joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x439559
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43956a
cmp eax, 2
je 0x4395dc
jmp 0x439609
push 0xbbf966b4
push dword [0x44ce74]
call fcn.0043eaf0
add esp, 8
test eax, eax
je 0x4395a7
mov ecx, dword [esi]
test ecx, ecx
je 0x4395d4
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x4395b0
cmp dword [esp], 0
je 0x4395b0
mov dword [esi + 4], 3
jmp 0x4395d4
mov dword [esi + 4], 1
jmp 0x439609
lea eax, [esp + 0xc]
push eax
call fcn.0043f2b0
add esp, 4
test al, al
je 0x4395d4
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x4395d1
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x439609
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x454e9c]
call fcn.0043eaf0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x4396b7
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor eax, eax
mov edx, 0xc1c6de16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
mov esi, eax
or esi, ebx
or esi, 0x3e3921e8
lea ecx, [edx + 1]
or ecx, ebx
mov ebx, edx
sub ebx, ecx
add ecx, eax
add ecx, 0x3e3921e9
xor ecx, esi
and ebx, esi
add ebx, ebx
sub ebx, ecx
add bl, 0x78
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 5
jne 0x439630
mov eax, dword [esp]
mov edx, dword [0x44ce80]
test edx, edx
je 0x4396b7
xor esi, esi
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x439690
inc esi
cmp edx, esi
jne 0x439680
jmp 0x4396b7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x4396b7
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 0x14
push edx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43bf80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x4499b0]

Function at 0x43cc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [ebp + 8]
push eax
push eax
mov esi, esp
movzx ecx, word [edi]
mov dword [ebp - 0x18], 0x514e1503
mov word [ebp - 0x14], 0
mov byte [ebp - 0x12], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x6d
xor bl, byte [ebp + edx - 0x18]
add bl, 0xdf
mov byte [ebp + edx - 0x18], bl
inc edx
cmp edx, 7
jne 0x43cc60
xor edx, edx
cmp dword [ebp - 0x18], ecx
setne dl
mov ecx, dword [edx*4 + 0x449e9c]
mov edx, 0x9cd7ef53
xor edx, dword [0x449ea4]
add ecx, edx
inc ecx
xor eax, eax
jmp ecx
Function at 0x43d3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
mov ecx, ebp
add ecx, ebx
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43d42a
mov ecx, ebp
shr ecx, 2
mov eax, ebx
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebp
and edx, 0xfffffffc
add esi, edx
add edx, ebx
mov eax, ebp
not eax
or eax, 3
lea ebx, [eax + ebp]
inc ebx
mov ecx, ebx
shr ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43d54e
and ebx, 0xfffffffe
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43d54e
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x2d
xor cl, byte [esp + eax]
add cl, 0x1f
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x43d440
mov eax, dword [esp]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x43d4b2
xor edx, edx
mov edi, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43d484
inc edx
cmp ecx, edx
jne 0x43d470
mov edi, dword [esp + 0x24]
jmp 0x43d4b2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x43d4b2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x28
test eax, eax
js 0x43d54e
push 0x732f71fd
push dword [0x454e9c]
call fcn.0043eaf0
add esp, 8
push 0
push 0
push ebp
push esi
push edi
push ebx
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
mov ebx, edx
add bl, 0x2d
xor bl, byte [esp + edx]
add bl, 0x1f
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x43d4f0
mov edx, dword [0x44ce80]
test edx, edx
je 0x43d54e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43d530
inc edi
cmp edx, edi
jne 0x43d520
jmp 0x43d54e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d54e
push ecx
push 4
push edx
push dword [0x44ce88]
mov esi, eax
call fcn.0043c030
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ea10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xd7d6c9f8
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x4084e7ce
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x4084e7ce]
xor edx, eax
lea esi, [edx + 0xf9]
not edx
xor esi, 1
and edx, 1
lea edx, [esi + edx*2]
mov byte [esp + eax - 0x4084e7ce], dl
inc eax
cmp eax, 0x4084e7d5
jne 0x43ea40
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a5c0]

Function at 0x43f310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f330
mov edi, eax
sar edi, 1
and eax, 8
mov esi, edi
xor esi, 4
add esi, eax
mov ecx, edi
and ecx, 1
mov eax, esi
or eax, 1
add eax, ecx
jns 0x43f35e
mov eax, 0xffffffff
jmp 0x43f360
add eax, eax
push eax
call fcn.00408770
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43f3a1
add ebx, 2
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43f390
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, edi
add esi, edx
mov word [esp + 8], si
mov ecx, esi
and ecx, 2
xor esi, 2
lea ecx, [esi + ecx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov ecx, 0x2d
mov edx, 0xd2
movzx esi, byte [esp + ecx - 0x2d]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x1f
mov byte [esp + ecx - 0x2d], bl
inc ecx
dec edx
cmp ecx, 0x32
jne 0x43f420
mov esi, dword [esp]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x43f4a2
xor edx, edx
mov edi, dword [0x44ce84]
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43f460
inc edx
cmp ecx, edx
jne 0x43f450
jmp 0x43f4a2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43f4a2
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44ce88]
mov edi, eax
call fcn.0043c030
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408780
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f4e0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43f4fb
mov eax, 0xffffffff
jmp 0x43f4fe
add eax, 0xa
push eax
call fcn.00408770
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f541
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f530
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov ecx, 0x2d
mov edx, 0xd2
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x2d]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x1f
mov byte [esp + ecx - 0x2d], bl
inc ecx
dec edx
cmp ecx, 0x32
jne 0x43f5b0
mov esi, dword [esp]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x43f621
xor edx, edx
mov ebx, dword [0x44ce84]
cmp dword [ebx + edx*8], 0x1affabda
je 0x43f5f0
inc edx
cmp ecx, edx
jne 0x43f5e0
jmp 0x43f621
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f621
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44ce88]
mov edi, eax
call fcn.0043c030
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408780
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f660
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43f67b
mov eax, 0xffffffff
jmp 0x43f67e
add eax, 0xa
push eax
call fcn.00408770
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f6c1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f6b0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xd0cfcecd
mov byte [esp + 0x24], 0
mov ecx, 0x2d
mov edx, 0xd2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xd]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x1f
mov byte [esp + ecx - 0xd], bl
inc ecx
dec edx
cmp ecx, 0x32
jne 0x43f730
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x43f7a9
xor edx, edx
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x43f780
inc edx
cmp ecx, edx
jne 0x43f770
jmp 0x43f7a9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f7a9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44ce88]
mov ebx, eax
call fcn.0043c030
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.00408780
add esp, 4
test edi, edi
je 0x43f7bc
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43f7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov eax, 0x2d
mov edx, 0xd2
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x2d]
mov ecx, edx
xor ecx, eax
and ecx, ebx
xor ecx, eax
add cl, 0x1f
mov byte [esp + eax - 0x2d], cl
inc eax
dec edx
cmp eax, 0x32
jne 0x43f800
mov eax, dword [esp]
mov edx, dword [0x44ce80]
test edx, edx
je 0x43f868
xor ebx, ebx
mov ecx, dword [0x44ce84]
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x43f840
inc ebx
cmp edx, ebx
jne 0x43f830
jmp 0x43f868
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43f868
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x20
test edi, edi
je 0x43f872
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43f87e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f890
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov eax, 0x2d
mov edi, 0xd2
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x2d]
mov ebx, edi
xor ebx, eax
and ebx, ebp
xor ebx, eax
add bl, 0x1f
mov byte [esp + eax - 0x2d], bl
inc eax
dec edi
cmp eax, 0x32
jne 0x43f8c0
mov eax, dword [esp]
mov ebx, dword [0x44ce80]
test ebx, ebx
je 0x43f92e
xor ebp, ebp
mov edi, dword [0x44ce84]
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x43f900
inc ebp
cmp ebx, ebp
jne 0x43f8f0
jmp 0x43f92e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f92e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x30
cmp eax, 0x103
jne 0x43f9b9
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov eax, 0x2d
mov ecx, 0xd2
nop
movzx edi, byte [esp + eax - 0x2d]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
add dl, 0x1f
mov byte [esp + eax - 0x2d], dl
inc eax
dec ecx
cmp eax, 0x32
jne 0x43f950
mov eax, dword [esp]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x43f9b1
xor edx, edx
mov edi, dword [0x44ce84]
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43f990
inc edx
cmp ecx, edx
jne 0x43f980
jmp 0x43f9b1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f9b1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x18
test eax, eax
js 0x43f9b9
mov eax, dword [esp + 8]
test esi, esi
je 0x43f9cc
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f9ca
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov eax, 0x2d
mov edi, 0xd2
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x2d]
mov ebx, edi
xor ebx, eax
and ebx, ebp
xor ebx, eax
add bl, 0x1f
mov byte [esp + eax - 0x2d], bl
inc eax
dec edi
cmp eax, 0x32
jne 0x43fa10
mov eax, dword [esp]
mov ebx, dword [0x44ce80]
test ebx, ebx
je 0x43fa7e
xor ebp, ebp
mov edi, dword [0x44ce84]
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x43fa50
inc ebp
cmp ebx, ebp
jne 0x43fa40
jmp 0x43fa7e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43fa7e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x30
cmp eax, 0x103
jne 0x43fb09
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov eax, 0x2d
mov ecx, 0xd2
nop
movzx edi, byte [esp + eax - 0x2d]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
add dl, 0x1f
mov byte [esp + eax - 0x2d], dl
inc eax
dec ecx
cmp eax, 0x32
jne 0x43faa0
mov eax, dword [esp]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x43fb01
xor edx, edx
mov edi, dword [0x44ce84]
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43fae0
inc edx
cmp ecx, edx
jne 0x43fad0
jmp 0x43fb01
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43fb01
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x18
test eax, eax
js 0x43fb09
mov eax, dword [esp + 8]
test esi, esi
je 0x43fb13
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43fb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43fb40
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xd0cfcecd
mov byte [esp + 4], 0
mov eax, 0x2d
mov edi, 0xd2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x2d]
mov ebx, edi
xor ebx, eax
and ebx, ebp
xor ebx, eax
add bl, 0x1f
mov byte [esp + eax - 0x2d], bl
inc eax
dec edi
cmp eax, 0x32
jne 0x43fbb0
mov eax, dword [esp]
mov edi, dword [0x44ce80]
test edi, edi
je 0x43fc12
xor ebx, ebx
mov ebp, dword [0x44ce84]
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43fbf1
inc ebx
cmp edi, ebx
jne 0x43fbe0
jmp 0x43fc12
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43fc12
lea eax, [esp + 0x10]
push esi
push eax
push edx
push ecx
push 0x10
push edi
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403650
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x49d4bc]
mov ecx, dword [0x49a3c4]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40373f
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x49d4bc], 0x959
jne 0x403725
push 0
push 0
call edi
push 0
lea eax, [esp + 0x43c]
push eax
push 0
call ebx
push 0
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea ecx, [esp + 0x1c]
push ecx
push 0
call esi
push 0
push 0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402cb0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004034a0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403690
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x40716c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430238]
jne 0x407176
repz ret
jmp fcn.0040c2a5

Function at 0x40cd9f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409a06
and dword [ebp - 4], 0
cmp dword [0x433258], 0
mov ebx, eax
jne 0x40ce50
push 0x4024b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cf01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024a8
push edi
call esi
test eax, eax
je 0x40cf01
push eax
call fcn.00409994
mov dword [esp], 0x402498
push edi
mov dword [0x433258], eax
call esi
push eax
call fcn.00409994
mov dword [esp], 0x402484
push edi
mov dword [0x43325c], eax
call esi
push eax
call fcn.00409994
mov dword [esp], 0x402468
push edi
mov dword [0x433260], eax
call esi
push eax
call fcn.00409994
pop ecx
mov dword [0x433268], eax
test eax, eax
je 0x40ce50
push 0x402450
push edi
call esi
push eax
call fcn.00409994
pop ecx
mov dword [0x433264], eax
mov eax, dword [0x433264]
cmp eax, ebx
je 0x40cea8
cmp dword [0x433268], ebx
je 0x40cea8
push eax
call fcn.00409a0f
push dword [0x433268]
mov esi, eax
call fcn.00409a0f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cea8
test edi, edi
je 0x40cea8
call esi
test eax, eax
je 0x40ce9f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ce9f
test byte [ebp - 0xc], 1
jne 0x40cea8
or dword [ebp + 0x10], 0x200000
jmp 0x40cee1
mov eax, dword [0x43325c]
cmp eax, ebx
je 0x40cee1
push eax
call fcn.00409a0f
pop ecx
test eax, eax
je 0x40cee1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cee1
mov eax, dword [0x433260]
cmp eax, ebx
je 0x40cee1
push eax
call fcn.00409a0f
pop ecx
test eax, eax
je 0x40cee1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433258]
call fcn.00409a0f
pop ecx
test eax, eax
je 0x40cf01
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40cf03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43fc19
Capabilities:
Encode data using xor

Disassembly:
mov ds, word [esi + 0x2d]
mov al, byte [0x1cc34a99]
pop es
xor byte [ecx + 0x64], ch
ror byte [eax - 0xc], 1
sub dword [edi + 0x26a08789], 0xffffffc3
sub bh, byte [edi + 0x21]
pushal
mov ecx, 0x8d9c203c
adc al, 0x1d
adc eax, 0x6fdf5cda
inc dword [edx + 0x34de5e0c]
add al, 0x7f
pop ss
xor al, 4
jg 0x43fc5f
ror dword ds:[edi + 0x1e], cl
push edi
pop esi
daa
jns 0x43fc44
mov ebp, 0x2791648c
mov ch, 0x7b
test eax, 0x959fa78b
sub ch, byte [ebp + 0x37]
aaa
inc ecx
aaa
dec ebx
ficomp word [esi + ecx*8 + 0x6c]
insd dword es:[edi], dx
xor dword [ebx + 0x3eb8bef1], ebp
add dword [edi], esp
clc
pop edx
push 0x357e315f
jge 0x43fc82
das
mov byte [0x68e1b564], al
dec ebp
aaa
jg 0x43fce6
arpl dx, cx
push eax
out 0x7a, eax
salc
stosb byte es:[edi], al
pop esi
mov dword [0x32f0301a], eax
mov al, 0x7b
pop ds
stc
insd dword es:[edi], dx
add eax, 0xa07d3f98
xchg byte [0xae79708a], dh
sbb edi, dword [ebp + ebx - 0x5288e286]
pushfd
mov ah, 0x81
and dword [eax], 0xeba9111a
jb 0x43fd30
retf 0xe750
mov dword [ecx], eax
push eax
push ecx
cli
fldcw word [ebp + 0x2f]
xor dh, byte [ecx]
pushal
or eax, 0xb6f05d87
xor al, 0xdf
salc
adc bl, cl
out dx, al
mov bh, 0x33
and edx, 0x3a466fc5
ja 0x43fcd8
loope 0x43fd3b
mov al, 0x5d
lea esi, [eax + ebx*4 - 1]
stosb byte es:[edi], al
xor al, 0x95
push ecx
inc ebp
sahf
je 0x43fd47
cwde
jmp [edx + 0x45519534]
imul esi, dword [edi + 0x6a1ecf4c], 0x63
push ds
push 0x63
scasd eax, dword es:[edi]
cmp dword [esi], edx
test al, 0x1c
adc byte [edi], ch
clc
les edi, [ebp - 0x1f]
fidivr word [ecx + 0x73]
invalid
sahf
invalid
setb byte [0xd1274909]
in eax, dx
and byte [esi], dl
wait
mov dh, 0xb5
or ah, byte [ebp - 0x2f406a40]
mov ah, 0xcd
popal
inc esp
ftst
arpl word [eax], si
aas
loop 0x43fdae
add byte [ebp - 0x79], ch
pop edx
nop
insd dword es:[edi], dx
xchg dword [edx + 0x26], ebx
nop
jno 0x43fd5d
push eax
stc
inc ebx
call 0xc90488b4
push esp
invalid
das
mov cl, 0x5e
invalid