
je 0x43c2a0
cmp bp, si
je 0x43c2c7
mov ebx, dword [edx]
test ebx, ebx
jne 0x43c290
mov edi, 0xc0000225
jmp 0x43c2dc
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.0043c040
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43c320
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x43c400
xor eax, eax
cmp dword [ecx], 0
jne 0x43c469
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x5d5e5f50
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43c3ce
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add eax, 0xc242a6a7
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 8
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43c3a0
mov eax, dword [esp + 0xc]
mov esi, dword [0x44ba98]
test esi, esi
je 0x43c469
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44ba9c]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43c472
inc edi
cmp esi, edi
jne 0x43c3f0
jmp 0x43c469
mov dword [esp + 0x14], 0x16575861
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43c465
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
mov edx, eax
and edx, 0xfdc8a786
xor eax, 0xfdc8a786
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x21
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43c420
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c469
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44baa0]
push esi
call fcn.0043dc50
add esp, 0x1c
jmp 0x43c469

Function at 0x43c4a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c571
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x5d5e5f50
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x43c510
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0xc242a6a7
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 8
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x43c4e0
mov edx, dword [0x44ba98]
test edx, edx
je 0x43c55e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44ba9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43c540
inc edi
cmp edx, edi
jne 0x43c530
jmp 0x43c55e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c55e
push eax
push 1
push dword [0x44baa0]
push edx
mov esi, ecx
call fcn.0043dc50
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43c800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x5d5e5f50
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
test edx, edx
jne 0x43c829
lea edx, [esp + 0x10]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43c86e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0xc242a6a7
xor eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 8
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43c840
mov eax, dword [esp + 4]
mov ebp, dword [0x44ba98]
test ebp, ebp
je 0x43c8d1
xor esi, esi
mov edi, dword [0x44ba9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x43c8aa
mov ebx, esi
and ebx, 1
xor esi, 1
lea esi, [esi + ebx*2]
cmp esi, ebp
jb 0x43c890
jmp 0x43c8d1
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x43c8d1
push edx
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push ecx
push 5
push dword [0x44baa0]
push ebp
call fcn.0043dc50
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43d340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov dword [esp + 0x4c], 0x50c752cf
mov dword [esp + 0x50], 0x54cb56f5
mov dword [esp + 0x54], 0x48994ac9
mov dword [esp + 0x58], 0x4cd34eed
mov dword [esp + 0x5c], 0x404342d1
mov byte [esp + 0x60], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0x14
ja 0x43d3c3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
movzx ecx, byte [esp + ecx + 0x4c]
add eax, 0xd416c0a7
xor eax, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 6
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x4c], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x15
jb 0x43d390
lea eax, [esp + 0x4c]
push eax
call fcn.0043ee40
add esp, 4
mov dword [0x453ab0], eax
mov dword [esp + 0x10], 0x8ed52b71
test eax, eax
je 0x43d3e9
mov dword [esp + 0x10], 0x47210f9f
mov edi, 0xd0e478e4
xor eax, eax
cmp edi, 0x194f5d30
setl al
jmp dword [eax*4 + 0x449b44]

Function at 0x43db60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x449c9c]
Function at 0x43ee40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 8], 0x3020d3c
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43ee9e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x5037f8c6
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0x36
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43ee70
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x30], 0
sete cl
jmp dword [ecx*4 + 0x44a338]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov edi, dword [case.0x43eeaf.4]
mov ebx, dword [edx]
mov dword [esp + 4], 0
mov dword [esp + 0x10], edx
jmp case.0x43eeaf.2
jmp edi
xor eax, eax
cmp ebx, edx
setne al
jmp dword [eax*4 + 0x44a350]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43f120
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x2728295a
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43f17e
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x7f7ce785
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x51
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43f150
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a3a8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44a3b0]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44a3b0]
mov eax, dword [esi + 0x30]
xor edi, edi
jmp dword [edi*4 + 0x44a3c0]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44a3b0]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44a3b8]
mov edi, 1
jmp dword [edi*4 + 0x44a3c0]
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43f210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], 0xc5c4c3f2
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43f26e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x4772938a
xor eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xb8
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43f240
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a3c8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44a404]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44a3e0]
jmp dword [0x44a3d8]

Function at 0x43f320
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [ebp + 8]
push eax
mov edx, esp
movzx eax, word [edi]
mov dword [ebp - 0x20], 0xeeef8692
mov word [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
cmp ecx, 5
ja 0x43f37e
nop
nop
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
movzx esi, byte [ebp + esi - 0x20]
add ecx, 0xcf35bf74
xor ecx, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add cl, 0x67
mov esi, dword [ebp - 0x10]
mov byte [ebp + esi - 0x20], cl
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, 6
jb 0x43f350
xor ecx, ecx
cmp dword [ebp - 0x20], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44a408]
mov ecx, dword [edi + 0x3c]
mov esi, dword [edi + ecx]
mov dword [ebp - 0x18], esi
mov dword [edx], 0xcbcc767e
mov dword [ebp - 0x14], 0
mov edi, dword [ebp - 0x14]
cmp edi, 3
ja 0x43f3e8
nop
nop
nop
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
movzx ebx, byte [edx + ebx]
lea esi, [edi + 0xf1]
and esi, ebx
add edi, ebx
add esi, esi
sub edi, esi
add edi, 0xfe01d9f1
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp - 0x20]
add bl, 0xc1
mov esi, dword [ebp - 0x14]
mov byte [edx + esi], bl
inc dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
cmp esi, 4
jb 0x43f3b0
xor ebx, ebx
mov esi, dword [ebp - 0x18]
cmp esi, dword [edx]
setne bl
mov edi, dword [ebp + 8]
jmp dword [ebx*4 + 0x44a410]
mov ebx, dword [edi + ecx + 0x78]
mov esi, dword [edi + ecx + 0x7c]
test esi, esi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44a418]
mov dword [ebp - 0x30], esi
mov eax, dword [edi + ebx + 0x20]
add eax, edi
mov dword [ebp - 0x40], eax
mov eax, dword [edi + ebx + 0x24]
add eax, edi
mov dword [ebp - 0x38], eax
mov eax, dword [edi + ebx + 0x1c]
add eax, edi
mov dword [ebp - 0x34], eax
xor edx, edx
xor ecx, ecx
cmp edx, dword [edi + ebx + 0x18]
setb cl
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], ebx
jmp dword [ecx*4 + 0x44a420]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fb70
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43fb8b
mov eax, 0xffffffff
jmp 0x43fb8e
add eax, 0xa
push eax
call fcn.00409cc0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43fbd1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43fbc0
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0xd1d0d7d6
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x43fc70
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0xadf91282
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xab
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x43fc40
mov esi, dword [esp + 4]
mov ecx, dword [0x44ba98]
test ecx, ecx
je 0x43fce1
xor edx, edx
mov edi, dword [0x44ba9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x10f02cc2
je 0x43fca0
inc edx
cmp ecx, edx
jne 0x43fc90
jmp 0x43fce1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43fce1
lea esi, [esp + 4]
lea edx, [esp + 0x18]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x60]
push dword [esp + 0x70]
push 0
push esi
push edx
push dword [esp + 0x70]
push dword [esp + 0x70]
push 0xb
push dword [0x44baa0]
push ecx
mov edi, eax
call fcn.0043dc50
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00409cd0
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fd20
mov ebx, eax
sar ebx, 1
lea esi, [ebx + 4]
and eax, 2
mov ecx, esi
xor ecx, 1
add ecx, eax
jns 0x43fd45
mov ecx, 0xffffffff
jmp 0x43fd47
add ecx, ecx
push ecx
call fcn.00409cc0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x43fd92
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x43fd80
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, ebx
lea ecx, [esi + edx]
mov word [esp + 0xc], cx
lea ecx, [esi + edx]
add ecx, 2
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0xd1d0d7d6
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x43fe50
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0xadf91282
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xab
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x43fe20
mov esi, dword [esp + 4]
mov ecx, dword [0x44ba98]
test ecx, ecx
je 0x43feb6
xor edx, edx
mov ebx, dword [0x44ba9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x43fe80
inc edx
cmp ecx, edx
jne 0x43fe70
jmp 0x43feb6
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43feb6
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push dword [esp + 0x54]
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44baa0]
push ecx
mov edi, eax
call fcn.0043dc50
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00409cd0
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret