joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4141c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [ebp + 0xc]
push eax
sub esp, 0x14
mov dword [ebp - 0x70], esp
push eax
mov dword [ebp - 0x90], esp
sub esp, 0xc
mov dword [ebp - 0x98], esp
sub esp, 0xc
mov dword [ebp - 0x60], esp
sub esp, 0x14
mov dword [ebp - 0x80], esp
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x414200
sar esi, 1
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44a970]
mov ebx, dword [ebp - 0x78]
mov edi, 0xffffffff
test ebx, ebx
jns 0x414232
mov eax, 0xffffffff
jmp 0x414235
lea eax, [ebx + ebx]
push eax
call fcn.00409a50
add esp, 4
lea ecx, [ebp - 0x78]
push ecx
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44a970]
mov eax, dword [ebp - 0x78]
mov ecx, eax
add ecx, 0xd
js 0x414263
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [ebp - 0x58], 0x7528771a
mov dword [ebp - 0x54], 0x89ff8beb
mov dword [ebp - 0x50], 0x8dac8ffa
mov dword [ebp - 0x4c], 0x81e583e8
mov dword [ebp - 0x48], 0x85f387f0
mov dword [ebp - 0x44], 0x99eb9be3
mov dword [ebp - 0x40], 0x9d9c9fec
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x1c
ja 0x4142ec
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x58]
add eax, 0x52f752fc
xor eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add al, 0x76
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x58], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x1d
jb 0x4142c0
movzx ecx, word [ebx]
mov eax, esi
test cx, cx
je 0x414311
lea edx, [ebx + 2]
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414300
mov word [eax], 0
movzx ecx, word [ebp - 0x58]
test cx, cx
mov dword [ebp - 0x7c], ebx
je 0x414341
lea edx, [ebp - 0x56]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414330
mov word [eax], 0
lea eax, [ebp - 0x68]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043f380
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445b4c]

Function at 0x415120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
xor eax, eax
cmp dword [esp + 0xa8], 0
setne al
xor edx, edx
mov dword [esp + 0x70], 0
xor ecx, ecx
jmp dword [eax*4 + 0x445c94]
Function at 0x416940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x40]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x416950
sar ebp, 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44a970]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41697f
mov eax, 0xffffffff
jmp 0x416982
lea eax, [edi + edi]
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44a970]
lea ebx, [esp + 0x14]
push ebx
push esi
call fcn.0043f530
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445e20]
Function at 0x419bdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [ebp + 0x10]
push eax
sub esp, 0x44
mov edi, esp
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x419bf0
cmp eax, 0xffffffdd
jge 0x419c07
mov eax, 0xffffffff
jmp 0x419c0a
add eax, 0x22
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [ebp - 0x3c], 0x129e14f1
mov dword [ebp - 0x38], 0xe9e109d
mov dword [ebp - 0x34], 0xa940c83
mov dword [ebp - 0x30], 0x69c0890
mov dword [ebp - 0x2c], 0x29f04e1
mov dword [ebp - 0x28], 0x3ea5009a
mov dword [ebp - 0x24], 0x3ab03ca2
mov dword [ebp - 0x20], 0x36bb38ad
mov word [ebp - 0x1c], 0x3435
mov dword [ebp - 0x1a], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x25
ja 0x419c9c
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x3c]
add eax, 0xf8d8004a
xor eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add al, 0xa1
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x3c], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x26
jb 0x419c70
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x419cc1
add ecx, 2
mov eax, esi
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x419cb0
mov word [eax], 0
movzx ecx, word [ebp - 0x3c]
test cx, cx
je 0x419cf1
lea edx, [ebp - 0x3a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419ce0
mov word [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov dword [edi], 0xdd4fdf4b
mov dword [edi + 4], 0xd101d352
mov dword [edi + 8], 0xd55ed74b
mov dword [edi + 0xc], 0xc951cb40
mov dword [edi + 0x10], 0xcd5bcf5a
mov dword [edi + 0x14], 0xc153c353
mov dword [edi + 0x18], 0xc51bc752
mov dword [edi + 0x1c], 0xb967bb19
mov dword [edi + 0x20], 0xbd1cbf66
mov dword [edi + 0x24], 0xb127b337
mov dword [edi + 0x28], 0xb520b72b
mov dword [edi + 0x2c], 0xa93bab71
mov dword [edi + 0x30], 0xad3aaf3a
mov dword [edi + 0x34], 0xa12aa337
mov dword [edi + 0x38], 0xa519a734
mov dword [edi + 0x3c], 0x99599b00
mov dword [edi + 0x40], 0x9d9e9f46
mov word [edi + 0x44], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x45
ja 0x419dca
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [edi + ecx]
add eax, 0xde2c64a3
xor eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add al, 0x85
mov ecx, dword [ebp - 0x10]
mov byte [edi + ecx], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x46
jb 0x419da0
lea eax, [ebp - 0x3c]
push eax
push 0x41a060
push edi
push esi
call fcn.0041a700
add esp, 0x10
jmp dword [0x445ea8]
Function at 0x419f10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419f20
cmp eax, 0xffffffed
jge 0x419f37
mov eax, 0xffffffff
jmp 0x419f3a
add eax, 0x12
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xfa50956
mov dword [esp + 8], 0x13b30da5
mov dword [esp + 0xc], 0x17621166
mov dword [esp + 0x10], 0x1bb215b2
mov dword [esp + 0x14], 0x191a
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x419fbe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x1838df29
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xdd
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x419f90
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419fe1
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419fd0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x41a011
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a000
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043f530
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x445eb0]

Function at 0x41a580
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
movzx ecx, byte [esp + 0x68]
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], cl
mov dword [esp + 0x38], eax
test ebp, ebp
setg al
and al, cl
movzx eax, al
jmp dword [eax*4 + 0x445f98]
Function at 0x41da00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x44a970]
mov dword [esp + 8], 0x97579545
mov dword [esp + 0xc], 0x93009106
mov dword [esp + 0x10], 0x9f3f9d5e
mov dword [esp + 0x14], 0x9b3b9902
mov dword [esp + 0x18], 0x87208575
mov dword [esp + 0x1c], 0x8328813a
mov dword [esp + 0x20], 0x8f1a8d1d
mov dword [esp + 0x24], 0x8b278922
mov dword [esp + 0x28], 0x77d67518
mov dword [esp + 0x2c], 0x73e271dd
mov dword [esp + 0x30], 0x7fd87dde
mov dword [esp + 0x34], 0x7bea79ce
mov dword [esp + 0x38], 0x67ca65eb
mov dword [esp + 0x3c], 0x63f461cd
mov dword [esp + 0x40], 0x6ff16dcd
mov word [esp + 0x44], 0x696e
mov dword [esp + 0x46], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x41
ja 0x41dae0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0xaedd885f
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xb
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x42
jb 0x41dab0
lea ebx, [esp + 0x4c]
lea edi, [esp + 8]
push ebx
push 0
push 0
push 0x1e
push edi
push 0
call eax
mov ebp, dword [esp + 0x4c]
test ebp, ebp
jns 0x41db03
mov eax, 0xffffffff
jmp 0x41db0a
lea eax, [ebp*2]
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov eax, dword [0x44a970]
mov dword [esp + 8], 0xa8e6aa80
mov dword [esp + 0xc], 0xb4c5b6c7
mov dword [esp + 0x10], 0xb0deb2ff
mov dword [esp + 0x14], 0xbcd2bec3
mov dword [esp + 0x18], 0xb8ddba90
mov dword [esp + 0x1c], 0xc4adc69b
mov dword [esp + 0x20], 0xc0b3c2b8
mov dword [esp + 0x24], 0xcca6cea3
mov dword [esp + 0x28], 0xc8a7cab5
mov dword [esp + 0x2c], 0xd4abd6a0
mov dword [esp + 0x30], 0xd0b5d2bf
mov dword [esp + 0x34], 0xdca3de8f
mov dword [esp + 0x38], 0xd8b3daaa
mov dword [esp + 0x3c], 0xe491e690
mov dword [esp + 0x40], 0xe09ce288
mov word [esp + 0x44], 0xeeef
mov dword [esp + 0x46], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x41
ja 0x41dbe0
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x3e92472c
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x79
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x42
jb 0x41dbb0
push ebx
push ebp
push esi
push 0x1e
push edi
push 0
call eax
mov dword [esp + 8], 0x63fa6d98
mov dword [esp + 0xc], 0x67f461f5
mov dword [esp + 0x10], 0x1bff6580
mov dword [esp + 0x14], 0x1ff8198e
mov dword [esp + 0x18], 0x13841d85
mov dword [esp + 0x1c], 0x171611f4
mov word [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x19
ja 0x41dc5e
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xd637ecb6
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x26
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1a
jb 0x41dc30
push 0
push 0
push edi
push esi
push dword [esp + 0x74]
call fcn.00416940
add esp, 0x14
jmp dword [0x44650c]
Function at 0x41f8f0
Capabilities:
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x850
lea ebx, [esp + 0xdc]
mov dword [esp + 0xc], 0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
xor esi, esi
jmp dword [ecx*4 + 0x446b70]
Function at 0x436e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x436e30
lea esi, [ecx + edx]
add esi, 0xfffffffe
mov edx, ecx
not edx
and edx, esi
add edx, edx
xor esi, ecx
mov dword [esp + 4], 0xd8d8da45
mov byte [esp + 8], 0
mov dword [esp], 0
mov edi, dword [esp]
cmp edi, 4
ja 0x436ea0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov ebx, dword [esp]
movzx ebx, byte [esp + ebx + 4]
add edi, 0x379de05c
xor edi, ebx
mov dword [esp + 0xc], edi
mov ebx, dword [esp + 0xc]
add bl, 0x7a
mov edi, dword [esp]
mov byte [esp + edi + 4], bl
inc dword [esp]
mov edi, dword [esp]
cmp edi, 5
jb 0x436e70
cmp edx, esi
je 0x436f0e
sub edx, esi
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x436ed1
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x436ec0
cmp edi, 3
jb 0x436f0e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x436ee0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.0043f380
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x14], 0
jmp dword [eax*4 + 0x44832c]
Function at 0x43b3e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448838]

Function at 0x43b480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x50515253
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43b4de
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x279c2e50
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xfc
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43b4b0
mov edi, dword [esp + 4]
mov eax, dword [0x44a974]
test eax, eax
je 0x43b536
xor ecx, ecx
mov edx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43b510
inc ecx
cmp eax, ecx
jne 0x43b500
jmp 0x43b536
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b536
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44a97c]
push eax
call fcn.0043d1f0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43b665
mov dword [esp + 0x10], esi
push dword [esp + 8]
call fcn.0043b2f0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x50515253
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x43b5a0
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x279c2e50
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xfc
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x43b570
mov edi, dword [esp + 4]
mov edx, dword [0x44a974]
test edx, edx
je 0x43b5f6
xor ebx, ebx
mov ebp, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43b5d1
inc ebx
cmp edx, ebx
jne 0x43b5c0
jmp 0x43b5f6
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43b5f6
push 0
push ecx
push eax
push 5
push 4
push dword [0x44a97c]
push edx
mov esi, eax
call fcn.0043d1f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43b65c
mov ecx, dword [esp + 0x28]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43b635
add ebx, 2
cmp bp, si
je 0x43b620
cmp bp, si
je 0x43b647
mov ebx, dword [edx]
test ebx, ebx
jne 0x43b610
mov edi, 0xc0000225
jmp 0x43b65c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.0043b3e0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43b6a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [ecx + 4]
test edx, edx
je 0x43b770
xor eax, eax
cmp dword [ecx], 0
jne 0x43b7c2
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x50515253
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x43b741
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
add eax, 0x279c2e50
xor eax, edx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xfc
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x43b710
mov eax, dword [esp + 8]
mov esi, dword [0x44a974]
test esi, esi
je 0x43b7c2
mov edx, dword [esp + 0x3c]
xor edi, edi
mov ebx, dword [0x44a978]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43b7cb
inc edi
cmp esi, edi
jne 0x43b760
jmp 0x43b7c2
mov dword [esp + 0x14], 0xc180878e
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43b7be
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0xa4083dd2
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xac
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43b790
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b7c2
lea eax, [esp + 0xc]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44a97c]
push esi
call fcn.0043d1f0
add esp, 0x1c
jmp 0x43b7c2

Function at 0x43b800
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b8c1
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x50515253
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x43b860
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x279c2e50
xor edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0xfc
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x43b830
mov edx, dword [0x44a974]
test edx, edx
je 0x43b8ae
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43b890
inc edi
cmp edx, edi
jne 0x43b880
jmp 0x43b8ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b8ae
push eax
push 1
push dword [0x44a97c]
push edx
mov esi, ecx
call fcn.0043d1f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x43b8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0x10], ecx
cmp dword [ecx + 4], 0
je 0x43b976
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x43b976
mov dword [esp], 0x50515253
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x43b941
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx]
add eax, 0x279c2e50
xor eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xfc
mov edx, dword [esp + 4]
mov byte [esp + edx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x43b910
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esp]
mov edi, dword [0x44a974]
test edi, edi
je 0x43b9f7
xor esi, esi
mov edx, dword [0x44a978]
cmp dword [edx + esi*8], 0xc766965c
je 0x43b9d7
inc esi
cmp edi, esi
jne 0x43b960
mov esi, dword [ebp + 0x10]
jmp 0x43b9f7
mov dword [esp + 8], 0xa0e3e215
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43b9ce
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x1751d3ff
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x1e
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43b9a0
mov eax, dword [esp + 8]
jmp 0x43bb12
mov edx, dword [edx + esi*8 + 4]
cmp edx, eax
mov esi, dword [ebp + 0x10]
je 0x43b9f7
push dword [ebp + 8]
push ecx
push 2
push dword [0x44a97c]
push edx
call fcn.0043d1f0
add esp, 0x14
cmp ebx, 1
mov ecx, esi
sbb ecx, 0
jl 0x43bb01
cmp eax, 0xc000010a
jne 0x43bb01
mov edi, esi
mov esi, ebx
and esi, 0xffffd8f0
mov eax, esi
xor eax, 0xffffd8f0
mov ecx, edi
not ecx
mov edx, ebx
and edx, 0x270f
imul ecx, edx
mul edx
mov dword [esp + 0x18], eax
add edx, ecx
mov ecx, edx
or ebx, 0xffffd8f0
mov eax, ebx
mul esi
imul edi, ebx
add edx, edi
sub edx, esi
add eax, dword [esp + 0x18]
adc edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov dword [esp + 0x14], 0x50515253
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43baae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x279c2e50
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xfc
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43ba80
mov eax, dword [esp + 0x14]
mov esi, dword [0x44a974]
test esi, esi
je 0x43bb01
xor edi, edi
mov ecx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0x7e28bda7
je 0x43bae0
inc edi
cmp esi, edi
jne 0x43bad0
jmp 0x43bb01
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x43bb01
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x18
test eax, eax
js 0x43bb12
mov ecx, dword [esp + 0x10]
mov esi, eax
call fcn.0043b800
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43bb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x30]
test edx, edx
jne 0x43bb33
lea edx, [esp + 0xc]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x50515253
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43bb7e
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0x279c2e50
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xfc
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43bb50
mov eax, dword [esp + 4]
mov ebp, dword [0x44a974]
test ebp, ebp
je 0x43bbd4
mov ebx, dword [esp + 0x2c]
xor esi, esi
mov edi, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x43bbb0
inc esi
cmp ebp, esi
jne 0x43bba0
jmp 0x43bbd4
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x43bbd4
push edx
push ebx
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push 5
push dword [0x44a97c]
push ebp
call fcn.0043d1f0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10