joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433550
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00418480
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x433589
jmp 0x4336fc
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
jmp 0x4335bb
xor ebx, ebx
test cl, 1
jne 0x4335c7
jmp 0x4336f4
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042ebd0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4335fb
jmp 0x4336e3
mov dword [ebp - 0x1c], eax
mov ebx, eax
sub ebx, 0x633f3dfc
add ebx, 1
add ebx, 0x633f3dfc
sub esp, 4
mov dword [esp], ebx
call fcn.00408380
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042ec40
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x21
mov byte [edi + 1], 7
mov byte [edi + 2], 5
mov byte [edi + 3], 0x19
mov byte [edi + 4], 0xe
mov byte [edi + 5], 0x1e
mov byte [edi + 6], 9
mov byte [edi + 7], 0x1b
mov byte [edi + 8], 8
mov byte [edi + 9], 0xc1
mov byte [edi + 0xa], 6
mov byte [edi + 0xb], 9
mov byte [edi + 0xc], 4
mov byte [edi + 0xd], 0xf7
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x12
jne 0x433677
xor eax, eax
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
cmp eax, 0x12
jae 0x4336b6
mov dh, byte [edi + eax]
mov dl, al
add dl, 0x27
xor dl, dh
add dl, 0x3d
mov byte [edi + eax], dl
mov ebx, eax
and ebx, 1
mov edx, eax
and edx, 1
xor edx, 0xffffffff
add eax, 2
add eax, edx
add eax, ebx
jmp 0x43368b
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.00409280
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00408390
add esp, 4
jmp 0x4336e1
jmp 0x4336e3
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4336f4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4336fc
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push eax
mov ebx, esp
sub esp, 0x10
mov esi, esp
lea ecx, [ebp - 0x24]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.0043ff30
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44984c]

Function at 0x439290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00440620
add esp, 0x14
test eax, eax
js 0x4393b6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004409f0
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43932a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4392f8
mov eax, 0xffffffff
jmp 0x4392ff
lea eax, [eax*2 + 2]
push eax
call fcn.00408380
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00440fb0
add esp, 0x14
test eax, eax
jns 0x43932a
push esi
call fcn.00408390
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xe8ebeae5
mov dword [esp + 8], 0
nop
nop
nop
mov ecx, ebx
add cl, 0xd7
xor cl, byte [esp + ebx + 4]
add cl, 0xcd
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 8
jne 0x439340
mov ecx, dword [0x44d2b8]
test ecx, ecx
je 0x43939a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44d2bc]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439380
inc edi
cmp ecx, edi
jne 0x439370
jmp 0x43939a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43939a
push eax
push 4
push ecx
push dword [0x44d2c0]
call fcn.0043d920
add esp, 0x10
test esi, esi
jne 0x4393b8
lea eax, [esp + 4]
push eax
call fcn.0043fd20
add esp, 4
test al, al
je 0x4393b6
cmp dword [esp + 4], 1
je 0x4393b8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b030
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, dword [esp + 8]
mov dword [esp], 0x93929140
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xe4
xor dl, byte [esp + ecx]
add dl, 0x8c
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43b040
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4552dc]
pop ecx
ret

Function at 0x43b070
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449b58]
Function at 0x43b450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43b557
xor eax, eax
cmp dword [ecx], 0
jne 0x43b5f2
mov edx, dword [esp + 0x3c]
mov dword [esp], 0x18
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], 0x34353637
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x18]
mov esi, 0x507bf34b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
lea ebx, [edi + edi]
not ebx
add ebx, edi
and ebx, 0xa05a69f3
mov ebp, edi
xor ebp, 0xa05a69f3
or edi, 0xc
and edi, ebp
mov ebp, ebx
xor ebp, edi
not edi
and edi, ebx
add ebp, ebx
sub ebp, edi
mov ebx, esi
xor ebx, 0x5fa5960c
mov edi, ebp
and edi, ebx
add ebx, ebp
add edi, edi
sub ebx, edi
add bl, 0x7c
mov byte [eax], bl
inc eax
dec esi
cmp esi, 0x507bf343
jne 0x43b4d0
mov eax, dword [esp + 0x18]
mov esi, dword [0x44d2b8]
test esi, esi
je 0x43b5f2
xor edi, edi
mov ebx, dword [0x44d2bc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43b5fc
inc edi
cmp esi, edi
jne 0x43b540
jmp 0x43b5f2
mov dword [esp], 0xb10e0f04
mov dword [esp + 4], 0
mov eax, 0x48a49f7d
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x48a49f7d]
lea edx, [eax - 0x40000000]
mov ecx, esi
not ecx
mov edi, ecx
or edi, 0x3ec70732
add edi, esi
inc edi
mov ebx, eax
and ebx, 0x402098cd
and edx, 0x8840732
or edx, ebx
or esi, 0x38070010
and esi, 0x380700dd
xor esi, edi
xor esi, 0xf93ff8dd
and ecx, edi
and ecx, 0xc138f8cd
or ecx, esi
xor ecx, edx
mov esi, ecx
xor esi, 0xcd
mov edx, ecx
xor edx, 2
and ecx, 0x8e
xor ecx, 0x8c
or edx, 0x71
add edx, esi
add edx, ecx
add dl, 0x90
mov byte [esp + eax - 0x48a49f7d], dl
inc eax
cmp eax, 0x48a49f85
jne 0x43b570
mov eax, dword [esp]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b5f2
lea eax, [esp + 0x20]
mov edi, esp
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44d2c0]
call fcn.0043d920
add esp, 0x1c
jmp 0x43b5f2
Function at 0x43b630
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b6fb
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x34353637
mov dword [esp + 4], 0
mov edx, esp
mov esi, 0x507bf34b
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx]
lea ebx, [edi + edi]
not ebx
add ebx, edi
and ebx, 0xa05a69f3
mov ebp, edi
xor ebp, 0xa05a69f3
or edi, 0xc
and edi, ebp
mov ebp, ebx
xor ebp, edi
not edi
and edi, ebx
add ebp, ebx
sub ebp, edi
mov ebx, esi
xor ebx, 0x5fa5960c
mov edi, ebp
and edi, ebx
add ebx, ebp
add edi, edi
sub ebx, edi
add bl, 0x7c
mov byte [edx], bl
inc edx
dec esi
cmp esi, 0x507bf343
jne 0x43b660
mov edx, dword [0x44d2b8]
test edx, edx
je 0x43b6ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44d2bc]
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b6d0
inc edi
cmp edx, edi
jne 0x43b6c0
jmp 0x43b6ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b6ee
push eax
push 4
push edx
push dword [0x44d2c0]
mov esi, ecx
call fcn.0043d920
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43b7c3
mov eax, dword [ecx]
test eax, eax
je 0x43b7c3
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x34353637
mov dword [esp + 8], 0
lea eax, [esp + 4]
mov ebx, 0x507bf34b
nop
nop
nop
movzx edi, byte [eax]
lea edx, [edi + edi]
not edx
add edx, edi
and edx, 0xa05a69f3
mov esi, edi
xor esi, 0xa05a69f3
or edi, 0xc
and edi, esi
mov esi, edx
xor esi, edi
not edi
and edi, edx
add esi, edx
sub esi, edi
mov edx, ebx
xor edx, 0x5fa5960c
mov edi, esi
and edi, edx
add edx, esi
add edi, edi
sub edx, edi
add dl, 0x7c
mov byte [eax], dl
inc eax
dec ebx
cmp ebx, 0x507bf343
jne 0x43b740
mov eax, dword [esp + 4]
mov esi, dword [0x44d2b8]
test esi, esi
je 0x43b84f
xor edx, edx
mov edi, dword [0x44d2bc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xaf0e0c2e
je 0x43b82b
inc edx
cmp esi, edx
jne 0x43b7b0
jmp 0x43b84f
mov dword [esp + 4], 0x94a4b74
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
mov edi, ecx
xor edi, 0x4ca400ed
mov edx, eax
and edx, 4
sub edx, edi
mov edi, edx
and edi, esi
add edi, edi
mov ebx, edi
not ebx
and ebx, edx
not edx
and edx, edi
sub edx, ebx
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
add dl, 0xa1
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x43b7e0
mov eax, dword [esp + 4]
jmp 0x43b955
mov edx, dword [edi + edx*8 + 4]
cmp edx, eax
je 0x43b84f
push dword [ebp + 8]
push dword [esp + 0x10]
push 8
push edx
push dword [0x44d2c0]
mov esi, ecx
call fcn.0043d920
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43b948
cmp eax, 0xc000010a
jne 0x43b948
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x34353637
mov dword [esp + 8], 0
lea eax, [esp + 4]
mov esi, 0x507bf34b
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
lea edx, [edi + edi]
not edx
add edx, edi
and edx, 0xa05a69f3
mov ebx, edi
xor ebx, 0xa05a69f3
or edi, 0xc
and edi, ebx
mov ebx, edx
xor ebx, edi
not edi
and edi, edx
add ebx, edx
sub ebx, edi
mov edx, esi
xor edx, 0x5fa5960c
mov edi, ebx
and edi, edx
add edx, ebx
add edi, edi
sub edx, edi
add dl, 0x7c
mov byte [eax], dl
inc eax
dec esi
cmp esi, 0x507bf343
jne 0x43b8b0
mov eax, dword [esp + 4]
mov esi, dword [0x44d2b8]
test esi, esi
je 0x43b948
xor edx, edx
mov edi, dword [0x44d2bc]
cmp dword [edi + edx*8], 0x4c697c35
je 0x43b920
inc edx
cmp esi, edx
jne 0x43b910
jmp 0x43b948
mov edx, dword [edi + edx*8 + 4]
cmp edx, eax
je 0x43b948
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 0xc
push edx
push dword [0x44d2c0]
mov esi, ecx
call fcn.0043d920
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43b955
mov esi, eax
call fcn.0043b630
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43b960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0x34353637
mov dword [esp + 4], 0
mov eax, esp
mov edx, 0x507bf34b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
lea ebx, [esi + esi]
not ebx
add ebx, esi
and ebx, 0xa05a69f3
mov edi, esi
xor edi, 0xa05a69f3
or esi, 0xc
and esi, edi
mov edi, ebx
xor edi, esi
not esi
and esi, ebx
add edi, ebx
sub edi, esi
mov ebx, edx
xor ebx, 0x5fa5960c
mov esi, edi
and esi, ebx
add ebx, edi
add esi, esi
sub ebx, esi
add bl, 0x7c
mov byte [eax], bl
inc eax
dec edx
cmp edx, 0x507bf343
jne 0x43b990
mov eax, dword [esp]
mov edx, dword [0x44d2b8]
test edx, edx
je 0x43ba08
xor esi, esi
mov edi, dword [0x44d2bc]
nop
cmp dword [edi + esi*8], 0xc18bc4ba
je 0x43ba00
inc esi
cmp edx, esi
jne 0x43b9f0
jmp 0x43ba08
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43ba12
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push ebp
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x18
push edx
push dword [0x44d2c0]
call fcn.0043d920
add esp, 0x2c
jmp 0x43ba0b

Function at 0x43ba40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov dword [esp], 0x34353637
mov dword [esp + 4], 0
mov eax, esp
mov ebp, 0x507bf34b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, 0xa05a69f3
mov esi, edx
xor esi, 0xa05a69f3
or edx, 0xc
and edx, esi
mov esi, edi
xor esi, edx
not edx
and edx, edi
add esi, edi
sub esi, edx
mov edx, ebp
xor edx, 0x5fa5960c
mov edi, esi
and edi, edx
add edx, esi
add edi, edi
sub edx, edi
add dl, 0x7c
mov byte [eax], dl
inc eax
dec ebp
cmp ebp, 0x507bf343
jne 0x43ba70
test ebx, ebx
jne 0x43bac2
lea ebx, [esp + 8]
mov eax, dword [esp]
mov edx, dword [0x44d2b8]
test edx, edx
je 0x43bb17
xor esi, esi
mov edi, dword [0x44d2bc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xe6c7f7c6
je 0x43baf0
inc esi
cmp edx, esi
jne 0x43bae0
jmp 0x43bb17
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x43bb17
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push edx
push dword [0x44d2c0]
call fcn.0043d920
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov dword [esp + 0x24], 0x33ce31c6
mov dword [esp + 0x28], 0x3fca3dd0
mov dword [esp + 0x2c], 0x3b0c39cc
mov dword [esp + 0x30], 0xc732c528
mov dword [esp + 0x34], 0xc3c2c134
mov word [esp + 0x38], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x24]
lea edx, [eax + 0xcc89474]
xor edx, ecx
lea ecx, [edx + 0xbb]
not edx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x24], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x16
jb 0x43c6c0
lea eax, [esp + 0x24]
push eax
call fcn.0043f030
add esp, 4
mov dword [0x4552d4], eax
mov esi, 0x5ba6e0a1
test eax, eax
je 0x43c712
mov esi, 0x950d9bd1
mov ecx, 0xa20f9845
xor eax, eax
cmp ecx, 0x19c713c8
setl al
mov eax, dword [eax*4 + 0x449b70]
mov edx, 0x5144c046
xor edx, dword [0x449b78]
add eax, edx
inc eax
jmp eax

Function at 0x43d880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x449fcc]

Function at 0x43e760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 8], 0xb18ef5c3
mov dword [esp + 0xc], 0
xor edx, edx
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
or esi, 0x1d
mov ebx, edx
or ebx, 0x1d
add ebx, esi
add ebx, edx
inc bl
xor bl, byte [esp + edx + 8]
add bl, 0x6f
mov byte [esp + edx + 8], bl
lea esi, [edx + 1]
dec ecx
mov edx, esi
cmp esi, 8
jne 0x43e790
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x44a3d0]
mov ecx, 0x979d9042
xor ecx, dword [0x44a3d8]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax

Function at 0x43f330
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov dword [esp], 0x9f9e99a8
mov word [esp + 4], 0
mov esi, 0x31780cdb
mov edi, 0xce87f325
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x31780cdb]
mov eax, edi
or eax, edx
lea ebx, [edi + 0x31780d00]
and ebx, edx
xor ebx, eax
or ebx, edi
add ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xbd
mov byte [esp + esi - 0x31780cdb], al
inc esi
dec edi
cmp esi, 0x31780ce1
jne 0x43f360
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor ecx, ecx
test ebp, ebp
sete cl
jmp dword [ecx*4 + 0x44a9d8]
Function at 0x43f450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov dword [esp], 0x494a4b1c
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
or esi, 0xaa7e96f3
add esi, edx
inc esi
mov edi, edx
or edi, 0xaa7e96f3
mov ebx, esi
and ebx, edi
xor edi, esi
lea ebx, [edi + ebx*2]
xor bl, byte [esp + edx]
add bl, 0x41
mov byte [esp + edx], bl
lea esi, [edx + 1]
dec eax
mov edx, esi
cmp esi, 7
jne case.default.0x43f4bd
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ebp, ebp
sete dl
jmp dword [edx*4 + 0x44aa08]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44aa3c]
mov edi, dword [edx]
xor ecx, ecx
cmp edi, edx
setne cl
jmp dword [ecx*4 + 0x44aa20]
xor ecx, ecx
cmp dword [edi + 0x18], ebp
sete cl
mov ebx, 1
jmp dword [ecx*4 + 0x44aa28]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [0x44aa54]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
hlt

Function at 0x43f550
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0xe3e20b3d
mov dword [esp + 4], 0
mov edx, 0x41c86728
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 0x41c86728]
xor ecx, edx
mov esi, ecx
and esi, 0x8b
xor esi, 0x9003008b
and ecx, 0xc82574
sub ecx, esi
mov esi, ecx
and esi, 0x37
xor ecx, 0xb715fc37
lea ebx, [ecx + esi*2]
add ebx, 0x8b
add ecx, ecx
or ecx, 0xfd
xor ebx, 0xfe
add ebx, ecx
mov cl, 0xfe
sub cl, bl
mov byte [esp + edx - 0x41c86728], cl
inc edx
cmp edx, 0x41c86730
jne 0x43f580
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44aa58]
Function at 0x43fd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fda0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43fdbb
mov eax, 0xffffffff
jmp 0x43fdbe
add eax, 0xa
push eax
call fcn.00408380
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43fe01
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43fdf0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x74750a0b
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 2
xor esi, 0x42
mov edx, ecx
and edx, 5
sub edx, esi
xor dl, byte [esp + ecx]
add dl, 0x4a
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x43fe80
mov esi, dword [esp]
mov ecx, dword [0x44d2b8]
test ecx, ecx
je 0x43ff12
xor edx, edx
mov edi, dword [0x44d2bc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43fed0
inc edx
cmp ecx, edx
jne 0x43fec0
jmp 0x43ff12
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43ff12
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44d2c0]
mov edi, eax
call fcn.0043d920
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408390
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ff30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ff50
mov ebx, eax
sar ebx, 1
lea esi, [ebx + 4]
and eax, 2
mov ecx, esi
xor ecx, 1
add ecx, eax
jns 0x43ff75
mov ecx, 0xffffffff
jmp 0x43ff77
add ecx, ecx
push ecx
call fcn.00408380
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x43ffc2
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x43ffb0
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, ebx
lea ecx, [esi + edx]
mov word [esp + 8], cx
lea ecx, [esi + edx]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x74750a0b
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 2
xor esi, 0x42
mov edx, ecx
and edx, 5
sub edx, esi
xor dl, byte [esp + ecx]
add dl, 0x4a
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x440040
mov esi, dword [esp]
mov ecx, dword [0x44d2b8]
test ecx, ecx
je 0x4400c4
xor edx, edx
mov ebx, dword [0x44d2bc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440090
inc edx
cmp ecx, edx
jne 0x440080
jmp 0x4400c4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4400c4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44d2c0]
mov edi, eax
call fcn.0043d920
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408390
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret