joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437813
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, edi
call fcn.00424fc8
lea esi, [ebp - 8]
call fcn.00424fc8
mov eax, 0x16461646
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x63
mov byte [ebp - 0x4c], 0x25
lea eax, [ebp - 0x4c]
inc eax
xor byte [eax], 0x63
jne 0x437840
movzx eax, byte [ebp + 0xb]
push eax
movzx eax, byte [ebp + 0xa]
push eax
movzx eax, byte [ebp + 9]
push eax
movzx eax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 8]
call fcn.0042549a
push dword [ebp - 8]
call fcn.0042767b
add esp, 0x18
test edx, edx
jl 0x437969
jg 0x437883
test eax, eax
je 0x437969
mov dword [ebp - 0x4c], 0x57552a46
mov word [ebp - 0x48], 0x6316
mov byte [ebp - 0x4c], 0x25
lea ecx, [ebp - 0x4c]
inc ecx
xor byte [ecx], 0x63
jne 0x437897
push 0
push 3
push edx
push eax
call fcn.00446fec
push edx
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 8]
call fcn.0042549a
mov ecx, dword [ebp - 8]
add esp, 0xc
test ecx, ecx
jne 0x4378c4
xor eax, eax
jmp 0x4378c9
call fcn.00424786
push eax
push ecx
lea eax, [ebp + 8]
push eax
call fcn.0042e064
add esp, 0xc
lea eax, [ebp + 8]
call fcn.00424ab4
test al, al
jne 0x437961
lea eax, [ebp - 0xc]
push eax
push 0xa
pop eax
xor edx, edx
lea ebx, [ebp + 8]
call fcn.00425562
mov ebx, eax
lea esi, [ebp + 8]
call fcn.00425388
lea esi, [ebp - 0xc]
call fcn.00424fe3
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x437911
xor eax, eax
jmp 0x437916
call fcn.00424786
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.0042e064
add esp, 0xc
mov ebx, eax
mov esi, edi
call fcn.00425388
lea esi, [ebp - 0xc]
call fcn.00424fe3
mov eax, edi
call fcn.00424ab4
test al, al
jne 0x437961
lea eax, [ebp - 0xc]
push eax
push 0xa
pop eax
xor edx, edx
mov ebx, edi
call fcn.00425562
mov ebx, eax
mov esi, edi
call fcn.00425388
lea esi, [ebp - 0xc]
call fcn.00424fe3
lea esi, [ebp + 8]
call fcn.00424fe3
lea esi, [ebp - 8]
call fcn.00424fe3
pop esi
mov eax, edi
pop ebx
leave
ret 4
Function at 0x437bfe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
and dword [ebp - 4], 0
mov dword [ebp - 0x60], 0x34051a09
mov dword [ebp - 0x5c], 0x17562b31
mov dword [ebp - 0x58], 0x7550757
mov byte [ebp - 0x54], 0x63
mov byte [ebp - 0x60], 0x6a
lea eax, [ebp - 0x60]
inc eax
xor byte [eax], 0x63
jne 0x437c28
push ebx
push esi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
call fcn.00441f50
pop ecx
pop ecx
push dword [eax]
lea esi, [ebp + 0x10]
call fcn.00424f68
lea eax, [ebp - 0x60]
push eax
mov edi, esi
call fcn.0042521f
lea esi, [ebp - 4]
call fcn.00424fe3
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
call fcn.00424f98
mov edx, dword [edi]
test edx, edx
jne 0x437c71
xor esi, esi
jmp 0x437c7a
mov ecx, edx
call fcn.00424786
mov esi, eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x437c85
xor eax, eax
jmp 0x437c8a
call fcn.00424786
push esi
push edx
push eax
push ecx
call fcn.0042d9f9
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push esi
call fcn.0042dd2e
mov ebx, eax
add esp, 0x18
mov dword [ebp - 0x20], ebx
test ebx, ebx
jne 0x437cbc
mov eax, dword [edi]
test eax, eax
je 0x437da0
mov byte [eax], bl
jmp 0x437da0
cmp byte [ebp + 0x14], 1
jne 0x437cec
lea esi, [ebp - 0x1c]
mov dword [ebp - 4], 3
call fcn.00424fc8
push dword [ebp + 0xc]
push 0
push ebx
mov ebx, eax
call fcn.004250f9
lea ecx, [ebp - 0x18]
push ecx
mov edi, eax
call fcn.00441fcc
pop ecx
jmp 0x437d12
lea esi, [ebp - 0x14]
mov dword [ebp - 4], 0xc
call fcn.00424fc8
push dword [ebp + 0xc]
push 0
push ebx
mov ebx, eax
call fcn.004250f9
mov esi, eax
lea edi, [ebp - 0x10]
call fcn.00424f98
push 0x7a
lea esi, [ebp - 0xc]
mov ebx, eax
call 0x424f3f
mov edi, eax
lea eax, [ebp + 0x14]
push eax
mov word [ebp + 0x14], 0x3d
call fcn.0042521f
push ebx
lea ecx, [ebp - 8]
mov eax, edi
call fcn.004252bf
mov esi, dword [ebp + 8]
mov ebx, eax
call fcn.00425388
lea esi, [ebp - 8]
call fcn.00424fe3
lea esi, [ebp - 0xc]
call fcn.00424fe3
mov ebx, dword [ebp - 4]
test bl, 8
je 0x437d67
lea esi, [ebp - 0x10]
and ebx, 0xfffffff7
call fcn.00424fe3
test bl, 4
je 0x437d77
lea esi, [ebp - 0x14]
and ebx, 0xfffffffb
call fcn.00424fe3
test bl, 2
je 0x437d87
lea esi, [ebp - 0x18]
and ebx, 0xfffffffd
call fcn.00424fe3
test bl, 1
je 0x437d94
lea esi, [ebp - 0x1c]
call fcn.00424fe3
push dword [ebp - 0x20]
call fcn.0040a90b
mov edi, dword [ebp + 8]
pop ecx
lea esi, [ebp + 0x10]
call fcn.00424fe3
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x437db1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
lea esi, [ebp - 0x10]
call fcn.0040d412
mov esi, 0x4d5b4d5b
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x635b4d5b
mov byte [ebp - 0x49], 0x63
mov byte [ebp - 0x50], 0x38
lea eax, [ebp - 0x50]
inc eax
xor byte [eax], 0x63
jne 0x437ddc
lea eax, [ebp - 0x50]
push eax
call fcn.0042428d
mov edi, eax
pop ecx
lea eax, [ebp - 0x10]
call fcn.0040d445
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x63574d57
mov byte [ebp - 0x49], 0x63
mov byte [ebp - 0x50], 0x38
lea eax, [ebp - 0x50]
inc eax
xor byte [eax], 0x63
jne 0x437e0b
lea eax, [ebp - 0x50]
push eax
call fcn.0042428d
mov edi, eax
pop ecx
lea eax, [ebp - 0x10]
call fcn.0040d445
mov ebx, 0x514d5455
mov esi, 0x514d5151
mov dword [ebp - 0x50], 0x4d5b5351
mov dword [ebp - 0x44], 0x63635351
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x42], 0x63
mov byte [ebp - 0x50], 0x32
lea eax, [ebp - 0x50]
inc eax
xor byte [eax], 0x63
jne 0x437e4e
lea eax, [ebp - 0x50]
push eax
call fcn.0042428d
mov edi, eax
pop ecx
lea eax, [ebp - 0x10]
call fcn.0040d445
mov dword [ebp - 0x50], 0x4d5b5351
mov dword [ebp - 0x44], 0x63635151
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x42], 0x63
mov byte [ebp - 0x50], 0x32
lea eax, [ebp - 0x50]
inc eax
xor byte [eax], 0x63
jne 0x437e87
lea eax, [ebp - 0x50]
push eax
call fcn.0042428d
mov edi, eax
pop ecx
lea eax, [ebp - 0x10]
call fcn.0040d445
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
call fcn.00441f50
lea eax, [ebp - 4]
push eax
lea esi, [ebp - 0x10]
call fcn.0043677b
add esp, 0xc
cmp eax, 0xffffffff
je 0x437ee9
push eax
call fcn.00424232
mov edi, eax
pop ecx
test edi, edi
je 0x437ee9
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.00425388
push edi
lea eax, [ebp - 4]
mov ecx, esi
call fcn.004256b3
xor ebx, ebx
inc ebx
lea esi, [ebp - 4]
call fcn.00424fe3
lea esi, [ebp - 0x10]
call fcn.0040d434
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x437f00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx]
sub esp, 0x1c0
push esi
push edi
test eax, eax
je 0x437f14
mov byte [eax], 0
mov eax, 0x100d0a45
mov dword [ebp - 0x180], 0x5e1a0608
mov dword [ebp - 0x13c], 0x6363635e
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf8], 0x63636300
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xb8], 0x63061502
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0x63631106
mov byte [ebp - 0x17c], 0x63
mov dword [ebp - 0x1c0], 0x5e070a45
mov byte [ebp - 0x1bc], 0x63
mov dword [ebp - 0x140], 0x51070a45
mov byte [ebp - 0x13b], 0x63
mov dword [ebp - 0xfc], 0xd155e17
mov byte [ebp - 0xf7], 0x63
mov dword [ebp - 0xbc], 0xf105e17
mov byte [ebp - 0xb5], 0x63
mov dword [ebp - 0x7c], 0x20e5e17
mov dword [ebp - 0x78], 0x11061710
mov byte [ebp - 0x74], 0x63
mov dword [ebp - 0x3c], 0xf135e17
mov dword [ebp - 0x38], 0xd0a0416
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x180], 0x6b
lea eax, [ebp - 0x180]
inc eax
xor byte [eax], 0x63
jne 0x437fd6
mov eax, dword [ebp + 8]
push dword [eax + 0x314]
lea edi, [ebp + 8]
call fcn.00437813
mov esi, eax
lea eax, [ebp - 0x180]
push eax
mov edi, ebx
call fcn.0042521f
push dword [esi]
mov edi, eax
call fcn.0042521f
lea esi, [ebp + 8]
call fcn.00424fe3
mov byte [ebp - 0x1c0], 0x26
lea eax, [ebp - 0x1c0]
inc eax
xor byte [eax], 0x63
jne 0x43801b
mov esi, dword [0x448688]
lea eax, [ebp - 0x1c0]
push eax
mov edi, ebx
call fcn.0042521f
push dword [esi + 0x38]
mov edi, eax
call fcn.0042521f
mov byte [ebp - 0x140], 0x26
lea eax, [ebp - 0x140]
inc eax
xor byte [eax], 0x63
jne 0x43804c
mov esi, dword [0x448688]
lea eax, [ebp - 0x140]
push eax
mov edi, ebx
call fcn.0042521f
push dword [esi + 0x3c]
mov edi, eax
call fcn.0042521f
mov eax, dword [0x44842c]
cmp eax, 3
jne 0x438095
mov byte [ebp - 0x100], 0x26
lea eax, [ebp - 0x100]
inc eax
xor byte [eax], 0x63
jne 0x438087
lea eax, [ebp - 0x100]
jmp 0x4380e0
cmp eax, 1
jne 0x4380b5
mov byte [ebp - 0xc0], 0x26
lea eax, [ebp - 0xc0]
inc eax
xor byte [eax], 0x63
jne 0x4380a7
lea eax, [ebp - 0xc0]
jmp 0x4380e0
test eax, eax
jne 0x4380cb
mov byte [ebp - 0x80], 0x26
lea eax, [ebp - 0x80]
inc eax
xor byte [eax], 0x63
jne 0x4380c0
lea eax, [ebp - 0x80]
jmp 0x4380e0
cmp eax, 2
jne 0x4380e8
mov byte [ebp - 0x40], 0x26
lea eax, [ebp - 0x40]
inc eax
xor byte [eax], 0x63
jne 0x4380d7
lea eax, [ebp - 0x40]
push eax
mov edi, ebx
call fcn.0042521f
mov eax, dword [ebp + 0xc]
push dword [eax]
mov edi, ebx
call fcn.0042521f
pop edi
pop esi
leave
ret 8
Function at 0x438163
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
lea esi, [ebp - 4]
call fcn.00424fc8
lea esi, [ebp + 0xc]
lea edi, [ebp - 8]
call fcn.00424f98
lea eax, [ebp - 4]
push eax
mov eax, edi
push eax
call fcn.00437db1
pop ecx
pop ecx
cmp eax, 1
jne 0x4381ac
mov edi, dword [ebp + 8]
lea esi, [ebp - 4]
call fcn.00424f98
lea esi, [ebp - 8]
call fcn.00424fe3
lea esi, [ebp - 4]
jmp 0x438344
lea esi, [ebp - 8]
call fcn.00424fe3
lea esi, [ebp - 4]
call fcn.00424fe3
mov dword [ebp - 0x5c], 0x7000102
mov dword [ebp - 0x58], 0xb040506
mov dword [ebp - 0x54], 0xf08090a
mov dword [ebp - 0x50], 0x130c0d0e
mov dword [ebp - 0x4c], 0x17101112
mov dword [ebp - 0x48], 0x1b141516
mov dword [ebp - 0x44], 0x5253191a
mov dword [ebp - 0x40], 0x56575051
mov dword [ebp - 0x3c], 0x5a5b5455
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x5c], 0x61
lea eax, [ebp - 0x5c]
inc eax
xor byte [eax], 0x63
jne 0x438206
lea eax, [ebp - 0x5c]
push eax
lea esi, [ebp - 0x14]
call fcn.00424f68
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00441f50
pop ecx
pop ecx
push dword [eax]
xor esi, esi
lea eax, [ebp + 0xc]
call 0x424e31
lea esi, [ebp - 0x10]
mov dword [ebp - 8], eax
call fcn.00424fe3
cmp dword [ebp - 8], 0xffffffff
je 0x438336
push ebx
lea esi, [ebp - 0x10]
call fcn.00424fc8
push 0x32
push 0xc
call fcn.0042895b
pop ecx
pop ecx
test eax, eax
jle 0x43829d
mov esi, dword [ebp - 0x14]
mov byte [ebp - 3], 0
mov ebx, eax
test esi, esi
jne 0x438271
xor eax, eax
jmp 0x438278
mov ecx, esi
call fcn.00424786
push eax
call fcn.0042891c
pop ecx
test esi, esi
jne 0x438287
xor eax, eax
jmp 0x438289
add eax, esi
mov al, byte [eax]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
lea edi, [ebp - 0x10]
call fcn.0042521f
dec ebx
jne 0x438269
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
xor edx, edx
lea ebx, [ebp + 0xc]
call fcn.00425562
push dword [eax]
lea esi, [ebp - 0xc]
call fcn.00424f68
push dword [ebp - 0x10]
mov edi, esi
call fcn.0042521f
push dword [ebp - 0xc]
lea esi, [ebp - 4]
call fcn.00424f68
push 0x4056ac
mov edi, esi
call fcn.0042521f
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, ebx
call fcn.0042552d
push dword [ebp - 4]
lea esi, [ebp - 8]
mov edi, eax
call fcn.00424f68
push dword [edi]
mov edi, esi
call fcn.0042521f
mov ebx, esi
lea esi, [ebp + 0xc]
call fcn.00425388
mov esi, ebx
call fcn.00424fe3
lea esi, [ebp - 4]
call fcn.00424fe3
lea esi, [ebp - 0xc]
call fcn.00424fe3
lea esi, [ebp - 0x18]
call fcn.00424fe3
lea esi, [ebp - 0x1c]
call fcn.00424fe3
lea esi, [ebp - 0x10]
call fcn.00424fe3
pop ebx
mov edi, dword [ebp + 8]
lea esi, [ebp + 0xc]
call fcn.00424f98
lea esi, [ebp - 0x14]
call fcn.00424fe3
lea esi, [ebp + 0xc]
call fcn.00424fe3
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x43858a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
and dword [ebp - 8], 0
push ebx
xor ebx, ebx
inc ebx
push esi
cmp dword [0x4010d8], ebx
jne 0x4385a5
mov eax, ebx
jmp 0x438622
push dword [0x4010d0]
call fcn.004366bb
pop ecx
test eax, eax
jne 0x438618
mov dword [ebp - 0x50], 0xe154e43
mov byte [ebp - 0x4c], 0x63
cmp dword [0x448428], eax
jne 0x4385f9
mov dword [ebp - 8], ebx
mov byte [ebp - 0x50], 0x20
lea eax, [ebp - 0x50]
inc eax
xor byte [eax], 0x63
jne 0x4385d2
lea eax, [ebp - 0x50]
push eax
call fcn.0042965a
push eax
lea esi, [ebp - 0xc]
call fcn.00424f68
xor esi, esi
call 0x424de0
mov byte [ebp - 1], bl
cmp eax, 0xffffffff
jne 0x4385fd
mov byte [ebp - 1], 0
test byte [ebp - 8], bl
je 0x43860a
lea esi, [ebp - 0xc]
call fcn.00424fe3
cmp byte [ebp - 1], 0
je 0x438618
mov dword [0x4010d8], ebx
jmp 0x4385a1
call fcn.00431005
neg eax
sbb eax, eax
inc eax
pop esi
pop ebx
leave
ret

Function at 0x438cb4
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax + 0x2c], 0x6363630d
mov dword [eax], 0x17050c30
mov dword [eax + 4], 0x6110214
mov dword [eax + 8], 0xa2e3f
mov dword [eax + 0xc], 0xc100c11
mov dword [eax + 0x10], 0x343f1705
mov dword [eax + 0x14], 0xc070d0a
mov dword [eax + 0x18], 0x203f1014
mov dword [eax + 0x1c], 0x6111116
mov dword [eax + 0x20], 0x635170d
mov dword [eax + 0x24], 0xc0a1011
mov dword [eax + 0x28], 0x16313f0d
mov byte [eax + 0x2d], 0x63
jmp 0x42d8a9
Function at 0x43a37c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
and dword [ebp - 4], 0
push esi
push edi
lea esi, [ebp - 8]
call fcn.00424fc8
xor esi, esi
mov edx, dword [0x448688]
mov ecx, dword [edx + 0x38]
test ecx, ecx
je 0x43a3d3
call fcn.00424786
cmp esi, eax
jae 0x43a3d3
mov eax, ecx
test eax, eax
je 0x43a3b3
add eax, esi
mov al, byte [eax]
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x43a3d0
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
lea edi, [ebp - 8]
mov byte [ebp - 3], 0
call fcn.0042521f
inc esi
jmp 0x43a395
push ebx
lea eax, [ebp - 8]
call fcn.00424ab4
xor ecx, ecx
inc ecx
cmp al, cl
jne 0x43a3f7
lea eax, [ebp - 0x10]
push eax
mov eax, 0x405a88
mov dword [ebp - 4], ecx
call fcn.0043e85b
pop ecx
jmp 0x43a40f
lea eax, [ebp - 0xc]
push eax
push 4
pop eax
xor edx, edx
lea ebx, [ebp - 8]
mov dword [ebp - 4], 2
call fcn.00425562
mov ebx, eax
lea esi, [ebp - 8]
call fcn.00425388
test byte [ebp - 4], 2
pop ebx
je 0x43a42c
and dword [ebp - 4], 0xfffffffd
lea esi, [ebp - 0xc]
call fcn.00424fe3
test byte [ebp - 4], 1
je 0x43a43a
lea esi, [ebp - 0x10]
call fcn.00424fe3
lea esi, [ebp - 4]
mov dword [ebp - 0x90], 0xa190c2e
mov dword [ebp - 0x8c], 0x4c020f0f
mov dword [ebp - 0x88], 0x43534d57
mov dword [ebp - 0x84], 0xe0c004b
mov dword [ebp - 0x80], 0xa170213
mov dword [ebp - 0x7c], 0x58060f01
mov dword [ebp - 0x78], 0x2a302e43
mov dword [ebp - 0x74], 0x4d554326
mov dword [ebp - 0x70], 0x34435853
mov dword [ebp - 0x6c], 0xc070d0a
mov dword [ebp - 0x68], 0x2d431014
mov dword [ebp - 0x64], 0x4d564337
mov dword [ebp - 0x60], 0x30435852
mov dword [ebp - 0x5c], 0x43585235
mov dword [ebp - 0x58], 0x37262d4d
mov dword [ebp - 0x54], 0x312f2043
mov dword [ebp - 0x50], 0x534d5243
mov dword [ebp - 0x4c], 0x4a10464d
mov byte [ebp - 0x48], 0x63
call fcn.00424fc8
xor byte [ebp - 0x90], 0x63
je 0x43a4e5
lea eax, [ebp - 0x90]
inc eax
xor byte [eax], 0x63
jne 0x43a4df
push dword [ebp - 8]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 4]
call fcn.0042549a
mov eax, dword [0x4488bc]
xor esi, esi
pop ecx
pop ecx
cmp eax, esi
jne 0x43a514
push 0xdf0049e1
call fcn.00427c67
pop ecx
mov dword [0x4488bc], eax
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call eax
lea esi, [ebp - 4]
mov edi, eax
call fcn.00424fe3
lea esi, [ebp - 8]
call fcn.00424fe3
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x43a6d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], 0x6000022
mov dword [ebp - 0x2c], 0x630d064f
mov dword [ebp - 0x44], 0x2f4e1713
mov dword [ebp - 0x40], 0x16040d02
mov dword [ebp - 0x3c], 0x59060402
mov dword [ebp - 0x38], 0x4e0d0643
mov dword [ebp - 0x34], 0x12583036
mov dword [ebp - 0x30], 0x514d535e
mov byte [ebp - 0x29], 0x63
mov byte [ebp - 0x48], 0x41
lea eax, [ebp - 0x48]
inc eax
xor byte [eax], 0x63
jne 0x43a720
push esi
push edi
lea eax, [ebp - 0x48]
push eax
lea esi, [ebp - 8]
call fcn.00424f68
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x43a73f
xor eax, eax
jmp 0x43a744
call fcn.00424786
push 0xa0000000
push eax
push ecx
push ebx
call fcn.00439f29
add esp, 0x10
and dword [ebp - 4], 0
mov eax, dword [0x4489f8]
test eax, eax
jne 0x43a77a
mov eax, dword [0x4488c8]
test eax, eax
jne 0x43a77a
push 0x81cd3706
call fcn.00427c67
pop ecx
mov dword [0x4488c8], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call eax
mov edi, eax
call fcn.00427398
mov esi, eax
cmp edi, 1
je 0x43a7e8
cmp esi, 0x2f0d
je 0x43a7a7
cmp esi, 0x2f19
jne 0x43a7bd
push ebx
call fcn.0043a265
pop ecx
test eax, eax
je 0x43a7e1
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x43a758
jmp 0x43a7e8
push ebx
call fcn.00439dc4
mov eax, dword [0x4488b8]
push eax
mov dword [0x4488b8], 0
call fcn.00439dc4
pop ecx
pop ecx
call fcn.0043a37c
jmp 0x43a7e8
call fcn.00427398
mov esi, eax
push esi
call fcn.00427375
pop ecx
lea esi, [ebp - 8]
call fcn.00424fe3
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x43afd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push ecx
lea esi, [ebp + 8]
mov edi, esp
mov ebx, eax
call fcn.00424f98
call fcn.0043a925
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x43b002
call fcn.00427398
mov ebx, dword [ebp - 8]
mov esi, eax
jmp 0x43b160
push ecx
mov esi, ebx
mov edi, esp
call fcn.00424f98
push ecx
lea esi, [ebp + 8]
mov edi, esp
call fcn.00424f98
push dword [ebp - 8]
call fcn.0043a7fd
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x43b037
call fcn.00427398
mov ebx, dword [ebp - 8]
mov esi, eax
jmp 0x43b157
mov dword [ebp - 0x4c], 0x170d0c20
mov dword [ebp - 0x20], 0x63070607
mov dword [ebp - 0x48], 0x4e170d06
mov dword [ebp - 0x44], 0x6131a37
mov dword [ebp - 0x40], 0x13024359
mov dword [ebp - 0x3c], 0xa0f13
mov dword [ebp - 0x38], 0xc0a1702
mov dword [ebp - 0x34], 0x4e1b4c0d
mov dword [ebp - 0x30], 0x4e141414
mov dword [ebp - 0x2c], 0xe110c05
mov dword [ebp - 0x28], 0xf11164e
mov dword [ebp - 0x24], 0xc000d06
mov byte [ebp - 0x1d], 0x63
mov byte [ebp - 0x4c], 0x43
lea eax, [ebp - 0x4c]
inc eax
xor byte [eax], 0x63
jne 0x43b096
lea eax, [ebp - 0x4c]
push eax
lea esi, [ebp - 4]
call fcn.00424f68
lea eax, [ebp - 0xc]
push eax
mov eax, 0x405a6c
call fcn.0043e85b
mov eax, dword [eax]
mov edx, dword [ebx]
push 1
call fcn.004246ae
mov ebx, eax
pop ecx
neg ebx
pop ecx
lea esi, [ebp - 0xc]
sbb bl, bl
call fcn.00424fe3
inc bl
je 0x43b0eb
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x43b0e0
xor eax, eax
jmp 0x43b0e5
call fcn.00424786
push 0
push 0
jmp 0x43b113
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
test edx, edx
jne 0x43b0f8
xor esi, esi
jmp 0x43b101
mov ecx, edx
call fcn.00424786
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x43b10c
xor eax, eax
jmp 0x43b111
call fcn.00424786
push esi
push edx
push eax
push ecx
mov ebx, edi
call fcn.0043a6d7
add esp, 0x10
lea esi, [ebp - 4]
mov ebx, eax
call fcn.00424fe3
call fcn.00427398
mov esi, eax
cmp ebx, 1
jne 0x43b150
push edi
call fcn.0043a331
lea ebx, [eax - 0xc8]
neg ebx
sbb ebx, ebx
inc ebx
pop ecx
jne 0x43b150
call fcn.00427398
mov esi, eax
push edi
call fcn.00439dc4
pop ecx
push dword [ebp - 8]
call fcn.00439dc4
pop ecx
push esi
call fcn.00427375
pop ecx
lea esi, [ebp + 8]
call fcn.00424fe3
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x43b176
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
push ecx
mov edi, esp
call fcn.00424f98
call fcn.0043a925
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x43b1af
call fcn.00427398
mov esi, eax
jmp 0x43b377
push ecx
mov esi, ebx
mov edi, esp
call fcn.00424f98
mov esi, dword [ebp + 8]
push ecx
mov edi, esp
call fcn.00424f98
push dword [ebp - 0x10]
call fcn.0043a7fd
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x43b1e1
call fcn.00427398
mov esi, eax
jmp 0x43b36e
mov dword [ebp - 0x58], 0x170d0c20
mov dword [ebp - 0x2c], 0x63070607
mov dword [ebp - 0x54], 0x4e170d06
mov dword [ebp - 0x50], 0x6131a37
mov dword [ebp - 0x4c], 0x13024359
mov dword [ebp - 0x48], 0xa0f13
mov dword [ebp - 0x44], 0xc0a1702
mov dword [ebp - 0x40], 0x4e1b4c0d
mov dword [ebp - 0x3c], 0x4e141414
mov dword [ebp - 0x38], 0xe110c05
mov dword [ebp - 0x34], 0xf11164e
mov dword [ebp - 0x30], 0xc000d06
mov byte [ebp - 0x29], 0x63
mov byte [ebp - 0x58], 0x43
lea eax, [ebp - 0x58]
inc eax
xor byte [eax], 0x63
jne 0x43b240
lea eax, [ebp - 0x58]
push eax
lea esi, [ebp - 4]
call fcn.00424f68
lea eax, [ebp - 0x14]
push eax
mov eax, 0x405a6c
call fcn.0043e85b
mov eax, dword [eax]
mov edx, dword [ebx]
push 1
call fcn.004246ae
mov ebx, eax
pop ecx
neg ebx
pop ecx
lea esi, [ebp - 0x14]
sbb bl, bl
call fcn.00424fe3
inc bl
je 0x43b295
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x43b28a
xor eax, eax
jmp 0x43b28f
call fcn.00424786
push 0
push 0
jmp 0x43b2bd
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
test edx, edx
jne 0x43b2a2
xor esi, esi
jmp 0x43b2ab
mov ecx, edx
call fcn.00424786
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x43b2b6
xor eax, eax
jmp 0x43b2bb
call fcn.00424786
push esi
push edx
push eax
push ecx
mov ebx, edi
call fcn.0043a6d7
add esp, 0x10
lea esi, [ebp - 4]
mov ebx, eax
call fcn.00424fe3
test ebx, ebx
jne 0x43b2e3
call fcn.00427398
mov esi, eax
jmp 0x43b367
push edi
call fcn.0043a331
pop ecx
cmp eax, 0xc8
jne 0x43b2d7
lea eax, [ebp - 8]
push eax
push edi
call fcn.00439e2e
pop ecx
pop ecx
test eax, eax
jne 0x43b317
call fcn.00427398
cmp eax, 0x3e5
jne 0x43b365
push 0x32
call fcn.00429723
pop ecx
jmp 0x43b2f1
cmp dword [ebp - 8], 0
je 0x43b365
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
add eax, dword [ebp - 8]
push eax
push dword [ebp - 0xc]
call 0x40a2de
pop ecx
pop ecx
test eax, eax
je 0x43b365
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 8]
mov ecx, dword [esi]
add ecx, eax
push ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.00439df9
add esp, 0x10
mov ebx, eax
call fcn.00427398
mov eax, dword [ebp - 0x18]
cmp ebx, 1
jne 0x43b361
test eax, eax
je 0x43b365
add dword [esi], eax
test eax, eax
jne 0x43b2f1
xor esi, esi
push edi
call fcn.00439dc4
pop ecx
push dword [ebp - 0x10]
call fcn.00439dc4
pop ecx
push esi
call fcn.00427375
mov eax, dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
leave
ret