joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40f2b8
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40f08c
cmp edx, esi
jae 0x40f2b8
test edi, edi
je 0x40f2b8
movzx ebp, bl
test bl, bl
js 0x40f0d0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
mov eax, edi
not eax
and eax, esi
not esi
and esi, edi
sub esi, eax
mov eax, ecx
mov edi, esi
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40f080
jmp 0x40f2b8
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40f108
cmp bl, 0xc2
jb 0x40f0bc
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40f16a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40f1bc
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40f132
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40f174
cmp ebp, 0xe0
jne 0x40f17d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40f0b8
jmp 0x40f17d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40f293
cmp bl, 0xf4
ja 0x40f0bc
movzx ecx, byte [edx + 1]
je 0x40f1c7
cmp ebp, 0xf0
jne 0x40f1d0
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40f0b8
jmp 0x40f1d0
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40f0be
cmp cl, 0x9f
ja 0x40f0b8
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f29a
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f2a0
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40f0a2
cmp cl, 0x8f
ja 0x40f0b8
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f29a
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f2a0
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f2ac
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40f0b8
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
cmp esi, 0x10000
jb 0x40f0b8
cmp edi, 2
jb 0x40f293
add ebp, 0xffff0000
shr ebp, 0xa
mov ecx, ebp
xor ecx, 0x2400
or ebp, 0x3ff
and ebp, ecx
or ebp, 0xd800
mov word [eax], bp
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40f0a2
mov ecx, eax
jmp 0x40f0a2
inc edx
jmp 0x40f0b8
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40f0be
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40f0be
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x299b2b77
mov dword [esp + 0x40], 0x2d812f96
mov dword [esp + 0x44], 0x319e3380
mov dword [esp + 0x48], 0x35473797
mov dword [esp + 0x4c], 0x39483b4f
mov dword [esp + 0x50], 0x3d5e3f48
mov dword [esp + 0x54], 0x15b0354
mov dword [esp + 0x58], 0x5b407af
mov dword [esp + 0x5c], 0x9bb0ba0
mov dword [esp + 0x60], 0xdbb0fb1
mov dword [esp + 0x64], 0x1140136c
mov dword [esp + 0x68], 0x15761744
mov dword [esp + 0x6c], 0x196a1b63
mov dword [esp + 0x70], 0x1d6e1f6a
mov dword [esp + 0x74], 0x61026361
mov dword [esp + 0x78], 0x65c96739
mov dword [esp + 0x7c], 0x69106bd6
mov dword [esp + 0x80], 0x6d136f1c
mov dword [esp + 0x84], 0x71ca730c
mov dword [esp + 0x88], 0x7502770a
mov dword [esp + 0x8c], 0x791a7b1b
mov dword [esp + 0x90], 0x7dce7f3f
mov dword [esp + 0x94], 0x41ee43cc
mov dword [esp + 0x98], 0x451f47eb
mov dword [esp + 0x9c], 0x49ec4bef
mov dword [esp + 0xa0], 0x4de14f05
mov dword [esp + 0xa4], 0x512353f8
mov dword [esp + 0xa8], 0x5523572b
mov dword [esp + 0xac], 0x59285b2d
mov dword [esp + 0xb0], 0x5d245f2d
mov dword [esp + 0xb4], 0xa1caa33c
mov dword [esp + 0xb8], 0xa5eea7ed
mov dword [esp + 0xbc], 0xa9f9abf0
mov dword [esp + 0xc0], 0xadc2afe4
mov dword [esp + 0xc4], 0xb11eb3cc
mov dword [esp + 0xc8], 0xb51bb71f
mov dword [esp + 0xcc], 0xb9dabb1f
mov dword [esp + 0xd0], 0xbd15bff1
mov dword [esp + 0xd4], 0x812f8319
mov dword [esp + 0xd8], 0x85e98731
mov dword [esp + 0xdc], 0x89cf8be4
mov dword [esp + 0xe0], 0x8d388f20
mov dword [esp + 0xe4], 0x9121933d
mov dword [esp + 0xe8], 0x95e7973b
mov dword [esp + 0xec], 0x99ed9be3
mov dword [esp + 0xf0], 0x9dec9fe7
mov dword [esp + 0xf4], 0xe190e3ec
mov dword [esp + 0xf8], 0xe594e790
mov dword [esp + 0xfc], 0xe98aeb94
mov dword [esp + 0x100], 0xed49efbd
mov dword [esp + 0x104], 0xf155f346
mov dword [esp + 0x108], 0xf559f746
mov dword [esp + 0x10c], 0xf981fb85
mov dword [esp + 0x110], 0xfd87ff8d
mov dword [esp + 0x114], 0xc1b7c38e
mov dword [esp + 0x118], 0xc5c6c7ba
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x44bc48]
mov ecx, 0xe4204087
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x1bdfbfb5]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
or esi, 0x5b
and edx, 0x5b
add edx, esi
add dl, 2
mov byte [esp + ecx + 0x1bdfbfb5], dl
inc ecx
cmp ecx, 0xe420416a
jne 0x410cc0
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x447084]
mov ecx, 0x28270325
xor ecx, dword [0x44708c]
add ecx, edx
inc ecx
jmp ecx
Function at 0x417f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1148
call fcn.0040ce30
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x417f20
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44cf8c]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x417f54
mov eax, 0xffffffff
jmp 0x417f57
lea eax, [ebx + ebx]
push eax
call fcn.0040ced0
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44cf8c]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x417f8c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ced0
add esp, 4
mov esi, eax
mov dword [esp + 0x144], 0x23de21cc
mov dword [esp + 0x148], 0x27b525c5
mov dword [esp + 0x14c], 0xdbfad94c
mov dword [esp + 0x150], 0xdf3bdd2a
mov dword [esp + 0x154], 0xd341d142
mov dword [esp + 0x158], 0xd749d54d
mov dword [esp + 0x15c], 0xcbcac956
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x30
mov edx, ecx
xor edx, 0xf8
add edx, edi
xor dl, byte [esp + ecx + 0x144]
add dl, 0x28
mov byte [esp + ecx + 0x144], dl
inc ecx
add eax, 2
cmp ecx, 0x1c
jne 0x417ff0
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x418041
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418030
mov word [eax], 0
movzx ecx, word [esp + 0x144]
test cx, cx
je 0x418071
lea edx, [esp + 0x146]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418060
mov word [eax], 0
lea eax, [esp + 0xb8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00440ca0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447854]
Function at 0x420810
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x420820
cmp eax, 0xffffffed
jge 0x420837
mov eax, 0xffffffff
jmp 0x42083a
add eax, 0x12
push eax
call fcn.0040ced0
add esp, 4
mov esi, eax
mov dword [esp], 0x178119fc
mov dword [esp + 4], 0x139b1589
mov dword [esp + 8], 0xfdc11dc
mov dword [esp + 0xc], 0xb940d90
mov dword [esp + 0x10], 0x908
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x46
xor cl, byte [esp + eax]
add cl, 0xa2
mov byte [esp + eax], cl
inc eax
cmp eax, 0x14
jne 0x420870
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4208b1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4208a0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4208e1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4208d0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440e30
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x447e24]
Function at 0x429c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x429c20
lea esi, [ebx + 1]
push esi
call fcn.0040ced0
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x429c83
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x429d34
neg ebx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, edx
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, eax
shl edx, 0x1e
sar edx, 0x1f
and edx, 0xedb88320
xor edx, esi
mov edi, eax
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, eax
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, eax
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, edi
xor eax, esi
mov esi, edx
shr esi, 6
xor eax, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0xedb88320
xor edx, ecx
inc ebp
inc ebx
jne 0x429c90
not edx
mov eax, dword [esp + 4]
mov dword [eax + 4], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp 0x429d25
Function at 0x42c7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42c942
mov ebp, dword [esp + 0x18]
dec ebp
je 0x42c942
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42c830
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x42c8e0
cmp ebx, 0x7ff
ja 0x42c860
cmp ebp, 2
jb 0x42c860
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x42c8e0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x42c8fa
cmp ebp, 4
jb 0x42c8fa
movzx edi, word [esi + 2]
mov ecx, ebx
not ecx
and ecx, 0xd800
and ebx, 0x27ff
sub ebx, ecx
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea edx, [ebx + edi]
add edx, 0x2400
mov ebx, edx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov byte [eax + 3], cl
lea ecx, [eax + 4]
add esi, 4
mov edi, esi
nop
nop
nop
add ebp, eax
sub ebp, ecx
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
je 0x42c942
test ebp, ebp
jne 0x42c810
jmp 0x42c942
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x42c909
mov esi, edi
jmp 0x42c8e8
cmp ebp, 3
jb 0x42c93e
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
mov edx, ecx
xor edx, 0xc0
or ecx, 0x3f
and ecx, edx
add cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x42c8e0
mov ecx, eax
jmp 0x42c8e0
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431640
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
call fcn.00417a70
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x43166a
cmp eax, 0
setne al
jmp 0x431672
jmp 0x431674
xor ebx, ebx
test al, 1
jne 0x43167f
jmp 0x43180e
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x431806
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042c770
add esp, 4
jmp 0x4316d8
jmp 0x4316da
cmp eax, 0
setne cl
jmp 0x4316e2
xor ebx, ebx
test cl, 1
jne 0x4316ee
jmp 0x4317f7
mov dword [ebp - 0x20], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040ced0
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042c7e0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
jmp 0x431722
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xf3
mov byte [edi + 1], 0xa5
mov byte [edi + 2], 0xab
mov byte [edi + 3], 0xa3
mov byte [edi + 4], 0x8e
mov byte [edi + 5], 0xba
mov byte [edi + 6], 0x8f
mov byte [edi + 7], 0xbd
mov byte [edi + 8], 0xb4
mov byte [edi + 9], 0xff
mov byte [edi + 0xa], 0xa6
mov byte [edi + 0xb], 0xa3
mov byte [edi + 0xc], 0xa8
mov byte [edi + 0xd], 0x25
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x12
jne 0x431763
xor edx, edx
cmp edx, 0x12
jae 0x4317c1
movzx eax, byte [edi + edx]
mov ecx, 0x71cc2b3
sub ecx, edx
or ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 0x71cc2b3
sub ecx, edx
mov ebx, 0x71cc2b3
sub ebx, edx
or ecx, ebx
mov ebx, eax
xor ebx, 0xffffffff
mov esi, ecx
and esi, ebx
xor ecx, eax
sub eax, ecx
add eax, esi
mov esi, eax
xor esi, 0xffffffff
mov ebx, dword [ebp - 0x14]
or ebx, esi
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x14]
add eax, ebx
add al, 0x84
mov byte [edi + edx], al
add edx, 1
jmp 0x431771
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.0040d8c0
mov bl, al
jmp 0x4317de
and bl, 1
jmp 0x4317e3
sub esp, 4
mov dword [esp], esi
call fcn.0040cee0
add esp, 4
jmp 0x4317f3
jmp 0x4317f5
jmp 0x4317f7
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x43180e
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437350
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x437370
add edx, ecx
add edx, 0xfffffffe
mov esi, ecx
not esi
and esi, edx
add esi, esi
xor edx, ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
sub esi, edx
mov dword [esp], 0xdedadc51
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ebx, 0xcf
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ebx - 0xcf]
lea edi, [ebx - 0x141f4a00]
mov edx, edi
and edx, ebx
or edx, ebp
and edi, ebp
sub edx, edi
add dl, 0xf5
mov byte [esp + ebx - 0xcf], dl
inc ebx
cmp ebx, 0xd6
jne 0x4373b0
mov edx, dword [esp + 8]
cmp edx, dword [esp + 0xc]
je 0x43744e
mov edx, dword [esp]
sar esi, 1
lea edi, [esi - 1]
mov ebx, esi
and ebx, 3
je 0x437411
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec esi
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, edx
mov ebp, eax
dec ebx
jne 0x437400
cmp edi, 3
jb 0x43744e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, edx
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, edx
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, edx
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, edx
add edi, 4
cmp esi, edi
jne 0x437420
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4380c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00440ca0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a5e8]

Function at 0x438340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.004413a0
add esp, 0x14
test eax, eax
js 0x438466
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00441790
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x4383da
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4383a8
mov eax, 0xffffffff
jmp 0x4383af
lea eax, [eax*2 + 2]
push eax
call fcn.0040ced0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00441da0
add esp, 0x14
test eax, eax
jns 0x4383da
push esi
call fcn.0040cee0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xc0c7c6c5
mov dword [esp + 8], 0
nop
nop
nop
mov ecx, ebx
add cl, 0x51
xor cl, byte [esp + ebx + 4]
add cl, 0x6b
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 8
jne 0x4383f0
mov ecx, dword [0x44cf90]
test ecx, ecx
je 0x43844a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44cf94]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x438430
inc edi
cmp ecx, edi
jne 0x438420
jmp 0x43844a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43844a
push eax
push 1
push ecx
push dword [0x44cf98]
call fcn.0043d020
add esp, 0x10
test esi, esi
jne 0x438468
lea eax, [esp + 4]
push eax
call fcn.00440a80
add esp, 4
test al, al
je 0x438466
cmp dword [esp + 4], 1
je 0x438468
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a050
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov dword [esp], 0x93929140
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 4
xor edx, 0x9c
mov ecx, eax
and ecx, 3
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0xc
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43a070
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov eax, dword [0x44a9b0]
nop
jmp eax
Function at 0x43a150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xc0c7c6c5
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x51]
and edx, ecx
add ecx, eax
add ecx, 0x51
add edx, edx
sub ecx, edx
add cl, 0x6b
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 8
jb 0x43a180
mov edi, dword [esp]
mov eax, dword [0x44cf90]
test eax, eax
je 0x43a1f6
xor ecx, ecx
mov edx, dword [0x44cf94]
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43a1d0
inc ecx
cmp eax, ecx
jne 0x43a1c0
jmp 0x43a1f6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43a1f6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x44cf98]
call fcn.0043d020
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x914e4f48
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x6d
xor cl, byte [esp + eax]
add cl, 0xdf
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x43a210
cmp edi, dword [esp]
jne 0x43a335
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.0043a050
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xc0c7c6c5
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx]
lea esi, [edx + 0x51]
and esi, ecx
add ecx, edx
add ecx, 0x51
add esi, esi
sub ecx, esi
add cl, 0x6b
mov byte [esp + edx], cl
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
cmp edx, 8
jb 0x43a260
mov edi, dword [esp]
mov edx, dword [0x44cf90]
test edx, edx
je 0x43a2d5
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44cf94]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43a2b0
inc ebp
cmp edx, ebp
jne 0x43a2a0
jmp 0x43a2d5
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43a2d5
push 0
push ecx
push eax
push 5
push 4
push edx
push dword [0x44cf98]
mov esi, eax
call fcn.0043d020
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43a32c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43a305
add edi, 2
cmp si, bp
je 0x43a2f0
cmp si, bp
je 0x43a317
mov esi, dword [ecx]
test esi, esi
jne 0x43a2e0
mov edi, 0xc0000225
jmp 0x43a32c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043a0e0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43a380
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43a440
xor eax, eax
cmp dword [ecx], 0
jne 0x43a484
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xc0c7c6c5
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
movzx esi, byte [esp + eax]
lea edi, [eax + 0x51]
and edi, esi
lea ebx, [eax + esi]
add ebx, 0x51
add edi, edi
sub ebx, edi
add bl, 0x6b
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 8
jb 0x43a3f0
mov eax, dword [esp]
mov esi, dword [0x44cf90]
test esi, esi
je 0x43a484
xor edi, edi
mov ebx, dword [0x44cf94]
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43a48d
inc edi
cmp esi, edi
jne 0x43a430
jmp 0x43a484
mov dword [esp + 8], 0xf3323138
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x34
xor cl, byte [esp + eax + 8]
add cl, 0xfc
mov byte [esp + eax + 8], cl
mov ecx, eax
xor ecx, 1
and eax, 1
lea eax, [ecx + eax*2]
cmp eax, 7
jb 0x43a460
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43a484
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x44cf98]
call fcn.0043d020
add esp, 0x1c
jmp 0x43a484

Function at 0x43a4d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43a57a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xc0c7c6c5
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
lea edi, [edx + 0x51]
and edi, esi
lea ebx, [edx + esi]
add ebx, 0x51
add edi, edi
sub ebx, edi
add bl, 0x6b
mov byte [esp + edx], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 8
jb 0x43a500
mov edx, dword [0x44cf90]
test edx, edx
je 0x43a56e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44cf94]
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43a550
inc edi
cmp edx, edi
jne 0x43a540
jmp 0x43a56e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a56e
push eax
push 1
push edx
push dword [0x44cf98]
mov esi, ecx
call fcn.0043d020
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret