joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov ebp, dword [esp + 0x448]
mov dword [esp + 0x34], 0x85eb83cf
mov dword [esp + 0x38], 0x89e1871c
mov dword [esp + 0x3c], 0x8de08be6
mov dword [esp + 0x40], 0xb19f8fef
mov dword [esp + 0x44], 0xb59ab3e7
mov dword [esp + 0x48], 0xb998b7e6
mov dword [esp + 0x4c], 0xbdcbbb92
mov dword [esp + 0x50], 0xa1cebfd7
mov dword [esp + 0x54], 0xa5cba3c6
mov dword [esp + 0x58], 0xa93ba731
mov dword [esp + 0x5c], 0xade2ab8a
mov dword [esp + 0x60], 0xd1f0afda
mov dword [esp + 0x64], 0xd584d383
mov dword [esp + 0x68], 0xd988d7f8
mov dword [esp + 0x6c], 0xddfcdb81
mov dword [esp + 0x70], 0xc1a9dfa9
mov dword [esp + 0x74], 0xc592c3ac
mov dword [esp + 0x78], 0xc993c792
mov dword [esp + 0x7c], 0xcd54cbea
mov dword [esp + 0x80], 0xf1a4cf98
mov dword [esp + 0x84], 0xf5d4f3db
mov dword [esp + 0x88], 0xf968f7b7
mov dword [esp + 0x8c], 0xfd90fb6a
mov dword [esp + 0x90], 0xe197ff9b
mov dword [esp + 0x94], 0xe586e387
mov dword [esp + 0x98], 0xe981e7ad
mov dword [esp + 0x9c], 0xedc3eb7e
mov dword [esp + 0xa0], 0x1143efbb
mov dword [esp + 0xa4], 0x153a1345
mov dword [esp + 0xa8], 0x194e1745
mov dword [esp + 0xac], 0x1d341b3a
mov dword [esp + 0xb0], 0x1481f55
mov dword [esp + 0xb4], 0x5490376
mov dword [esp + 0xb8], 0x924074a
mov dword [esp + 0xbc], 0xd600b2a
mov dword [esp + 0xc0], 0x315b0f67
mov dword [esp + 0xc4], 0x35143357
mov dword [esp + 0xc8], 0x395d3771
mov dword [esp + 0xcc], 0x3d573b59
mov dword [esp + 0xd0], 0x21093f51
mov dword [esp + 0xd4], 0x25672302
mov dword [esp + 0xd8], 0x29ba274e
mov dword [esp + 0xdc], 0x2d412b45
mov dword [esp + 0xe0], 0x517f2f4b
mov dword [esp + 0xe4], 0x55055303
mov dword [esp + 0xe8], 0x5976570f
mov dword [esp + 0xec], 0x5d725b0a
mov dword [esp + 0xf0], 0x416e5f0e
mov dword [esp + 0xf4], 0x45644312
mov dword [esp + 0xf8], 0x49294735
mov dword [esp + 0xfc], 0x4d2d4b2c
mov dword [esp + 0x100], 0x71194fdc
mov dword [esp + 0x104], 0x7521735d
mov dword [esp + 0x108], 0x792f7725
mov dword [esp + 0x10c], 0x7d2f7b54
mov dword [esp + 0x110], 0x61607f28
mov eax, dword [0x447350]
mov dword [esp], eax
mov ecx, 0x52682b12
mov edx, 0x2d97d4ed
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x52682ade]
mov edi, ecx
and edi, esi
add edi, edi
sub edi, esi
lea ebx, [edx + edi]
add ebx, 0x80000000
and ebx, ecx
mov edi, ebx
and edi, 0x52682ffd
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
xor eax, 2
imul eax, edi
add ebx, eax
mov eax, ebx
xor eax, ecx
and ebx, edx
add ebx, ebx
sub ebx, eax
mov eax, esi
not eax
and eax, ebx
not ebx
and ebx, esi
sub ebx, eax
add bl, 0x70
mov byte [esp + ecx - 0x52682ade], bl
inc ecx
dec edx
cmp ecx, 0x52682bf2
jne 0x40bc60
lea ebx, [esp + 0x34]
push 0
push 0
push 0
push 0
push ebx
call dword [esp + 0x14]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x4417e0]
mov ecx, 0xd08132a3
xor ecx, dword [0x4417e8]
add eax, ecx
inc eax
jmp eax
Function at 0x40c390
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov ebx, dword [esp + 0x264]
mov dword [esp + 0x38], 0xe67ae41e
mov dword [esp + 0x3c], 0x9a00986d
mov dword [esp + 0x40], 0x9e019c07
mov dword [esp + 0x44], 0x924e907e
mov dword [esp + 0x48], 0x964b9446
mov dword [esp + 0x4c], 0x8aa98847
mov dword [esp + 0x50], 0x8e7a8c53
mov dword [esp + 0x54], 0x821f8016
mov dword [esp + 0x58], 0x861a8467
mov dword [esp + 0x5c], 0xba2ab810
mov dword [esp + 0x60], 0xbe43bc9b
mov dword [esp + 0x64], 0xb291b04b
mov dword [esp + 0x68], 0xb665b462
mov dword [esp + 0x6c], 0xaa79a869
mov dword [esp + 0x70], 0xae8dac60
mov dword [esp + 0x74], 0xa238a058
mov dword [esp + 0x78], 0xa673a43d
mov dword [esp + 0x7c], 0x5a925873
mov dword [esp + 0x80], 0x5ed55c7b
mov dword [esp + 0x84], 0x52855089
mov dword [esp + 0x88], 0x5675548a
mov dword [esp + 0x8c], 0x4ad94896
mov dword [esp + 0x90], 0x4ed14cdb
mov dword [esp + 0x94], 0x42b640aa
mov dword [esp + 0x98], 0x46a744a6
mov dword [esp + 0x9c], 0x7ae078bc
mov dword [esp + 0xa0], 0x7ea27cef
mov dword [esp + 0xa4], 0x72a270aa
mov dword [esp + 0xa8], 0x76ab74a4
mov dword [esp + 0xac], 0x6abf68a4
mov dword [esp + 0xb0], 0x6eb56c4b
mov dword [esp + 0xb4], 0x62996094
mov dword [esp + 0xb8], 0x66986497
mov dword [esp + 0xbc], 0x1ac5189b
mov dword [esp + 0xc0], 0x1e811c3b
mov dword [esp + 0xc4], 0x128a1086
mov dword [esp + 0xc8], 0x163514f6
mov dword [esp + 0xcc], 0xaec08d0
mov dword [esp + 0xd0], 0xe960ce8
mov dword [esp + 0xd4], 0x2d80090
mov dword [esp + 0xd8], 0x6c60423
mov dword [esp + 0xdc], 0x3aab389f
mov dword [esp + 0xe0], 0x3ea03ca4
mov dword [esp + 0xe4], 0x32ee30da
mov dword [esp + 0xe8], 0x36e434e2
mov dword [esp + 0xec], 0x2af728fe
mov dword [esp + 0xf0], 0x2ef32cfb
mov dword [esp + 0xf4], 0x22ff20ff
mov dword [esp + 0xf8], 0x260524f3
mov dword [esp + 0xfc], 0xda38d8d4
mov dword [esp + 0x100], 0xde3cdc3d
mov dword [esp + 0x104], 0xd248d04d
mov dword [esp + 0x108], 0xd600d40c
mov dword [esp + 0x10c], 0xca1ec804
mov dword [esp + 0x110], 0xce1ecc15
mov dword [esp + 0x114], 0xc2c1c019
mov eax, dword [0x447350]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x3b
xor dl, byte [esp + ecx + 0x38]
add dl, 0x28
mov byte [esp + ecx + 0x38], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0xe0
jb 0x40c5e0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x4419a0]
mov ecx, 0x6948adcc
xor ecx, dword [0x4419a8]
add ecx, edx
inc ecx
jmp ecx
Function at 0x41f040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp], 0xa8d7d62f
mov ecx, 0x3d
mov edx, 0xdd422fc2
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x3d]
mov esi, edx
or esi, ebx
not ebx
or ebx, ecx
and ebx, esi
mov edi, ebx
not edi
mov esi, edi
and esi, 0x15
mov ebp, ebx
and ebp, 2
imul ebp, esi
and edi, 2
or esi, 2
imul esi, edi
xor ebx, 0xe8
add ebx, ebp
add ebx, esi
inc bl
mov byte [esp + ecx - 0x3d], bl
inc ecx
dec edx
cmp ecx, 0x41
jne 0x41f080
lea ecx, [esp + 4]
mov edx, esp
push ecx
push 0x420b30
push edx
push dword [eax + 8]
call fcn.004210e0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x420c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
xor eax, eax
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x420c80
lea ecx, [edi + eax]
add ecx, 0xfffffffe
mov eax, edi
not eax
and eax, ecx
xor ecx, edi
add eax, eax
sub eax, ecx
cmp eax, 0xffffffed
jge 0x420ca8
mov eax, 0xffffffff
jmp 0x420cab
add eax, 0x12
push eax
call fcn.00407f60
add esp, 4
mov esi, eax
mov dword [esp], 0xbcc0bad5
mov dword [esp + 4], 0xb036bed8
mov dword [esp + 8], 0xb48db285
mov dword [esp + 0xc], 0xc8d5b6d1
mov word [esp + 0x10], 0xcac9
mov eax, esp
mov ecx, 0xce
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
lea edx, [ecx - 0x10c16e00]
or edx, ebx
and ebx, ecx
not edx
or edx, ebx
lea ebx, [edx + 0x79f49677]
mov ebp, ebx
xor ebp, 0xfe
or ebx, 1
and ebx, ebp
mov ebp, 0x88
sub ebp, edx
or ebp, 1
sub ebx, ebp
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0xbc
jne 0x420cf0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420d51
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420d40
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420d81
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420d70
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043cb20
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x442d34]
Function at 0x439140
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edx, dword [ecx + 8]
