joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416cd0
sar esi, 1
lea edi, [esp + 0x7c]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x448ad0]
mov ebx, dword [esp + 0x7c]
test ebx, ebx
jns 0x416cff
mov eax, 0xffffffff
jmp 0x416d02
lea eax, [ebx + ebx]
push eax
call fcn.004093a0
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x448ad0]
mov dword [esp + 0x20], 0x334e315c
mov dword [esp + 0x24], 0x37a53555
mov dword [esp + 0x28], 0x2b0a29bc
mov dword [esp + 0x2c], 0x2f4b2d5a
mov dword [esp + 0x30], 0x23b121b2
mov dword [esp + 0x34], 0x27b925bd
mov dword [esp + 0x38], 0x5b5a59c6
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x23
ja 0x416de1
nop
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb8]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + edx]
add esi, 0xfbce1ea8
add ecx, 0xfbce1ea8
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x90], esi
mov ecx, dword [esp + 0x90]
mov edx, ecx
xor edx, 0x67
and ecx, 0x67
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x24
jb 0x416d80
lea edi, [esp + 0xb8]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x7c]
mov ecx, eax
add ecx, 0xd
jns 0x416e17
mov eax, 0xffffffff
jmp 0x416e1c
add eax, eax
add eax, 0x1a
push eax
call fcn.004093a0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x416e51
lea edx, [ebx + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416e40
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
mov dword [esp + 0x6c], ebx
je 0x416e81
lea edx, [esp + 0xba]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416e70
mov word [eax], 0
mov eax, esp
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043c380
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443074]
Function at 0x41b750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x3b55394a
mov dword [esp + 0xc], 0x3fa73d5d
mov dword [esp + 0x10], 0x230e216a
mov dword [esp + 0x14], 0x27462546
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x2926
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1b
ja 0x41b7ec
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0xa7]
add ecx, edx
and esi, edx
add esi, esi
sub ecx, esi
add ecx, 0xc711e2a7
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x6f
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1c
jb 0x41b7b0
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x2a]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x3a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41b820
mov edi, esi
cmp eax, 0xffffffed
jge 0x41b839
mov eax, 0xffffffff
jmp 0x41b83c
add eax, 0x12
push eax
call fcn.004093a0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41b871
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41b860
mov word [eax], 0
movzx ecx, word [esp + 0x2a]
test cx, cx
je 0x41b8a1
lea edx, [esp + 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b890
mov word [eax], 0
push edi
push esi
call fcn.0043c560
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x443490]
Function at 0x41f4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0xc30bc52d
mov dword [esp + 0x14], 0xcf70c172
mov dword [esp + 0x18], 0xcb63cd02
mov dword [esp + 0x1c], 0xd767c976
mov dword [esp + 0x20], 0xd370d53d
mov dword [esp + 0x24], 0xdf78d10e
mov dword [esp + 0x28], 0xdb6edd65
mov dword [esp + 0x2c], 0xa773d976
mov dword [esp + 0x30], 0xa30aa518
mov dword [esp + 0x34], 0xaf1ea115
mov dword [esp + 0x38], 0xab08ad02
mov dword [esp + 0x3c], 0xb716a97a
mov dword [esp + 0x40], 0xb31eb507
mov dword [esp + 0x44], 0xbf04b105
mov dword [esp + 0x48], 0xbb01bd15
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0xb9ba
mov dword [esp + 0x4e], 0
mov byte [esp + 0x52], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x42
ja 0x41f598
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
add ecx, 0x3e0fa121
mov esi, ecx
and esi, edx
mov edi, ecx
xor edi, edx
not edx
or ecx, edx
add edx, edi
add ecx, esi
sub edx, ecx
lea ecx, [edx + esi*2]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0x19
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x43
jb 0x41f550
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x448ad0]
mov eax, dword [0x443e80]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x422740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.00422760
add esp, 4
test al, al
je 0x422753
mov al, 1
ret
jmp fcn.00422f40
Function at 0x438290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x4383a0
xor eax, eax
cmp dword [ecx], 0
jne 0x4383a5
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x28292e2f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x438368
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + 0xf2ffc5a]
and esi, edx
add eax, edx
add eax, 0xf2ffc5a
add esi, esi
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x8a
mov edx, dword [esp]
mov byte [esp + edx + 8], al
mov eax, dword [esp]
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov dword [esp], eax
mov eax, dword [esp]
cmp eax, 0xd
jb 0x438320
mov eax, dword [esp + 8]
mov esi, dword [0x448ad4]
test esi, esi
je 0x4383a5
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x4383af
inc edi
cmp esi, edi
jne 0x438390
jmp 0x4383a5
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4383a5
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x448adc]
push esi
call fcn.00439d10
add esp, 0x1c
jmp 0x4383a5

Function at 0x4383e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x4384c7
mov esi, ecx
mov dword [esp + 8], 0x28292e2f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xc
ja 0x43847a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0xf2ffc5a]
and edi, edx
add ecx, edx
add ecx, 0xf2ffc5a
add edi, edi
sub ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x8a
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
mov ecx, dword [esp]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp ecx, 0xd
jb 0x438430
mov ecx, dword [0x448ad4]
test ecx, ecx
je 0x4384ba
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x448ad8]
cmp dword [ebx + edi*8], 0x11081610
je 0x4384a0
inc edi
cmp ecx, edi
jne 0x438490
jmp 0x4384ba
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4384ba
push eax
push 1
push dword [0x448adc]
push ecx
call fcn.00439d10
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4384d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x4386ee
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x4386ee
mov dword [esp + 8], 0x28292e2f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xc
ja 0x43857a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0xf2ffc5a]
and edi, edx
add ecx, edx
add ecx, 0xf2ffc5a
add edi, edi
sub ecx, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0x8a
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
mov ecx, dword [esp]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp ecx, 0xd
jb 0x438530
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0x448ad4]
test edx, edx
je 0x4385d5
xor ecx, ecx
mov ebx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0xac3673b8
je 0x4385b3
inc ecx
cmp edx, ecx
jne 0x4385a0
mov ebx, dword [ebp + 0x10]
jmp 0x4385d5
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x4385d5
push dword [ebp + 8]
push eax
push 2
push dword [0x448adc]
push ecx
call fcn.00439d10
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x4386e3
cmp edi, 0xc000010a
jne 0x4386e3
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x28292e2f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xc
ja 0x43868e
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0xf2ffc5a]
and edi, edx
add ecx, edx
add ecx, 0xf2ffc5a
add edi, edi
sub ecx, edi
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x8a
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
mov ecx, dword [esp + 4]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, 0xd
jb 0x438640
mov edi, dword [esp + 8]
mov ecx, dword [0x448ad4]
test ecx, ecx
je 0x4386e3
xor edx, edx
mov ebx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xb33e16a3
je 0x4386c0
inc edx
cmp ecx, edx
jne 0x4386b0
jmp 0x4386e3
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x4386e3
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0x448adc]
push ecx
call fcn.00439d10
add esp, 0x18
mov edi, eax
test edi, edi
js 0x4386ee
mov ecx, esi
call fcn.004383e0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x438700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x438717
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x28292e2f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x438798
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [eax + 0xf2ffc5a]
and edi, esi
add eax, esi
add eax, 0xf2ffc5a
add edi, edi
sub eax, edi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x8a
mov esi, dword [esp]
mov byte [esp + esi + 8], al
mov eax, dword [esp]
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
mov dword [esp], eax
mov eax, dword [esp]
cmp eax, 0xd
jb 0x438750
mov eax, dword [esp + 8]
mov esi, dword [0x448ad4]
test esi, esi
je 0x4387e4
xor edi, edi
mov ebx, dword [0x448ad8]
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x4387c0
inc edi
cmp esi, edi
jne 0x4387b0
jmp 0x4387e4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4387e4
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x448adc]
push esi
call fcn.00439d10
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43b5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, esp
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [eax], 0xb0a0d3c
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [esi], 0
mov edx, dword [esi]
cmp edx, 0xb
ja 0x43b624
nop
nop
nop
nop
nop
nop
mov edx, dword [esi]
mov edi, dword [esi]
movzx ecx, byte [eax + edi]
lea edi, [edx + 0x82]
mov ebx, ecx
not ebx
or ebx, edi
and edi, ecx
add edi, ebx
neg edi
lea ecx, [edx + edi]
add ecx, 0x911c3181
mov dword [esi + 4], ecx
mov ecx, dword [esi + 4]
mov edx, ecx
xor edx, 0x71
and ecx, 0x71
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esi]
mov byte [eax + edx], cl
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, 0xc
jb 0x43b5e0
mov eax, dword [eax]
mov eax, dword fs:[eax]
xor ecx, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
sete cl
jmp dword [ecx*4 + 0x44749c]
jmp dword [0x4474ac]
mov ebx, dword [eax + 8]
mov edx, dword [case.0x43b633.8]
nop
jmp edx
jmp dword [0x4474d0]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov edi, dword [edx]
xor ecx, ecx
cmp edi, edx
setne cl
jmp dword [ecx*4 + 0x4474d4]
Function at 0x43c1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c1d0
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43c1eb
mov eax, 0xffffffff
jmp 0x43c1ee
add eax, 0xa
push eax
call fcn.004093a0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43c231
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43c220
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 4], cx
add eax, edx
add eax, 2
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x68696e6f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43c305
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xdf085692
add eax, 0x92
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 2
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43c2c0
mov edi, dword [esp + 0x10]
mov eax, dword [0x448ad4]
test eax, eax
je 0x43c36d
xor ecx, ecx
mov edx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x7a96736e
je 0x43c330
inc ecx
cmp eax, ecx
jne 0x43c320
jmp 0x43c36d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c36d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x448adc]
push eax
call fcn.00439d10
add esp, 0x38
mov edi, eax
push esi
call fcn.004093b0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c3a0
mov ebx, eax
sar ebx, 1
lea edi, [ebx + 4]
and eax, 2
mov ecx, edi
xor ecx, 1
add ecx, eax
jns 0x43c3c5
mov ecx, 0xffffffff
jmp 0x43c3c7
add ecx, ecx
push ecx
call fcn.004093a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x43c411
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x43c400
mov word [edx], 0
mov edx, edi
and edx, 0xfffd
and ebx, 2
mov ecx, ebx
xor ecx, 2
imul ecx, edx
or edi, 2
imul edi, ebx
lea edx, [edi + ecx]
mov word [esp + 4], dx
add ecx, edi
add ecx, 2
mov word [esp + 6], cx
mov esi, eax
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x68696e6f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43c4e5
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xdf085692
add eax, 0x92
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 2
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43c4a0
mov edi, dword [esp + 0x10]
mov eax, dword [0x448ad4]
test eax, eax
je 0x43c541
xor ecx, ecx
mov edx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x366ceda
je 0x43c510
inc ecx
cmp eax, ecx
jne 0x43c500
jmp 0x43c541
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c541
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x448adc]
push eax
call fcn.00439d10
add esp, 0x24
mov edi, eax
push esi
call fcn.004093b0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edi + 2], 0
lea edi, [edi + 2]
jne 0x43c580
sar edi, 1
lea ebx, [edi + 4]
mov ecx, edi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43c5a5
mov eax, 0xffffffff
jmp 0x43c5a7
add eax, eax
push eax
call fcn.004093a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x43c5f1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x43c5e0
mov word [edx], 0
mov edx, ebx
and edx, 0xfffd
and edi, 2
mov ecx, edi
xor ecx, 2
imul ecx, edx
or ebx, 2
imul ebx, edi
lea edx, [ebx + ecx]
mov word [esp + 4], dx
add ecx, ebx
add ecx, 2
mov word [esp + 6], cx
mov esi, eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x68696e6f
mov dword [esp + 0x2c], 0
mov byte [esp + 0x30], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43c6c5
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
lea edx, [eax + ecx]
add edx, 0xdf085692
add eax, 0x92
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 2
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43c680
mov edi, dword [esp + 0x28]
mov eax, dword [0x448ad4]
test eax, eax
je 0x43c715
xor ecx, ecx
mov edx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x43c6f0
inc ecx
cmp eax, ecx
jne 0x43c6e0
jmp 0x43c715
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c715
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x448adc]
push eax
call fcn.00439d10
add esp, 0x14
mov edi, eax
push esi
call fcn.004093b0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43c72b
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x68696e6f
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x43c7ca
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xdf085692
add eax, 0x92
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add al, 2
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x43c780
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x448ad4]
test edx, edx
je 0x43c828
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x448ad8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3bebd150
je 0x43c800
inc edi
cmp edx, edi
jne 0x43c7f0
jmp 0x43c828
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43c828
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x448adc]
push edx
call fcn.00439d10
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43c835
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x43c841
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret