joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4031c8
mov esi, edx
test edx, edx
je 0x4031c8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4031c8
push esi
call fcn.00409260
add esp, 4
test eax, eax
je 0x40311a
xor edi, edi
mov ecx, 0x1505
movzx edx, byte [esi + edi]
test edx, edx
je 0x403121
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x403100
jmp 0x403123
mov ebp, 0x1505
jmp 0x403123
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4031d0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40318a
call fcn.004032c0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4031c8
push ecx
call fcn.00409260
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x40323f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4031e8
inc ebx
dec esi
je 0x40313f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x403144
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4031e0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00409260
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4031e0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00409290
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4031e0
mov eax, 0xffffffff
jmp 0x4031c8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403258
inc ebx
dec esi
je 0x403185
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40318a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403250
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00409260
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403250
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00409290
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403250
jmp 0x40318a
Function at 0x403a20
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403bd6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x403bcf
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x403ab3
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x403bcf
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x403b2d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x403ad0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x403a78
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x403b83
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403b60
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403a70
jmp 0x403b95
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x403a70
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403ba0
jmp 0x403a70
shl ecx, 0x10
or ecx, edi
jmp 0x403bdb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403c4a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x403c4c
not eax
xor esi, esi
nop
nop
nop
nop
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi]
mov ebp, eax
and ebp, ebx
or eax, ebx
not ebp
and ebp, eax
and ebp, 0xf
xor edi, dword [ebp*4 + 0x43da18]
mov eax, edi
shr eax, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor eax, dword [ebx*4 + 0x43da18]
inc esi
cmp edx, esi
jne 0x403c10
not eax
jmp 0x403c4c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409810
sub esp, 0x100
mov esi, esp
call fcn.00437820
test al, 1
jne 0x40978c
jmp 0x4097d1
call fcn.00432320
test al, 1
jne 0x409797
jmp 0x4097ca
call fcn.0040a8f0
test al, 1
jne 0x4097a2
jmp 0x4097c8
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004097f0
add esp, 8
call fcn.0040f2d0
call fcn.0040b850
jmp 0x4097c6
jmp 0x4097c8
jmp 0x4097ca
call fcn.00438000
jmp 0x4097d1
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40999e
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4098ad
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4098d1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x4098a0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x4098a0
lea ebp, [ebx + 1]
push ebp
call fcn.004090b0
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x4099ac
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x409918
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x4099ae
movzx edx, word [edi]
test dx, dx
je 0x4099ae
cmp dx, 0x7f
jbe 0x409900
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ebp, 0x7ff
ja 0x409960
cmp ecx, 2
jb 0x409960
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x409907
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x409907
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x409907
push 1
call fcn.004090b0
add esp, 4
mov esi, eax
jmp 0x4099ae
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4099d7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [esi + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4099d2
test eax, eax
jne 0x4099d0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405e50
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x417830
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov esi, esp
push eax
sub esp, 0x24
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0xa8], eax
mov esp, eax
push eax
mov dword [esi + 0x74], esp
push eax
mov dword [esi + 0xa4], esp
sub esp, 0x48
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0xb0], eax
mov esp, eax
push eax
sub esp, 0x2c
mov dword [esi + 0x94], esp
sub esp, 0x38
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0xb4], eax
mov esp, eax
push eax
mov dword [esi + 0xa0], esp
sub esp, 0x18
mov dword [esi + 0x98], esp
sub esp, 0x20
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x90], eax
mov esp, eax
push eax
mov dword [esi + 0x9c], esp
sub esp, 0x10
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x7c], eax
mov esp, eax
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
xor ecx, ecx
jmp dword [eax*4 + 0x442e64]
Function at 0x41aff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x43354122
mov dword [esp + 0xc], 0x5fd75d3d
mov dword [esp + 0x10], 0x5b6e5912
mov dword [esp + 0x14], 0x57365526
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x5156
mov dword [esp + 0x1e], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x19
ja 0x41b091
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0x53cc4e4b]
and esi, edx
add ecx, edx
add ecx, 0x53cc4e4b
add esi, esi
sub ecx, esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
add cl, 0xf3
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1a
jb 0x41b050
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41b0c0
mov edi, esi
cmp eax, 0xffffffed
jge 0x41b0d9
mov eax, 0xffffffff
jmp 0x41b0dc
add eax, 0x12
push eax
call fcn.004090b0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41b111
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41b100
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41b141
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b130
mov word [eax], 0
push edi
push esi
call fcn.0043b0a0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4431c8]

Function at 0x420fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x868
lea ebx, [esp + 0xec]
xor edi, edi
mov eax, 0x20219
mov ecx, 1
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
jmp dword [ecx*4 + 0x444550]
Function at 0x439190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 0x28], 0xbbb8e3f9
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov word [esp + 0x34], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xd
ja 0x43921e
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x775cfcb7
mov esi, ecx
and esi, edx
mov edi, ecx
xor edi, edx
or ecx, edx
xor ecx, edi
lea edx, [edi + esi*2]
add ecx, esi
sub edx, ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
dec cl
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
mov ecx, dword [esp]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp ecx, 0xe
jb 0x4391d0
xor ecx, ecx
cmp dword [esp + 0x28], eax
setne cl
mov eax, dword [ecx*4 + 0x447964]
mov ecx, 0xeb14e534
xor ecx, dword [0x44796c]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x43a02f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x5b5a5908
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x43a0b9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov eax, dword [esp]
movzx edi, byte [esp + eax + 8]
lea eax, [esi + 0x4117f1cc]
lea edx, [esi + edi]
add edx, 0x4117f1cc
add esi, 0xcc
and esi, edi
and eax, edi
add eax, esi
mov esi, edx
not esi
and esi, eax
not eax
and eax, edx
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov edx, eax
xor edx, 0x6b
and eax, 0x6b
lea eax, [edx + eax*2]
inc al
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x43a060
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x448510]
mov ecx, dword [case.0x43a0c7.4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [eax + 8]
mov edx, dword [case.0x43a0c7.0]
nop
nop
nop
nop
nop
jmp edx
mov edx, dword [eax + 0xc]
add edx, 0xc
mov edi, dword [0x448544]
xor eax, eax
mov esi, edx
jmp edi
Function at 0x43a446
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov dword [esp + 8], 0x6364c3d5
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xf
ja 0x43a3b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0x649e6991]
add ecx, 0x91
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
mov edx, ecx
or edx, 8
and ecx, 8
add ecx, edx
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x10
jb 0x43a370
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
jmp dword [ecx*4 + 0x448630]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + edx]
mov dword [esp + 8], 0xfbf83eb6
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x43a42d
mov ecx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [ecx + esi]
add edi, 0x9b6dcaff
add ecx, 0x9b6dcaff
and ecx, esi
add ecx, ecx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 7
mov esi, dword [esp]
mov byte [esp + esi + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb case.default.0x43a438
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448648]
jmp dword [0x448658]
mov esi, dword [ebx + edx + 0x7c]
mov edx, dword [ebx + edx + 0x78]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x448660]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x448668]
mov dword [esp + 0x18], esi
mov eax, dword [ebx + edx + 0x20]
add eax, ebx
mov dword [esp + 0x30], eax
mov eax, dword [ebx + edx + 0x24]
add eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + edx + 0x1c]
add eax, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], edx
mov ecx, dword [ebx + edx + 0x18]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x2c], ecx
cmp ebx, ecx
setb al
mov ecx, 1
jmp dword [eax*4 + 0x448680]
xor eax, eax
jmp dword [0x448644]
mov ecx, dword [case.0x43a438.1]
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ad20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ad40
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43ad5b
mov eax, 0xffffffff
jmp 0x43ad5e
add eax, 0xa
push eax
call fcn.004090b0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43ada1
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43ad90
mov word [ecx], 0
mov ecx, 3
sub ecx, edi
and ecx, 2
mov edx, eax
and edx, 0xfffd
imul edx, ecx
and edi, 2
or eax, 2
imul eax, edi
add eax, edx
mov word [esp + 4], ax
mov ecx, eax
and ecx, 2
xor eax, 2
lea eax, [eax + ecx*2]
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x48494e4f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43ae6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0xa4188a8a
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x3a
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43ae40
mov edi, dword [esp + 0x10]
mov eax, dword [0x449c38]
test eax, eax
je 0x43aedd
xor ecx, ecx
mov edx, dword [0x449c3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x7a96736e
je 0x43aea0
inc ecx
cmp eax, ecx
jne 0x43ae90
jmp 0x43aedd
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43aedd
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x449c40]
push eax
call fcn.00438170
add esp, 0x38
mov edi, eax
push esi
call fcn.004090c0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43af10
cmp edi, 0xfffffff5
jge 0x43af27
mov eax, 0xffffffff
jmp 0x43af2a
lea eax, [edi + 0xa]
push eax
call fcn.004090b0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43af71
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43af60
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x48494e4f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43b01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0xa4188a8a
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x3a
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43aff0
mov edi, dword [esp + 0x10]
mov eax, dword [0x449c38]
test eax, eax
je 0x43b081
xor ecx, ecx
mov edx, dword [0x449c3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x366ceda
je 0x43b050
inc ecx
cmp eax, ecx
jne 0x43b040
jmp 0x43b081
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b081
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x449c40]
push eax
call fcn.00438170
add esp, 0x24
mov edi, eax
push esi
call fcn.004090c0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43b0c0
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43b0db
mov eax, 0xffffffff
jmp 0x43b0de
add eax, 0xa
push eax
call fcn.004090b0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43b121
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43b110
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 4], cx
add eax, edx
add eax, 2
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x48494e4f
mov dword [esp + 0x2c], 0
mov byte [esp + 0x30], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43b1de
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
add eax, 0xa4188a8a
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x3a
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43b1b0
mov edi, dword [esp + 0x28]
mov eax, dword [0x449c38]
test eax, eax
je 0x43b235
xor ecx, ecx
mov edx, dword [0x449c3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x43b210
inc ecx
cmp eax, ecx
jne 0x43b200
jmp 0x43b235
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b235
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x449c40]
push eax
call fcn.00438170
add esp, 0x14
mov edi, eax
push esi
call fcn.004090c0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b24b
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret