joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433490
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
jmp 0x43349e
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x4334b2
cmp eax, 0
setne al
jmp 0x4334ba
jmp 0x4334bc
xor ebx, ebx
test al, 1
jne 0x4334c7
jmp 0x4335fc
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
jmp 0x4334f5
cmp edi, 0
setne al
jmp 0x4334fd
jmp 0x4334ff
xor ebx, ebx
test al, 1
jne 0x43350a
jmp 0x4335f6
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0040cb40
add esp, 4
mov edx, eax
jmp 0x43352b
jmp 0x43352d
xor ebx, ebx
cmp edx, 0
je 0x4335ea
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x89
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0xad
mov byte [ebp - 0x25], 0x51
mov byte [ebp - 0x24], 0xa2
mov byte [ebp - 0x23], 0x52
mov byte [ebp - 0x22], 0xa1
mov byte [ebp - 0x21], 0x5f
mov byte [ebp - 0x20], 0xa0
mov byte [ebp - 0x1f], 0x99
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x51
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0xcb
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x12
jne 0x43357a
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x12
jae 0x4335c7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.004369e0
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x43358e
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d5a0
mov bl, al
and bl, 1
jmp 0x4335ea
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x1c]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.00443ba0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44dfa0]
Function at 0x43a860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
lea eax, [edi - 1]
mov ecx, edi
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x43a870
mov ecx, edi
not ecx
and ecx, eax
add ecx, ecx
xor eax, edi
mov edx, ecx
sub edx, eax
lea esi, [edx + edx*2]
shr esi, 2
mov dword [esp], edx
movzx edx, byte [edi + edx - 1]
cmp edx, 0x3d
je 0x43a89f
cmp edx, 0x2e
jne 0x43a8a0
dec esi
mov edx, dword [esp]
movzx edx, byte [edi + edx - 2]
cmp edx, 0x3d
je 0x43a8b2
cmp edx, 0x2e
jne 0x43a8b3
dec esi
mov dword [esp + 4], esi
mov esi, 0
cmp ecx, eax
mov edi, dword [esp]
jne 0x43a98d
mov ebx, dword [esp + 4]
cmp esi, ebx
mov eax, 0
jne 0x43a985
mov esi, dword [esp + 0x48]
lea edx, [esi + 0x20]
lea edi, [esp + 0x10]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x30]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov edi, esi
mov eax, ebx
add eax, 0xffffffe0
je 0x43a981
cmp ebx, 0x21
je 0x43a95e
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
mov dh, byte [esp + edx + 0x10]
movzx ebx, byte [edi + ebp + 0x20]
mov dl, byte [edi + ebp + 0x21]
mov bh, dh
and bh, bl
add dh, bl
add bh, bh
sub dh, bh
mov byte [edi + ebp], dh
lea esi, [ebp + 1]
and esi, 0x1f
mov dh, byte [esp + esi + 0x10]
mov bl, dh
and bl, dl
add dh, dl
add bl, bl
sub dh, bl
mov byte [edi + ebp + 1], dh
add ebp, 2
cmp ecx, ebp
jne 0x43a920
test byte [esp + 4], 1
je 0x43a981
movzx ecx, byte [edi + ebp + 0x20]
mov edx, ebp
and edx, 0x1f
movzx edx, byte [esp + edx + 0x10]
mov ch, dl
and ch, cl
add dl, cl
add ch, ch
sub dl, ch
mov byte [edi + ebp], dl
mov byte [edi + eax], 0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov ebp, 2
jmp 0x43a9b6
lea eax, [ebp + 4]
add ebp, 2
mov esi, dword [esp + 8]
mov ecx, esi
cmp ebp, edi
mov ebp, eax
jae 0x43a8c7
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x44]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.0041e990
add esp, 4
mov bh, al
movzx eax, byte [esi + ebp - 1]
push eax
call fcn.0041e990
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
mov edx, dword [esp + 0xc]
lea ecx, [edx + 1]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x48]
mov byte [ecx + edx], al
cmp ebp, edi
jae 0x43a9a0
movzx eax, byte [esi + ebp]
push eax
call fcn.0041e990
mov edi, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43a9a0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov esi, dword [esp + 0xc]
lea edx, [esi + 2]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x48]
mov byte [edx + esi + 1], cl
mov edi, dword [esp]
lea ecx, [ebp + 1]
cmp ecx, edi
jae 0x43a9a0
mov ecx, dword [esp + 0x44]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov ebx, eax
call fcn.0041e990
mov edi, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43a9a0
mov ecx, ebx
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0xc]
mov byte [ecx + esi + 2], al
add esi, 3
mov dword [esp + 8], esi
jmp 0x43a9a0
Function at 0x43d3b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0xe9eaebb4
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43d419
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xcd8583d7
and eax, 0xcd8583d7
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xcd
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43d3e0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x4586f8]
add esp, 0x10
ret

Function at 0x43d440
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44e370]
Function at 0x43d550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x909f9e9d
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43d5b9
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xe45132a5
and eax, 0xe45132a5
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xc7
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43d580
mov edi, dword [esp + 4]
mov eax, dword [0x4506dc]
test eax, eax
je 0x43d606
xor ecx, ecx
mov edx, dword [0x4506e0]
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43d5e0
inc ecx
cmp eax, ecx
jne 0x43d5d0
jmp 0x43d606
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d606
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x4506e4]
push eax
call fcn.00440260
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43d755
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043d3b0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x909f9e9d
mov word [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x43d68b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0xe45132a5
and edx, 0xe45132a5
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0xc7
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x43d650
mov edi, dword [esp + 4]
mov edx, dword [0x4506dc]
test edx, edx
je 0x43d6e6
xor ebx, ebx
mov ebp, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43d6c1
inc ebx
cmp edx, ebx
jne 0x43d6b0
jmp 0x43d6e6
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43d6e6
push 0
push ecx
push eax
push 5
push 4
push dword [0x4506e4]
push edx
mov esi, eax
call fcn.00440260
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43d74c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43d725
add ebx, 2
cmp bp, si
je 0x43d710
cmp bp, si
je 0x43d737
mov ebx, dword [edx]
test ebx, ebx
jne 0x43d700
mov edi, 0xc0000225
jmp 0x43d74c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043d440
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43d790
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x43d880
xor eax, eax
cmp dword [ecx], 0
jne 0x43d8e7
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x909f9e9d
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43d849
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
mov esi, eax
xor esi, 0xe45132a5
and eax, 0xe45132a5
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0xc7
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43d810
mov eax, dword [esp + 0xc]
mov esi, dword [0x4506dc]
test esi, esi
je 0x43d8e7
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43d8f0
inc edi
cmp esi, edi
jne 0x43d870
jmp 0x43d8e7
mov dword [esp + 0x14], 0x498a8b94
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x43d8e3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x33a682a3
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xd1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x43d8b0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d8e7
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x4506e4]
push esi
call fcn.00440260
add esp, 0x1c
jmp 0x43d8e7

Function at 0x43d930
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43d9fa
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x909f9e9d
mov word [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x43d99b
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0xe45132a5
and edx, 0xe45132a5
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xc7
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x43d960
mov edx, dword [0x4506dc]
test edx, edx
je 0x43d9ee
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43d9d0
inc edi
cmp edx, edi
jne 0x43d9c0
jmp 0x43d9ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d9ee
push eax
push 1
push dword [0x4506e4]
push edx
mov esi, ecx
call fcn.00440260
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43dc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43dd02
push 0xfb1631b0
push dword [0x4506d0]
call fcn.00442fb0
add esp, 8
test eax, eax
je 0x43dccd
mov ecx, dword [esi]
test ecx, ecx
je 0x43dcff
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43dcdb
cmp dword [esp + 4], 0
je 0x43dcdb
mov dword [esi + 4], 3
jmp 0x43dcff
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43dda7
lea eax, [esp + 0xc]
push eax
call fcn.00443960
add esp, 4
test al, al
je 0x43dcff
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43dcfc
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43dda7
mov dword [esp + 4], 0x909f9e9d
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43dd69
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xe45132a5
and eax, 0xe45132a5
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xc7
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43dd30
mov eax, dword [esp + 4]
mov edx, dword [0x4506dc]
test edx, edx
je 0x43de64
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x43de40
inc esi
cmp edx, esi
jne 0x43dd90
jmp 0x43de64
mov dword [esp + 4], 0x909f9e9d
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43de09
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xe45132a5
and eax, 0xe45132a5
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xc7
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43ddd0
mov eax, dword [esp + 4]
mov edx, dword [0x4506dc]
test edx, edx
je 0x43de64
xor esi, esi
mov ebx, dword [0x4506e0]
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x43de30
inc esi
cmp edx, esi
jne 0x43de20
jmp 0x43de64
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43de64
push ebp
push edi
push dword [esp + 0x30]
jmp 0x43de4e
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43de64
push dword [esp + 0x30]
push edi
push ebp
push dword [esp + 0x30]
push ecx
push 5
push dword [0x4506e4]
push edx
call fcn.00440260
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43e1f9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43e20a
cmp eax, 2
je 0x43e280
jmp 0x43e2ad
push 0xfb1631b0
push dword [0x4506d0]
call fcn.00442fb0
add esp, 8
test eax, eax
je 0x43e24b
mov ecx, dword [esi]
test ecx, ecx
je 0x43e278
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43e254
cmp dword [esp + 4], 0
je 0x43e254
mov dword [esi + 4], 3
jmp 0x43e278
mov dword [esi + 4], 1
jmp 0x43e2ad
lea eax, [esp + 0xc]
push eax
call fcn.00443960
add esp, 4
test al, al
je 0x43e278
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e275
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43e2ad
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x4586f0]
call fcn.00442fb0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43e354
mov ecx, dword [esi]
mov dword [esp + 4], 0x909f9e9d
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43e309
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xe45132a5
and eax, 0xe45132a5
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xc7
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43e2d0
mov eax, dword [esp + 4]
mov edx, dword [0x4506dc]
test edx, edx
je 0x43e354
xor esi, esi
mov ebx, dword [0x4506e0]
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x43e330
inc esi
cmp edx, esi
jne 0x43e320
jmp 0x43e354
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43e354
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x4506e4]
push edx
call fcn.00440260
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x440190
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44e754]
Function at 0x4419c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x34]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x30]
jb 0x441a66
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ebp, ebx
and ebp, 3
mov ecx, ebp
shr ecx, 1
mov ebx, edx
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov edi, dword [esp + 0x34]
mov ecx, edi
xor ecx, 2
and ecx, ebp
je 0x441bee
and edi, 2
movzx ebx, byte [edx + edi]
mov byte [esi + edi], bl
cmp ecx, 1
je 0x441bee
mov ebp, esi
movzx ebx, byte [edx + edi + 1]
mov byte [esi + edi + 1], bl
cmp ecx, 2
je 0x441bee
mov esi, edi
movzx ecx, byte [edx + edi + 2]
mov byte [ebp + edi + 2], cl
jmp 0x441bee
mov dword [esp + 4], 0x5c5d5e5f
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x441abe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xfdcb670
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xd0
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x441a90
mov eax, dword [esp + 4]
mov ecx, dword [0x4506dc]
test ecx, ecx
je 0x441b22
xor edx, edx
mov edi, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x54ca534e
je 0x441af4
inc edx
cmp ecx, edx
jne 0x441ae0
mov edi, dword [esp + 0x2c]
jmp 0x441b22
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x2c]
je 0x441b22
lea eax, [esp + 0x10]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x4506e4]
push ecx
call fcn.00440260
add esp, 0x28
test eax, eax
js 0x441bee
push 0xc95dc39
push dword [0x4586f0]
call fcn.00442fb0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x28]
call eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], 0x5c5d5e5f
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x441ba0
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0xfdcb670
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xd0
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x441b70
mov edx, dword [0x4506dc]
test edx, edx
je 0x441bee
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x441bd0
inc edi
cmp edx, edi
jne 0x441bc0
jmp 0x441bee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x441bee
push ecx
push 1
push dword [0x4506e4]
push edx
mov esi, eax
call fcn.00440260
mov eax, esi
add esp, 0x10
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4429a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0xf9fafb2c
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x442a1c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
mov edx, ecx
xor edx, 0xe999c2b
mov esi, ecx
xor esi, 0x716663d4
or ecx, 0xe999c2b
and ecx, esi
add ecx, ecx
mov esi, ecx
and esi, edx
xor ecx, edx
lea ecx, [ecx + esi*2]
xor ecx, eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
add al, 0x29
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4429d0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x44f0a0]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp + 4], 0
mov esi, dword [0x44f0c8]
mov edi, dword [edx]
xor eax, eax
cmp edi, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x44f0a8]
mov ebp, dword [edi + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov ebx, 1
jmp dword [eax*4 + 0x44f0b0]
mov ecx, dword [esp + 0x2c]
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x442a8f
or edx, 0x20
movzx eax, word [ebp]
lea ebx, [eax - 0x41]
cmp bx, 0x1a
jae 0x442a9f
or eax, 0x20
mov ebx, 1
test dx, dx
je 0x442ab4
add ebp, 2
add ecx, 2
cmp dx, ax
je 0x442a80
xor ecx, ecx
cmp dx, ax
sete cl
mov edx, dword [esp + 0x10]
jmp dword [ecx*4 + 0x44f0b8]
jmp esi
jmp dword [ebx*4 + 0x44f0d0]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x442e80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x33323100
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x442f05
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x22da0e34
and eax, 0x22da0e34
lea eax, [esi + eax*2]
lea esi, [eax + edx]
mov edi, edx
not edi
or edi, eax
lea eax, [edx + edi]
add edx, edi
inc edx
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
add eax, edi
inc eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0xfc
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x442eb0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44f170]
mov edx, dword [case.0x442f13.5]
jmp edx
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, dword [edx]
mov eax, dword [0x44f190]
nop
jmp eax
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 0x10
pop esi
pop edi
pop ebx
ret