test edx, edx
je 0x439240
xor eax, eax
cmp dword [ecx], 0
jne 0x439273
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edx
mov dword [esp + 4], ecx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xcbcccdce
mov eax, 0x2ef40a89
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
not edx
movzx edi, byte [esp + eax - 0x2ef40a89]
mov esi, edi
and esi, 0xffffff84
mov ebx, edi
not ebx
or ebx, 0xa1358e7b
add ebx, edi
inc ebx
and edx, 4
mov ecx, eax
xor ecx, 0x84
mov ebp, eax
or ebp, 0xb
and ebp, ecx
or ebp, edx
xor esi, ebx
not ebx
xor esi, 0x84
or ebx, edi
not ebx
and ebx, 0x84
or ebx, esi
xor ebx, ebp
add bl, 0xb8
mov byte [esp + eax - 0x2ef40a89], bl
inc eax
cmp eax, 0x2ef40a8d
jne 0x4391b0
mov eax, dword [esp]
mov edx, dword [0x4486a8]
test edx, edx
je 0x439273
xor esi, esi
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xf62c6d34
je 0x43927d
inc esi
cmp edx, esi
jne 0x439230
jmp 0x439273
mov dword [esp + 8], 0xee2d2c13
mov eax, 0x33
nop
nop
nop
movzx ecx, byte [esp + eax - 0x2b]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xe8
mov byte [esp + eax - 0x2b], cl
inc eax
cmp eax, 0x37
jne 0x439250
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [edi + esi*8 + 4]
cmp esi, eax
je 0x439273
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
push dword [esp + 0x44]
push dword [esp + 0x10]
push 0x10
push esi
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x1c
jmp 0x439273

Function at 0x4392b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], ecx
mov eax, dword [ecx]
test eax, eax
je 0x439397
mov dword [esp + 4], eax
mov dword [esp], 0xcbcccdce
mov edx, 0x2ef40a89
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
not eax
movzx edi, byte [esp + edx - 0x2ef40a89]
mov esi, edi
and esi, 0xffffff84
mov ebx, edi
not ebx
or ebx, 0xa1358e7b
add ebx, edi
inc ebx
and eax, 4
mov ecx, edx
xor ecx, 0x84
mov ebp, edx
or ebp, 0xb
and ebp, ecx
or ebp, eax
xor esi, ebx
not ebx
xor esi, 0x84
or ebx, edi
not ebx
and ebx, 0x84
or ebx, esi
xor ebx, ebp
add bl, 0xb8
mov byte [esp + edx - 0x2ef40a89], bl
inc edx
cmp edx, 0x2ef40a8d
jne 0x4392e0
mov edx, dword [0x4486a8]
test edx, edx
je 0x43938d
mov eax, dword [esp]
xor esi, esi
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xb430e561
je 0x439370
inc esi
cmp edx, esi
jne 0x439360
jmp 0x43938d
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x43938d
push dword [esp + 4]
push 4
push edx
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x10
mov eax, dword [esp + 8]
mov dword [eax], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], 0xcbcccdce
mov ebx, 0x2ef40a89
nop
nop
nop
nop
nop
nop
nop
mov ebp, ebx
not ebp
movzx edi, byte [esp + ebx - 0x2ef40a89]
mov esi, edi
and esi, 0xffffff84
mov eax, edi
not eax
or eax, 0xa1358e7b
lea edx, [edi + eax]
inc edx
and ebp, 4
mov ecx, ebx
xor ecx, 0x84
mov eax, ebx
or eax, 0xb
and eax, ecx
or eax, ebp
xor esi, edx
not edx
xor esi, 0x84
or edx, edi
not edx
and edx, 0x84
or edx, esi
xor edx, eax
add dl, 0xb8
mov byte [esp + ebx - 0x2ef40a89], dl
inc ebx
cmp ebx, 0x2ef40a8d
jne 0x439670
mov eax, dword [esp]
mov edx, dword [0x4486a8]
test edx, edx
je 0x439708
xor esi, esi
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xe095b21b
je 0x439700
inc esi
cmp edx, esi
jne 0x4396f0
jmp 0x439708
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x439712
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x18]
push 0x18
push edx
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x2c
jmp 0x43970b

Function at 0x439740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], 0xcbcccdce
mov edi, 0x2ef40a89
nop
nop
nop
nop
nop
nop
nop
mov ecx, edi
not ecx
movzx esi, byte [esp + edi - 0x2ef40a89]
mov ebp, esi
and ebp, 0xffffff84
mov eax, esi
not eax
or eax, 0xa1358e7b
lea edx, [esi + eax]
inc edx
and ecx, 4
mov ebx, edi
xor ebx, 0x84
mov eax, edi
or eax, 0xb
and eax, ebx
or eax, ecx
xor ebp, edx
not edx
xor ebp, 0x84
or edx, esi
not edx
and edx, 0x84
or edx, ebp
xor edx, eax
add dl, 0xb8
mov byte [esp + edi - 0x2ef40a89], dl
inc edi
cmp edi, 0x2ef40a8d
jne 0x439760
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0x4397c9
lea edi, [esp + 8]
mov eax, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43981a
xor edx, edx
mov esi, dword [0x4486ac]
nop
nop
cmp dword [esi + edx*8], 0xa99f3325
je 0x4397f0
inc edx
cmp ecx, edx
jne 0x4397e0
jmp 0x43981a
mov edx, dword [esi + edx*8 + 4]
cmp edx, eax
je 0x43981a
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 0x14
push edx
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43b640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp + 0x14], 0xe0ef44b0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xc5
xor dl, byte [esp + ecx + 0x14]
add dl, 0xd8
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 4
jne 0x43b660
xor ecx, ecx
cmp dword [esp + 0x14], eax
setne cl
mov edi, dword [ecx*4 + 0x445940]
mov edx, dword [0x445948]
mov esi, edx
mov ecx, edx
xor ecx, 0x7c2f05c0
sub ecx, edx
not edx
and esi, 0x7c2f05c0
add ecx, esi
or edx, 0x7c2f05c0
lea esi, [ecx + ecx]
not esi
add esi, ecx
and esi, edx
sub edi, esi
xor eax, eax
jmp edi

Function at 0x43bf00
Capabilities:
Encode data using xor

Disassembly:
push eax
mov dword [esp], 0x49484716
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf6
xor cl, byte [esp + eax]
add cl, 0x50
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43bf10
mov eax, dword [esp]
mov eax, dword fs:[eax]
pop ecx
ret

Function at 0x43c280
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp + 0xc], 0xd2d17a62
mov ecx, 0x4d1437e7
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x4d1437db]
xor edx, ecx
mov esi, 0x38
sub esi, edx
add edx, 7
and esi, 0xd0
and edx, 0x2f
sub edx, esi
add dl, 0xd1
mov byte [esp + ecx - 0x4d1437db], dl
inc ecx
cmp ecx, 0x4d1437eb
jne 0x43c2a0
xor ecx, ecx
cmp dword [esp + 0xc], eax
setne cl
jmp dword [ecx*4 + 0x445ee0]
Function at 0x43c820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c840
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43c85b
mov eax, 0xffffffff
jmp 0x43c85e
add eax, 0xa
push eax
call fcn.00407f60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43c8a1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43c890
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x66676869
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x46
xor dl, byte [esp + ecx]
add dl, 0xd0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43c900
mov esi, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43c97f
xor edx, edx
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43c940
inc edx
cmp ecx, edx
jne 0x43c930
jmp 0x43c97f
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43c97f
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x4486b0]
mov edi, eax
call fcn.0043a9b0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00407f70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c9c0
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x43c9e5
mov ecx, 0xffffffff
jmp 0x43c9e7
add ecx, ecx
push ecx
call fcn.00407f60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43ca31
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43ca20
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x66676869
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x46
xor dl, byte [esp + ecx]
add dl, 0xd0
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43ca90
mov esi, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43cb01
xor edx, edx
mov ebx, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43cad0
inc edx
cmp ecx, edx
jne 0x43cac0
jmp 0x43cb01
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43cb01
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x4486b0]
mov edi, eax
call fcn.0043a9b0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00407f70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cb40
mov esi, eax
sar esi, 1
and eax, 8
mov ecx, esi
xor ecx, 4
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x43cb68
mov eax, 0xffffffff
jmp 0x43cb6f
lea eax, [ebx*2 + 2]
push eax
call fcn.00407f60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x43cbb1
add edi, 2
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x43cba0
mov word [ecx], 0
mov ecx, ebx
and ecx, 0xfffd
and esi, 2
mov edx, esi
xor edx, 2
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x66676869
xor ecx, ecx
nop
nop
nop
mov edx, ecx
add dl, 0x46
xor dl, byte [esp + ecx + 0x20]
add dl, 0xd0
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 4
jne 0x43cc20
mov esi, dword [esp + 0x20]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43cc89
xor edx, edx
mov edi, dword [0x4486ac]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43cc60
inc edx
cmp ecx, edx
jne 0x43cc50
jmp 0x43cc89
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43cc89
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x4486b0]
mov edi, eax
call fcn.0043a9b0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00407f70
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43cc9f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43ccb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x66676869
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x46
xor cl, byte [esp + eax]
add cl, 0xd0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43ccd0
mov eax, dword [esp]
mov edx, dword [0x4486a8]
test edx, edx
je 0x43cd38
xor ebx, ebx
mov ecx, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43cd10
inc ebx
cmp edx, ebx
jne 0x43cd00
jmp 0x43cd38
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43cd38
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x20
test edi, edi
je 0x43cd42
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43cd4e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0x66676869
xor eax, eax
nop
nop
nop
mov ebx, eax
add bl, 0x46
xor bl, byte [esp + eax + 4]
add bl, 0xd0
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 4
jne 0x43cd80
mov eax, dword [esp + 4]
mov ebx, dword [0x4486a8]
test ebx, ebx
je 0x43cdee
xor ebp, ebp
mov edi, dword [0x4486ac]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xe88ddea1
je 0x43cdc0
inc ebp
cmp ebx, ebp
jne 0x43cdb0
jmp 0x43cdee
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43cdee
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x30
cmp eax, 0x103
jne 0x43ce69
mov dword [esp], 0x66676869
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x46
xor cl, byte [esp + eax]
add cl, 0xd0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43ce00
mov eax, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43ce61
xor edx, edx
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43ce40
inc edx
cmp ecx, edx
jne 0x43ce30
jmp 0x43ce61
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ce61
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x4486b0]
call fcn.0043a9b0
add esp, 0x18
test eax, eax
js 0x43ce69
mov eax, dword [esp + 4]
test esi, esi
je 0x43ce7c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43ce7a
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret