joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e9f0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 2], 0xb1b0cf24
mov word [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x3e
xor dl, byte [esp + ecx + 2]
add dl, 0x10
mov byte [esp + ecx + 2], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 6
jb 0x41ea30
lea ecx, [esp + 8]
lea edx, [esp + 2]
push ecx
push 0x420140
push edx
push dword [eax + 8]
call fcn.004207e0
add esp, 0x28
pop esi
ret

Function at 0x420260
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x420270
cmp eax, 0xffffffed
jge 0x420287
mov eax, 0xffffffff
jmp 0x42028a
add eax, 0x12
push eax
call fcn.004084d0
add esp, 4
mov esi, eax
mov dword [esp], 0x5db75ba6
mov dword [esp + 4], 0x41d95fbb
mov dword [esp + 8], 0x456a4396
mov dword [esp + 0xc], 0x49aa47a2
mov dword [esp + 0x10], 0x4b4a
xor eax, eax
nop
nop
movzx edx, byte [esp + eax]
mov ebx, eax
and ebx, 0x16
xor ebx, 0x824d76f6
mov ecx, eax
and ecx, 9
sub ecx, ebx
mov ebx, ecx
and ebx, edx
add ecx, edx
add ebx, ebx
sub ecx, ebx
mov edx, ecx
or edx, 0xaf
add edx, ecx
not ecx
or ecx, 0xaf
add edx, ecx
add dl, 2
mov byte [esp + eax], dl
inc eax
cmp eax, 0x14
jne 0x4202c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420321
add edi, 2
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420310
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420351
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420340
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043d360
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x4442f0]
Function at 0x425de6
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov ecx, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x425df0
sub eax, esi
cmp eax, 0xffffffd9
jge 0x425e19
mov eax, 0xffffffff
jmp 0x425e1c
add eax, 0x26
push eax
call fcn.004084d0
add esp, 4
mov ebx, eax
mov dword [esp + 0x18], 0x3c583a55
mov dword [esp + 0x1c], 0x30413e42
mov dword [esp + 0x20], 0x344a3257
mov dword [esp + 0x24], 0x485b3652
mov dword [esp + 0x28], 0x4c344a2a
mov dword [esp + 0x2c], 0x40294e33
mov dword [esp + 0x30], 0x44244238
mov dword [esp + 0x34], 0x5831467b
mov dword [esp + 0x38], 0x5c3d5a3d
mov word [esp + 0x3c], 0x5e5d
mov byte [esp + 0x3e], 0
mov eax, 0x16a494b1
movzx ecx, byte [esp + eax - 0x16a49499]
xor ecx, eax
mov edx, ecx
and edx, 0x77
xor ecx, 0x77
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x16a49499], cl
inc eax
cmp eax, 0x16a494d8
jne 0x425e80
movzx ecx, word [esi]
mov eax, ebx
test cx, cx
je 0x425ed1
mov edx, esi
add edx, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425ec0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x425f01
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425ef0
mov word [eax], 0
jmp dword [0x445098]

Function at 0x425f0c
Capabilities:
Copy file

Disassembly:
push esi
call fcn.004084e0
add esp, 4
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x4450a0]

Function at 0x425f25
Capabilities:
Copy file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x4450a0]

Function at 0x4264da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, edx
and al, 1
movzx ecx, al
mov eax, edx
jmp dword [ecx*4 + 0x445210]

Function at 0x426514
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x74], ebp
not eax
shr eax, 0x1f
xor edx, edx
mov ebp, edi
jmp dword [eax*4 + 0x445150]

Function at 0x426d2e
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x78]
mov ebp, edx
call fcn.004084e0
add esp, 4
mov edx, ebp
mov eax, edx
and al, 1
movzx ecx, al
mov eax, ebp
jmp dword [ecx*4 + 0x445210]

Function at 0x426dc8
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp esi, ebx
sete al
jmp dword [eax*4 + 0x445100]
Function at 0x426e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x100
mov dword [esp + 8], 0x8876b650
mov dword [esp + 0xc], 0x8c3b8a39
mov dword [esp + 0x10], 0x802e8e49
mov dword [esp + 0x14], 0x84228235
mov dword [esp + 0x18], 0x98878660
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x5d
xor dl, byte [esp + ecx + 8]
add dl, 0x18
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 0x16
jne 0x426ed0
lea esi, [esp + 0xec]
lea edx, [esp + 8]
mov edi, esi
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x100]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 9
push esi
push 0
call dword [0x449dc4]
mov ebp, eax
mov dword [esp + 8], 0xd01f1e7e
mov byte [esp + 0xc], 0
mov ebx, 0x336e61b5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx - 0x336e61ad]
mov ecx, edi
and ecx, ebx
mov eax, ecx
or al, 0xfd
inc al
mov edx, ecx
and dl, 0xbd
mul dl
mov edx, eax
mov eax, edi
add dl, al
mov eax, ecx
shr al, 1
and al, 1
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, ebx
add al, 0x58
mov byte [esp + ebx - 0x336e61ad], al
inc ebx
cmp ebx, 0x336e61ba
jne 0x426f40
xor eax, eax
cmp ebp, dword [esp + 8]
setne al
jmp dword [eax*4 + 0x445230]
Function at 0x4317c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
call fcn.00414fb0
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x4317e5
cmp eax, 0
setne al
jmp 0x4317ed
xor ebx, ebx
test al, 1
jne 0x4317f8
jmp 0x431968
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x431834
jmp 0x431960
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.004246c0
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x431951
mov dword [ebp - 0x28], eax
mov ebx, eax
sub ebx, 0xffffffff
sub esp, 4
mov dword [esp], ebx
call fcn.004084d0
sub esp, 8
mov dword [ebp - 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00409370
add esp, 0xc
mov al, byte [edi]
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1c], 0xfc
mov byte [ebp - 0x1b], 0x2c
mov byte [ebp - 0x1a], 0x28
mov byte [ebp - 0x19], 0x22
mov byte [ebp - 0x18], 0x11
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x14
mov byte [ebp - 0x15], 0x24
mov byte [ebp - 0x14], 0x13
mov byte [ebp - 0x13], 0xf6
mov byte [ebp - 0x12], 0x3d
mov byte [ebp - 0x11], 0x22
mov byte [ebp - 0x10], 0x3f
mov byte [ebp - 0xf], 0xac
mov eax, 0xe
mov byte [ebp + eax - 0x1c], 0
add eax, 1
cmp eax, 0xf
jne 0x4318cc
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0xf
jae 0x43191c
movzx edx, byte [ebp + eax - 0x1c]
mov edi, eax
add edi, 0xcaa05687
xor edi, edx
mov esi, edi
shl esi, 1
and esi, 0x8e
xor edi, 0xaafd4bc7
mov edx, edi
add edx, esi
mov ecx, dword [ebp + 8]
shl edi, 1
and edi, 2
xor edx, 1
add edx, edi
mov byte [ebp + eax - 0x1c], dl
add eax, 1
jmp 0x4318de
lea eax, [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], eax
mov esi, dword [ebp - 0x24]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
call fcn.004094e0
mov bl, al
and bl, 1
jmp 0x43193f
sub esp, 4
mov dword [esp], esi
call fcn.004084e0
add esp, 4
jmp 0x43194f
jmp 0x431951
sub esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x431968
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x436550
lea esi, [ebx - 2]
mov dword [esp], 0xc0c0ab9
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
add al, 0xda
xor al, byte [esp + edx]
add al, 0x30
mov byte [esp + edx], al
inc edx
cmp edx, 4
jne 0x436570
cmp ebx, 2
je 0x436599
mov edx, dword [esp]
mov eax, esi
sar esi, 1
test al, 2
jne 0x43659d
cmp ebx, 4
jne 0x4365b8
jmp 0x4365ea
mov eax, edi
jmp 0x4365ea
dec esi
movzx eax, word [ecx]
add ecx, 2
mov ebp, eax
and ebp, edi
add eax, edi
add ebp, ebp
sub eax, ebp
imul eax, edx
mov edi, eax
cmp ebx, 4
je 0x4365ea
xor ebx, ebx
mov eax, edi
nop
nop
nop
nop
movzx edi, word [ecx + ebx*2]
mov ebp, eax
and ebp, edi
add eax, edi
add ebp, ebp
sub eax, ebp
imul eax, edx
movzx edi, word [ecx + ebx*2 + 2]
mov ebp, eax
and ebp, edi
add eax, edi
add ebp, ebp
sub eax, ebp
imul eax, edx
add ebx, 2
cmp esi, ebx
jne 0x4365c0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4372b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
push eax
mov edi, esp
sub esp, 0x10
mov esi, esp
lea ecx, [ebp - 0x20]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.0043d190
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446764]

Function at 0x437530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.0043d980
add esp, 0x14
test eax, eax
js 0x437692
lea edi, [esp + 0x10]
lea eax, [esp + 0x14]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043de30
add esp, 0x24
mov ecx, eax
xor esi, esi
mov eax, 0
test ecx, ecx
js 0x4375d0
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc ecx
jns 0x43759a
mov eax, 0xffffffff
jmp 0x4375a1
lea eax, [eax*2 + 2]
push eax
call fcn.004084d0
add esp, 4
push edi
mov edi, eax
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.0043e500
add esp, 0x14
test eax, eax
js 0x4375c5
mov eax, edi
jmp 0x4375d0
push edi
call fcn.004084e0
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x24252627
mov byte [esp + 8], 0
mov edx, 0xd954ed67
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 4]
mov ebx, edx
and ebx, 0xd8404502
mov ebp, esi
and ebp, 5
or ebp, ebx
xor ebp, 0xfeeb579a
lea ebx, [edx + 0x26ab1300]
xor ebx, ebp
and ebx, edi
xor ebx, ebp
mov edi, ebx
not edi
lea ebx, [ebx + edi*2]
mov cl, 0x3e
sub cl, bl
mov byte [esp + esi + 4], cl
inc esi
dec edx
cmp esi, 5
jne 0x4375f0
mov edx, dword [0x449dc8]
test edx, edx
je 0x437681
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x449dcc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x437660
inc edi
cmp edx, edi
jne 0x437650
jmp 0x437681
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x437681
push dword [esp + 0xc]
push 4
push edx
push dword [0x449dd0]
mov esi, eax
call fcn.0043ad80
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x437694
lea eax, [esp + 4]
push eax
call fcn.0043cf70
add esp, 4
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439520
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x4395f0
xor eax, eax
cmp dword [ecx], 0
jne 0x439638
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 2], 0x24252627
mov byte [esp + 6], 0
xor eax, eax
mov esi, 0x67
nop
movzx ebx, byte [esp + eax + 2]
mov edi, eax
or edi, ebx
or edi, 0x26ab1298
not ebx
or ebx, esi
and ebx, edi
mov edi, ebx
not edi
and edi, 0xf3
and ebx, 0xc
sub ebx, edi
add bl, 0x33
mov byte [esp + eax + 2], bl
inc eax
dec esi
cmp eax, 5
jne 0x439590
mov eax, dword [esp + 2]
mov esi, dword [0x449dc8]
test esi, esi
je 0x439638
xor edi, edi
mov ebx, dword [0x449dcc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x439641
inc edi
cmp esi, edi
jne 0x4395e0
jmp 0x439638
mov dword [esp + 8], 0x7ebdbc83
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov esi, ecx
xor esi, 0xfba723a
mov ebx, eax
and ebx, 2
sub ebx, esi
add ebx, 0xecd388dd
mov esi, edx
and esi, ebx
add esi, esi
sub ebx, esi
add bl, dl
add bl, 0xe8
mov byte [esp + ecx + 8], bl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x439600
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x439638
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x1c
jmp 0x439638
Function at 0x43a720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
push eax
sub esp, 0x14
mov dword [ebp - 0x34], esp
sub esp, 0x1c
mov dword [ebp - 0x30], esp
mov dword [ebp - 0x2c], 0xdd48db34
mov dword [ebp - 0x28], 0xc12cdf3a
mov dword [ebp - 0x24], 0xc5eac32e
mov dword [ebp - 0x20], 0xc924c722
mov dword [ebp - 0x1c], 0xcdcccb26
mov byte [ebp - 0x18], 0
xor eax, eax
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
movzx esi, byte [ebp + ebx - 0x2c]
mov edi, ebx
xor edi, 0x8d18f1d4
mov edx, dword [ebp - 0x10]
and edx, 0x16
sub edx, edi
mov edi, esi
not edi
or edi, 0xb2bb9626
lea eax, [esi + edi]
inc eax
and esi, 0xffffffd9
xor esi, 0x4d4469d9
mov edi, 0x4504a0a1
sub edi, edx
add edx, 0x3afb5f5e
or eax, esi
and edi, 0x400400d9
and edx, 0x20a20426
or edx, edi
mov dword [ebp - 0x38], eax
mov esi, eax
and esi, edx
add esi, esi
sub edx, esi
lea esi, [edx + eax]
mov edi, esi
and edi, 0x90ec93ad
mov ecx, esi
and ecx, 2
mov eax, ecx
xor eax, 2
imul eax, edi
or edi, 2
imul edi, ecx
add edi, eax
add esi, esi
and esi, 0x5e
mov eax, dword [ebp - 0x38]
add eax, edx
add eax, 0x90ec93af
mov edx, eax
sub edx, esi
add edx, edi
and eax, 1
or edx, 1
add edx, eax
mov byte [ebp + ebx - 0x2c], dl
mov eax, dword [ebp - 0x10]
inc ebx
add eax, 2
cmp ebx, 0x15
jne 0x43a770
lea eax, [ebp - 0x2c]
push eax
call fcn.0043c420
add esp, 4
mov ecx, eax
mov dword [0x451de4], eax
xor eax, eax
test ecx, ecx
sete al
mov eax, dword [eax*4 + 0x446954]
mov edx, 0x4dc8a8e7
xor edx, dword [0x44695c]
add edx, eax
inc edx
xor eax, eax
jmp edx

Function at 0x43ba90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x38]
movzx eax, word [eax]
mov dword [esp], eax
mov dword [esp + 0xa], 0x2423c8fc
lea ecx, [esp + 0xa]
xor edx, edx
mov esi, 0x98e1f269
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, dl
and edi, 1
add edi, edi
mov ebp, esi
sub ebp, edi
mov edi, ebx
and edi, 2
mov eax, ebp
and eax, edi
xor edi, ebp
lea eax, [edi + eax*2]
xor al, byte [ecx]
add al, 0xb8
mov byte [ecx], al
inc ecx
add ebx, 2
inc esi
inc dl
cmp ebx, 8
jne 0x43bac0
xor eax, eax
mov ecx, dword [esp]
cmp dword [esp + 0xa], ecx
setne al
mov eax, dword [eax*4 + 0x446ef8]
mov ecx, 0x48a14ea2
xor ecx, dword [str.q8_t_]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x43c3f0
Capabilities:
Encode data using xor

Disassembly:
push eax
mov dword [esp], 0x24232211
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x69
xor cl, byte [esp + eax]
add cl, 0xb8
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43c400
mov eax, dword [esp]
mov eax, dword fs:[eax]
pop ecx
ret
Function at 0x43cfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cfd0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43cfeb
mov eax, 0xffffffff
jmp 0x43cfee
add eax, 0xa
push eax
call fcn.004084d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43d031
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43d020
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xa2a3a4a5
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edi, 0x60889915
sub edi, ecx
lea ebx, [ecx + 0xa]
mov ebp, edi
and ebp, 0x1c
and ebx, 0x1c
xor ebx, 0x2008981c
mov edx, ecx
and edx, 3
or edx, ebp
or edx, ebx
and edi, 3
xor edi, 0x16600203
xor edx, 2
or edx, edi
xor edx, esi
lea esi, [edx + edx]
and esi, 0x5e
xor esi, 0x58
xor edx, 0x53
add edx, esi
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x43d0b0
mov esi, dword [esp]
mov ecx, dword [0x449dc8]
test ecx, ecx
je 0x43d175
xor edx, edx
mov edi, dword [0x449dcc]
nop
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43d130
inc edx
cmp ecx, edx
jne 0x43d120
jmp 0x43d175
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d175
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x449dd0]
mov edi, eax
call fcn.0043ad80
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004084e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d190
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
mov esi, 0xfffffffe
cmp word [ebp + esi + 2], 0
lea esi, [esi + 2]
jne 0x43d1a0
sar esi, 1
lea ebx, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43d1c5
mov eax, 0xffffffff
jmp 0x43d1c7
add eax, eax
push eax
call fcn.004084d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x43d212
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x43d200
mov word [ecx], 0
mov ecx, ebx
and ecx, 0xfffd
and esi, 2
mov edx, esi
xor edx, 2
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp + 8], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xa2a3a4a5
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov ebx, 0x60889915
sub ebx, ecx
lea ebp, [ecx + 0xa]
mov edi, ebx
and edi, 0x1c
and ebp, 0x1c
xor ebp, 0x2008981c
mov edx, ecx
and edx, 3
or edx, edi
or edx, ebp
and ebx, 3
xor ebx, 0x16600203
xor edx, 2
or edx, ebx
xor edx, esi
lea esi, [edx + edx]
and esi, 0x5e
xor esi, 0x58
xor edx, 0x53
add edx, esi
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x43d290
mov esi, dword [esp]
mov ecx, dword [0x449dc8]
test ecx, ecx
je 0x43d347
xor edx, edx
mov ebx, dword [0x449dcc]
nop
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43d310
inc edx
cmp ecx, edx
jne 0x43d300
jmp 0x43d347
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d347
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x449dd0]
mov edi, eax
call fcn.0043ad80
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004084e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d380
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d39b
mov eax, 0xffffffff
jmp 0x43d39e
add eax, 0xa
push eax
call fcn.004084d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43d3e1
add ebx, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43d3d0
mov word [ecx], 0
lea ecx, [esi*2 + 8]
mov word [esp], cx
and esi, 1
xor ecx, 2
lea ecx, [ecx + esi*4]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xa2a3a4a5
mov byte [esp + 0x24], 0
xor ecx, ecx
mov esi, 0x60889915
sub esi, ecx
mov ebx, esi
and ebx, 0x1c
mov edx, ecx
and edx, 3
or edx, ebx
lea ebx, [ecx + 0xa]
and ebx, 0x1c
xor ebx, 0x2008981c
or edx, ebx
and esi, 3
xor esi, 0x16600203
xor edx, 2
or edx, esi
movzx esi, byte [esp + ecx + 0x20]
xor edx, esi
lea esi, [edx + edx]
and esi, 0x5e
xor esi, 0x58
xor edx, 0x53
add edx, esi
inc dl
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x43d440
mov esi, dword [esp + 0x20]
mov ecx, dword [0x449dc8]
test ecx, ecx
je 0x43d4e9
xor edx, edx
mov ebx, dword [0x449dcc]
cmp dword [ebx + edx*8], 0xcaa82e26
je 0x43d4c0
inc edx
cmp ecx, edx
jne 0x43d4b0
jmp 0x43d4e9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d4e9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x449dd0]
mov ebx, eax
call fcn.0043ad80
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.004084e0
add esp, 4
test edi, edi
je 0x43d4fc
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret